Sample viewer

vx.netlux.org/Virus.DOS.Chomik.704

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:46:52.308329673Z 48 PC: 14497 | Get DOS version
2018-12-17T22:46:52.309351462Z 255 PC: 144a0 | UNKNOWN!
2018-12-17T22:46:52.310540226Z 88 PC: 144df | case 0xGet or set allocation strateg:
2018-12-17T22:46:52.312318427Z 82 PC: 144e3 | Get DOS internal pointers (SYSVARS)
2018-12-17T22:46:52.313904246Z 42 PC: 14523 | Get date 0x14523: cmp dx, 0x30d
0x14527: nop
0x14528: nop
0x14529: mov word ptr [0xa7], 0x9090
0x1452f: shr al, 1
0x14531: jae 0x14548
0x14533: mov ax, 0x3509
0x14536: int 0x21
0x14538: mov word ptr [0x118], bx
0x1453c: mov word ptr [0x11a], es
0x14540: mov dx, 0xe0
0x14543: mov ax, 0x2509
0x14546: int 0x21
0x14548: mov ax, 0x3521
0x1454b: int 0x21
0x1454d: mov word ptr [0x127], bx
0x14551: mov word ptr [0x129], es
0x14555: mov dx, 0x11c
0x14558: mov ax, 0x2521
0x1455b: int 0x21
2018-12-17T22:46:52.317761604Z 53 PC: 14538 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-17T22:46:52.318955958Z 37 PC: 14548 | Set interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-17T22:46:52.320396945Z 53 PC: 1454d | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:46:52.322794199Z 37 PC: 1455d | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:46:52.32404549Z 53 PC: 13452 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:46:52.325213775Z 53 PC: 13452 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:46:52.328167545Z 53 PC: 13452 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:46:52.329525065Z 53 PC: 13452 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:46:52.330995067Z 53 PC: 13452 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:46:52.332895698Z 53 PC: 13452 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:52.33425417Z 53 PC: 13452 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:46:52.335403559Z 53 PC: 13452 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:46:52.337890662Z 53 PC: 13452 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:46:52.344255341Z 53 PC: 13452 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:46:52.345997464Z 53 PC: 13452 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:46:52.347712546Z 53 PC: 13452 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:46:52.350901127Z 53 PC: 13452 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:46:52.352639483Z 53 PC: 13452 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:46:52.353828567Z 53 PC: 13452 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:46:52.362839577Z 53 PC: 13452 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:46:52.365266817Z 53 PC: 13452 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:46:52.366836145Z 53 PC: 13452 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:46:52.368733069Z 53 PC: 13452 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:46:52.369896555Z 37 PC: 13467 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:46:52.370962478Z 37 PC: 1346f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:46:52.372936106Z 37 PC: 13477 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:52.374275423Z 37 PC: 1347f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:46:52.375890197Z 68 PC: 137ef | I/O control for devices (Set for = '')
2018-12-17T22:46:52.403115989Z 37 PC: 12e75 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:46:52.408303084Z 58 PC: 142fa | Remove subdirectory
2018-12-17T22:46:52.417754141Z 25 PC: 14233 | Get default drive
2018-12-17T22:46:52.419016202Z 71 PC: 14246 | Get current directory
2018-12-17T22:46:52.423483405Z 59 PC: 142fa | Change current directory
2018-12-17T22:46:52.429919147Z 14 PC: 1428c | Set default drive (Drive = 'A')
2018-12-17T22:46:52.431539491Z 25 PC: 14290 | Get default drive
2018-12-17T22:46:52.434075496Z 59 PC: 142fa | Change current directory
2018-12-17T22:46:52.611262226Z 54 PC: 12d6a | Get free disk space
2018-12-17T22:46:52.621891026Z 67 PC: 12dca | Get or set file attributes
2018-12-17T22:46:52.628504031Z 60 PC: 1407a | Create or truncate file
2018-12-17T22:46:53.005771234Z 62 PC: 140ca | Close file
2018-12-17T22:46:53.008233541Z 65 PC: 141c3 | Delete file (Filename = 'C:\mempatch.exe')
2018-12-17T22:46:53.019541146Z 37 PC: 13566 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:46:53.02170407Z 37 PC: 13566 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:46:53.023526804Z 37 PC: 13566 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:46:53.025422626Z 37 PC: 13566 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:46:53.027954373Z 37 PC: 13566 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:46:53.029333754Z 37 PC: 13566 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:53.030830737Z 37 PC: 13566 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:46:53.033372322Z 37 PC: 13566 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:46:53.034880245Z 37 PC: 13566 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:46:53.036114804Z 37 PC: 13566 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:46:53.038106075Z 37 PC: 13566 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:46:53.039740917Z 37 PC: 13566 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:46:53.041348889Z 37 PC: 13566 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:46:53.043688314Z 37 PC: 13566 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:46:53.04575651Z 37 PC: 13566 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:46:53.047338041Z 37 PC: 13566 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:46:53.050602144Z 37 PC: 13566 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:46:53.05229801Z 37 PC: 13566 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:46:53.053846249Z 37 PC: 13566 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:46:53.05539604Z 76 PC: 135a5 | Terminate with return code (Return code = '0')