Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Happy.6912

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:47:15.537958837Z 53 PC: 13652 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:15.540383612Z 53 PC: 13652 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:47:15.541645504Z 53 PC: 13652 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:47:15.542805712Z 53 PC: 13652 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:47:15.544292818Z 53 PC: 13652 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:15.545751007Z 53 PC: 13652 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:15.547106516Z 53 PC: 13652 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:47:15.548447233Z 53 PC: 13652 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:47:15.549941634Z 53 PC: 13652 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:47:15.551126559Z 53 PC: 13652 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:47:15.552285216Z 53 PC: 13652 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:47:15.554620656Z 53 PC: 13652 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:47:15.556227386Z 53 PC: 13652 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:47:15.557829458Z 53 PC: 13652 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:47:15.560641447Z 53 PC: 13652 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:47:15.562056471Z 53 PC: 13652 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:47:15.563410604Z 53 PC: 13652 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:47:15.566040971Z 53 PC: 13652 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:15.574378927Z 53 PC: 13652 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:47:15.576147782Z 37 PC: 13667 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:15.578093145Z 37 PC: 1366f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:15.579766355Z 37 PC: 13677 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:15.58106613Z 37 PC: 1367f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:15.582810878Z 68 PC: 13c52 | I/O control for devices (Set for = '')
2018-12-17T22:47:15.584877103Z 48 PC: 142d7 | Get DOS version
2018-12-17T22:47:15.586988887Z 26 PC: 133a3 | Set disk transfer address
2018-12-17T22:47:15.588240173Z 78 PC: 133af | Find first file
2018-12-17T22:47:15.597904189Z 67 PC: 1332c | Get or set file attributes
2018-12-17T22:47:15.616558001Z 61 PC: 14189 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:47:15.625568191Z 63 PC: 1425c | Read file or device (Read 6912 bytes on handle 5)
2018-12-17T22:47:15.636032006Z 66 PC: 142bb | Move file pointer
2018-12-17T22:47:15.646008471Z 63 PC: 1425c | Read file or device (Read 6912 bytes on handle 5)
2018-12-17T22:47:15.658300136Z 66 PC: 142bb | Move file pointer
2018-12-17T22:47:15.661197246Z 64 PC: 1425c | Write file or device (Write 6912 bytes on handle 5)
2018-12-17T22:47:15.670478064Z 66 PC: 142bb | Move file pointer
2018-12-17T22:47:15.671821696Z 64 PC: 141ba | Write file or device (Write 0 bytes on handle 5)
2018-12-17T22:47:15.682861789Z 62 PC: 141d9 | Close file
2018-12-17T22:47:15.692615964Z 61 PC: 14189 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:47:15.69696415Z 87 PC: 13373 | Get or set file date and time
2018-12-17T22:47:15.698292959Z 62 PC: 141d9 | Close file
2018-12-17T22:47:16.019533269Z 67 PC: 1332c | Get or set file attributes
2018-12-17T22:47:16.031168902Z 54 PC: 132cc | Get free disk space
2018-12-17T22:47:16.041795177Z 26 PC: 133a3 | Set disk transfer address
2018-12-17T22:47:16.043790592Z 78 PC: 133af | Find first file
2018-12-17T22:47:16.056213402Z 25 PC: 134fa | Get default drive
2018-12-17T22:47:16.058074512Z 71 PC: 13519 | Get current directory
2018-12-17T22:47:16.069450624Z 61 PC: 14189 | Open file (Filename = 'A:\SLEEP.COM')
2018-12-17T22:47:16.080938162Z 66 PC: 142bb | Move file pointer
2018-12-17T22:47:16.082747155Z 63 PC: 1425c | Read file or device (Read 2 bytes on handle 5)
2018-12-17T22:47:16.085723402Z 62 PC: 141d9 | Close file
2018-12-17T22:47:16.087933979Z 67 PC: 1332c | Get or set file attributes
2018-12-17T22:47:16.099479893Z 61 PC: 14189 | Open file (Filename = 'A:\SLEEP.COM')
2018-12-17T22:47:16.108131934Z 63 PC: 1425c | Read file or device (Read 6912 bytes on handle 5)
2018-12-17T22:47:16.116260572Z 66 PC: 142bb | Move file pointer
2018-12-17T22:47:16.118365519Z 64 PC: 1425c | Write file or device (Write 6912 bytes on handle 5)
2018-12-17T22:47:16.128847663Z 66 PC: 142bb | Move file pointer
2018-12-17T22:47:16.133072537Z 64 PC: 1425c | Write file or device (Write 407 bytes on handle 5)
2018-12-17T22:47:16.142618254Z 62 PC: 141d9 | Close file
2018-12-17T22:47:16.151993455Z 61 PC: 14189 | Open file (Filename = 'A:\SLEEP.COM')
2018-12-17T22:47:16.157775858Z 87 PC: 13373 | Get or set file date and time
2018-12-17T22:47:16.159210479Z 62 PC: 141d9 | Close file
2018-12-17T22:47:16.163956346Z 67 PC: 1332c | Get or set file attributes
2018-12-17T22:47:16.171049847Z 26 PC: 133c7 | Set disk transfer address
2018-12-17T22:47:16.172232876Z 79 PC: 133cc | Find next file
2018-12-17T22:47:16.175665574Z 53 PC: 1340a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:16.177539099Z 37 PC: 13413 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:16.178735407Z 53 PC: 1340a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:47:16.179952323Z 37 PC: 13413 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:47:16.182560152Z 53 PC: 1340a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:47:16.184461879Z 37 PC: 13413 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:47:16.18600272Z 53 PC: 1340a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:47:16.188372497Z 37 PC: 13413 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:47:16.189874657Z 53 PC: 1340a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:16.191326697Z 37 PC: 13413 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:16.192731552Z 53 PC: 1340a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:16.19503322Z 37 PC: 13413 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:16.196281936Z 53 PC: 1340a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:47:16.19750038Z 37 PC: 13413 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:47:16.199968949Z 53 PC: 1340a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:47:16.201271846Z 37 PC: 13413 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:47:16.202519948Z 53 PC: 1340a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:47:16.206316709Z 37 PC: 13413 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:47:16.207889591Z 53 PC: 1340a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:47:16.209487007Z 37 PC: 13413 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:47:16.211640167Z 53 PC: 1340a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:47:16.213357153Z 37 PC: 13413 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:47:16.214876902Z 53 PC: 1340a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:47:16.217396784Z 37 PC: 13413 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:47:16.228147957Z 53 PC: 1340a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:47:16.229380801Z 37 PC: 13413 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:47:16.230729659Z 53 PC: 1340a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:47:16.232325228Z 37 PC: 13413 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:47:16.233539661Z 53 PC: 1340a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:47:16.234803389Z 37 PC: 13413 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:47:16.236930919Z 53 PC: 1340a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:47:16.238637536Z 37 PC: 13413 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:47:16.240179356Z 53 PC: 1340a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:47:16.242863687Z 37 PC: 13413 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:47:16.244415192Z 53 PC: 1340a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:16.246042024Z 37 PC: 13413 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:16.248046196Z 53 PC: 1340a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:47:16.249599201Z 37 PC: 13413 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:47:16.251287135Z 74 PC: 1324b | Reallocate memory
2018-12-17T22:47:16.25445812Z 41 PC: 13493 | Parse filename
2018-12-17T22:47:16.256443138Z 41 PC: 134a1 | Parse filename
2018-12-17T22:47:16.258410072Z 75 PC: 134ac | Execute program
2018-12-17T22:47:16.276678158Z 9 PC: 1ce7e | Display string (String= 'DEFGH - A 10000 byte COM test file 1994. ')
2018-12-17T22:47:16.283487612Z 74 PC: 1324b | Reallocate memory
2018-12-17T22:47:16.285702984Z 53 PC: 1340a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:16.288421408Z 37 PC: 13413 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:16.28991109Z 53 PC: 1340a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:47:16.291354587Z 37 PC: 13413 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:47:16.293018323Z 53 PC: 1340a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:47:16.294979566Z 37 PC: 13413 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:47:16.297490656Z 53 PC: 1340a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:47:16.299469592Z 37 PC: 13413 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:47:16.301935832Z 53 PC: 1340a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:16.30358009Z 37 PC: 13413 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:16.305693275Z 53 PC: 1340a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:16.308404908Z 37 PC: 13413 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:16.309697597Z 53 PC: 1340a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:47:16.311391204Z 37 PC: 13413 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:47:16.313976283Z 53 PC: 1340a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:47:16.31566834Z 37 PC: 13413 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:47:16.317249275Z 53 PC: 1340a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:47:16.320122221Z 37 PC: 13413 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:47:16.321707417Z 53 PC: 1340a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:47:16.323352981Z 37 PC: 13413 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:47:16.325558954Z 53 PC: 1340a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:47:16.326985155Z 37 PC: 13413 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:47:16.328789459Z 53 PC: 1340a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:47:16.330911673Z 37 PC: 13413 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:47:16.332149959Z 53 PC: 1340a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:47:16.33340515Z 37 PC: 13413 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:47:16.335847545Z 53 PC: 1340a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:47:16.337754485Z 37 PC: 13413 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:47:16.339144327Z 53 PC: 1340a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:47:16.341081324Z 37 PC: 13413 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:47:16.342387216Z 53 PC: 1340a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:47:16.343601654Z 37 PC: 13413 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:47:16.353770704Z 53 PC: 1340a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:47:16.355420026Z 37 PC: 13413 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:47:16.356780657Z 53 PC: 1340a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:16.359190908Z 37 PC: 13413 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:16.360981461Z 53 PC: 1340a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:47:16.362782106Z 37 PC: 13413 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:47:16.365093473Z 67 PC: 1332c | Get or set file attributes
2018-12-17T22:47:16.376192386Z 61 PC: 14189 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:47:16.383732453Z 63 PC: 1425c | Read file or device (Read 6912 bytes on handle 5)
2018-12-17T22:47:16.394148677Z 66 PC: 142bb | Move file pointer
2018-12-17T22:47:16.396852827Z 64 PC: 1425c | Write file or device (Write 6912 bytes on handle 5)
2018-12-17T22:47:16.415502849Z 66 PC: 142bb | Move file pointer
2018-12-17T22:47:16.417462706Z 64 PC: 1425c | Write file or device (Write 6912 bytes on handle 5)
2018-12-17T22:47:16.428025526Z 62 PC: 141d9 | Close file
2018-12-17T22:47:16.437181706Z 61 PC: 14189 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:47:16.445029858Z 87 PC: 13373 | Get or set file date and time
2018-12-17T22:47:16.447299529Z 62 PC: 141d9 | Close file
2018-12-17T22:47:16.455723535Z 67 PC: 1332c | Get or set file attributes
2018-12-17T22:47:16.469980755Z 42 PC: 13257 | Get date 0x13257: xor ah, ah
0x13259: les di, ptr [bp + 6]
0x1325c: stosw word ptr es:[di], ax
0x1325d: mov al, dl
0x1325f: les di, ptr [bp + 0xa]
0x13262: stosw word ptr es:[di], ax
0x13263: mov al, dh
0x13265: les di, ptr [bp + 0xe]
0x13268: stosw word ptr es:[di], ax
0x13269: xchg ax, cx
0x1326a: les di, ptr [bp + 0x12]
0x1326d: stosw word ptr es:[di], ax
0x1326e: pop bp
0x1326f: retf 0x10
0x13272: push bp
0x13273: mov bp, sp
0x13275: mov cx, word ptr [bp + 0xa]
0x13278: mov dh, byte ptr [bp + 8]
0x1327b: mov dl, byte ptr [bp + 6]
0x1327e: mov ah, 0x2b
2018-12-17T22:47:16.473307731Z 64 PC: 13d55 | Write file or device (Write 0 bytes on handle 1)
2018-12-17T22:47:16.475856083Z 37 PC: 13766 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:16.477709286Z 37 PC: 13766 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:47:16.480707439Z 37 PC: 13766 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:47:16.482527569Z 37 PC: 13766 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:47:16.484348472Z 37 PC: 13766 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:16.487096264Z 37 PC: 13766 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:16.488541198Z 37 PC: 13766 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:47:16.489968903Z 37 PC: 13766 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:47:16.492379508Z 37 PC: 13766 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:47:16.493770518Z 37 PC: 13766 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:47:16.495475069Z 37 PC: 13766 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:47:16.497732693Z 37 PC: 13766 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:47:16.499428577Z 37 PC: 13766 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:47:16.501094885Z 37 PC: 13766 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:47:16.503304189Z 37 PC: 13766 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:47:16.504805773Z 37 PC: 13766 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:47:16.506259576Z 37 PC: 13766 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:47:16.508314349Z 37 PC: 13766 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:16.509996373Z 37 PC: 13766 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:47:16.511392506Z 76 PC: 137a5 | Terminate with return code (Return code = '0')