Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Carol.20500

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:47:18.49946659Z 53 PC: 1325a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:18.501721711Z 53 PC: 1325a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:47:18.503235744Z 53 PC: 1325a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:47:18.504682232Z 53 PC: 1325a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:47:18.506827864Z 53 PC: 1325a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:18.508341609Z 53 PC: 1325a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:18.509855884Z 53 PC: 1325a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:47:18.512094728Z 53 PC: 1325a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:47:18.513746202Z 53 PC: 1325a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:47:18.515325589Z 53 PC: 1325a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:47:18.521331527Z 53 PC: 1325a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:47:18.52251908Z 53 PC: 1325a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:47:18.523648621Z 53 PC: 1325a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:47:18.525032411Z 53 PC: 1325a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:47:18.527942871Z 53 PC: 1325a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:47:18.53031515Z 53 PC: 1325a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:47:18.535223314Z 53 PC: 1325a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:47:18.539270386Z 53 PC: 1325a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:18.540701904Z 53 PC: 1325a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:47:18.542135903Z 37 PC: 1326f | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:18.544363409Z 37 PC: 13277 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:18.545755167Z 37 PC: 1327f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:18.547086179Z 37 PC: 13287 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:18.549626593Z 68 PC: 13ae5 | I/O control for devices (Set for = '')
2018-12-17T22:47:18.551216724Z 42 PC: 12f9d | Get date 0x12f9d: mov byte ptr [0x56], dh
0x12fa1: mov byte ptr [0x57], dl
0x12fa5: mov ah, 0x2c
0x12fa7: int 0x21
0x12fa9: mov byte ptr [0x58], ch
0x12fad: mov byte ptr [0x59], dh
0x12fb1: cmp byte ptr [0x57], 8
0x12fb6: mov al, 0
0x12fb8: jne 0x12fbb
0x12fba: inc ax
0x12fbb: mov dl, al
0x12fbd: cmp byte ptr [0x56], 1
0x12fc2: mov al, 0
0x12fc4: jne 0x12fc7
0x12fc6: inc ax
0x12fc7: and al, dl
0x12fc9: or al, al
0x12fcb: je 0x12fef
0x12fcd: mov di, 0x501
0x12fd0: push cs
2018-12-17T22:47:18.553485828Z 44 PC: 12fa9 | Get time 0x12fa9: mov byte ptr [0x58], ch
0x12fad: mov byte ptr [0x59], dh
0x12fb1: cmp byte ptr [0x57], 8
0x12fb6: mov al, 0
0x12fb8: jne 0x12fbb
0x12fba: inc ax
0x12fbb: mov dl, al
0x12fbd: cmp byte ptr [0x56], 1
0x12fc2: mov al, 0
0x12fc4: jne 0x12fc7
0x12fc6: inc ax
0x12fc7: and al, dl
0x12fc9: or al, al
0x12fcb: je 0x12fef
0x12fcd: mov di, 0x501
0x12fd0: push cs
0x12fd1: push di
0x12fd2: mov di, 0x5b
0x12fd5: push ds
0x12fd6: push di
2018-12-17T22:47:18.557356987Z 48 PC: 13810 | Get DOS version
2018-12-17T22:47:18.558741312Z 48 PC: 13810 | Get DOS version
2018-12-17T22:47:18.560344212Z 61 PC: 136c2 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:47:18.569527893Z 63 PC: 13795 | Read file or device (Read 4864 bytes on handle 5)
2018-12-17T22:47:18.578185188Z 62 PC: 13712 | Close file
2018-12-17T22:47:18.580976043Z 26 PC: 130d7 | Set disk transfer address
2018-12-17T22:47:18.583217444Z 78 PC: 130e3 | Find first file
2018-12-17T22:47:18.590867903Z 61 PC: 136c2 | Open file (Filename = 'TEST.EXE')
2018-12-17T22:47:18.597936033Z 66 PC: 137f4 | Move file pointer
2018-12-17T22:47:18.600545742Z 63 PC: 13795 | Read file or device (Read 5 bytes on handle 5)
2018-12-17T22:47:18.606618878Z 26 PC: 130fb | Set disk transfer address
2018-12-17T22:47:18.608228822Z 79 PC: 13100 | Find next file
2018-12-17T22:47:18.612072732Z 48 PC: 13810 | Get DOS version
2018-12-17T22:47:18.614611791Z 26 PC: 130d7 | Set disk transfer address
2018-12-17T22:47:18.616129635Z 78 PC: 130e3 | Find first file
2018-12-17T22:47:18.62227311Z 48 PC: 13810 | Get DOS version
2018-12-17T22:47:18.624395963Z 67 PC: 130a6 | Get or set file attributes
2018-12-17T22:47:18.63927672Z 61 PC: 136c2 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:47:18.64605799Z 66 PC: 137f4 | Move file pointer
2018-12-17T22:47:18.648317962Z 63 PC: 13795 | Read file or device (Read 4864 bytes on handle 6)
2018-12-17T22:47:18.656358399Z 66 PC: 137f4 | Move file pointer
2018-12-17T22:47:18.657822122Z 64 PC: 136f3 | Write file or device (Write 0 bytes on handle 6)
2018-12-17T22:47:18.666264169Z 66 PC: 137f4 | Move file pointer
2018-12-17T22:47:18.668087124Z 64 PC: 13795 | Write file or device (Write 4864 bytes on handle 6)
2018-12-17T22:47:18.676302423Z 62 PC: 13712 | Close file
2018-12-17T22:47:18.684565868Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:18.686027227Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:18.687476567Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:47:18.689351196Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:47:18.690689245Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:47:18.692079539Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:47:18.694330991Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:47:18.695707319Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:47:18.697003727Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:18.703884814Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:18.705255698Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:18.706640038Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:18.708829523Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:47:18.710429457Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:47:18.711645593Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:47:18.713295401Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:47:18.714760459Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:47:18.716021404Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:47:18.718235229Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:47:18.719421151Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:47:18.720460724Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:47:18.722416703Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:47:18.723691184Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:47:18.724931313Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:47:18.726767054Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:47:18.730385349Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:47:18.731695643Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:47:18.739425243Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:47:18.74135129Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:47:18.742447498Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:47:18.743733714Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:47:18.745335941Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:47:18.746379336Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:47:18.747720829Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:47:18.749550925Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:18.750936688Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:18.753037712Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:47:18.754756291Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:47:18.75599012Z 41 PC: 1318f | Parse filename
2018-12-17T22:47:18.757353696Z 41 PC: 1319d | Parse filename
2018-12-17T22:47:18.758907988Z 75 PC: 131a8 | Execute program
2018-12-17T22:47:18.774509554Z 9 PC: 17318 | Display string (Could not find end pointer)
2018-12-17T22:47:18.788222768Z 76 PC: 1731c | Terminate with return code (Return code = '36')
2018-12-17T22:47:18.792150925Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:18.793471789Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:18.794749981Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:47:18.79705049Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:47:18.798401711Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:47:18.799777993Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:47:18.801922297Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:47:18.803132038Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:47:18.804382619Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:18.806323259Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:18.807561085Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:18.808924291Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:18.810914153Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:47:18.812156829Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:47:18.813483022Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:47:18.81549295Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:47:18.816666233Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:47:18.817719614Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:47:18.819438991Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:47:18.820637211Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:47:18.821664107Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:47:18.823618766Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:47:18.824791296Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:47:18.825859437Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:47:18.834399842Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:47:18.835757527Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:47:18.837787698Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:47:18.839551966Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:47:18.840855662Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:47:18.841900712Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:47:18.843291665Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:47:18.844476099Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:47:18.845504838Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:47:18.847473476Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:47:18.848788451Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:18.850136768Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:18.85196049Z 53 PC: 131d8 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:47:18.853094274Z 37 PC: 131e1 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:47:18.854186302Z 48 PC: 13810 | Get DOS version
2018-12-17T22:47:18.85624023Z 67 PC: 130a6 | Get or set file attributes
2018-12-17T22:47:18.866184097Z 61 PC: 136c2 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:47:18.872672262Z 64 PC: 13795 | Write file or device (Write 4864 bytes on handle 6)
2018-12-17T22:47:18.880687251Z 66 PC: 137f4 | Move file pointer
2018-12-17T22:47:18.882718598Z 64 PC: 13795 | Write file or device (Write 4864 bytes on handle 6)
2018-12-17T22:47:18.890712652Z 66 PC: 137f4 | Move file pointer
2018-12-17T22:47:18.892566344Z 64 PC: 13795 | Write file or device (Write 5 bytes on handle 6)
2018-12-17T22:47:18.895997846Z 62 PC: 13712 | Close file
2018-12-17T22:47:18.904532301Z 64 PC: 1361d | Write file or device (Write 0 bytes on handle 1)
2018-12-17T22:47:18.909603713Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:47:18.911401098Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:47:18.912470281Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:47:18.913875436Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:47:18.915642009Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:18.916675536Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:18.91799825Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:47:18.919749903Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:47:18.921138455Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:47:18.922713616Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:47:18.924488526Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:47:18.925802864Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:47:18.937379199Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:47:18.938639594Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:47:18.939689822Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:47:18.941391785Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:47:18.942832906Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:47:18.943913479Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:47:18.946057383Z 37 PC: 133b1 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:47:18.947124394Z 76 PC: 133f0 | Terminate with return code (Return code = '0')