Sample viewer

vx.netlux.org/Virus.DOS.Demon3b.4390

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:47:33.88547921Z 73 PC: 12bb5 | Release memory
2018-12-17T22:47:33.887700089Z 72 PC: 12bbc | Allocate memory
2018-12-17T22:47:33.889367188Z 74 PC: 12bcd | Reallocate memory
2018-12-17T22:47:33.890708174Z 74 PC: 12be2 | Reallocate memory
2018-12-17T22:47:33.903068864Z 77 PC: 11fe0 | Get program return code
2018-12-17T22:47:33.904440231Z 72 PC: 12174 | Allocate memory
2018-12-17T22:47:33.906326941Z 72 PC: 1218d | Allocate memory
2018-12-17T22:47:33.910633934Z 44 PC: 9ed5b | Get time 0x9ed5b: ret
0x9ed5c: push ds
0x9ed5d: call 0x9f096
0x9ed60: shl bx, 1
0x9ed62: shl bx, 1
0x9ed64: cli
0x9ed65: mov ax, word ptr [bx]
0x9ed67: mov dx, word ptr [bx + 2]
0x9ed6a: sti
0x9ed6b: pop ds
0x9ed6c: ret
0x9ed6d: push cx
0x9ed6e: push ds
0x9ed6f: call 0x9f096
0x9ed72: mov cl, 2
0x9ed74: shl bx, cl
0x9ed76: cli
0x9ed77: mov word ptr [bx], dx
0x9ed79: mov word ptr [bx + 2], cs
0x9ed7c: sti
2018-12-17T22:47:33.9136117Z 37 PC: 123c4 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T22:47:33.915383223Z 44 PC: 9ed5b | Get time 0x9ed5b: ret
0x9ed5c: push ds
0x9ed5d: call 0x9f096
0x9ed60: shl bx, 1
0x9ed62: shl bx, 1
0x9ed64: cli
0x9ed65: mov ax, word ptr [bx]
0x9ed67: mov dx, word ptr [bx + 2]
0x9ed6a: sti
0x9ed6b: pop ds
0x9ed6c: ret
0x9ed6d: push cx
0x9ed6e: push ds
0x9ed6f: call 0x9f096
0x9ed72: mov cl, 2
0x9ed74: shl bx, cl
0x9ed76: cli
0x9ed77: mov word ptr [bx], dx
0x9ed79: mov word ptr [bx + 2], cs
0x9ed7c: sti
2018-12-17T22:47:33.918623458Z 37 PC: 123cb | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:33.922058765Z 44 PC: 9ed5b | Get time 0x9ed5b: ret
0x9ed5c: push ds
0x9ed5d: call 0x9f096
0x9ed60: shl bx, 1
0x9ed62: shl bx, 1
0x9ed64: cli
0x9ed65: mov ax, word ptr [bx]
0x9ed67: mov dx, word ptr [bx + 2]
0x9ed6a: sti
0x9ed6b: pop ds
0x9ed6c: ret
0x9ed6d: push cx
0x9ed6e: push ds
0x9ed6f: call 0x9f096
0x9ed72: mov cl, 2
0x9ed74: shl bx, cl
0x9ed76: cli
0x9ed77: mov word ptr [bx], dx
0x9ed79: mov word ptr [bx + 2], cs
0x9ed7c: sti
2018-12-17T22:47:33.924523717Z 37 PC: 123d2 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:33.926575955Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.935136146Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.937641455Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.94004187Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.943273644Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.945632735Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.947929422Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.950899967Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.953250231Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.955297639Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.957981927Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.960197069Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.962460157Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.965293076Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.968098806Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:33.972016423Z 47 PC: 9ed5b | Get disk transfer address
2018-12-17T22:47:33.985216283Z 26 PC: 9ed5b | Set disk transfer address
2018-12-17T22:47:33.986335129Z 78 PC: 9ed5b | Find first file
2018-12-17T22:47:33.991853755Z 61 PC: 9ed5b | Open file (Filename = 'C:\COMMAND.COM')
2018-12-17T22:47:33.998220126Z 63 PC: 9ed5b | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:47:34.001149665Z 66 PC: 9ed5b | Move file pointer
2018-12-17T22:47:34.002495599Z 66 PC: 9ed5b | Move file pointer
2018-12-17T22:47:34.00398121Z 63 PC: 9ed5b | Read file or device (Read 2 bytes on handle 5)
2018-12-17T22:47:34.007657735Z 66 PC: 9ed5b | Move file pointer
2018-12-17T22:47:34.009559523Z 87 PC: 9ed5b | Get or set file date and time
2018-12-17T22:47:34.011384092Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:34.355573485Z 67 PC: 9ed5b | Get or set file attributes
2018-12-17T22:47:34.365656267Z 26 PC: 9ed5b | Set disk transfer address
2018-12-17T22:47:34.367626606Z 61 PC: 12354 | Open file (Filename = 'C:\COMMAND.COM')
2018-12-17T22:47:34.375716465Z 66 PC: 12372 | Move file pointer
2018-12-17T22:47:34.378179177Z 44 PC: 9ed5b | Get time 0x9ed5b: ret
0x9ed5c: push ds
0x9ed5d: call 0x9f096
0x9ed60: shl bx, 1
0x9ed62: shl bx, 1
0x9ed64: cli
0x9ed65: mov ax, word ptr [bx]
0x9ed67: mov dx, word ptr [bx + 2]
0x9ed6a: sti
0x9ed6b: pop ds
0x9ed6c: ret
0x9ed6d: push cx
0x9ed6e: push ds
0x9ed6f: call 0x9f096
0x9ed72: mov cl, 2
0x9ed74: shl bx, cl
0x9ed76: cli
0x9ed77: mov word ptr [bx], dx
0x9ed79: mov word ptr [bx + 2], cs
0x9ed7c: sti
2018-12-17T22:47:34.380853498Z 63 PC: 12383 | Read file or device (Read 44693 bytes on handle 5)
2018-12-17T22:47:34.39520436Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:34.398567186Z 47 PC: 9ed5b | Get disk transfer address
2018-12-17T22:47:34.400278565Z 26 PC: 9ed5b | Set disk transfer address
2018-12-17T22:47:34.401670981Z 78 PC: 9ed5b | Find first file
2018-12-17T22:47:34.408506737Z 26 PC: 9ed5b | Set disk transfer address
2018-12-17T22:47:34.411702267Z 99 PC: 992b7 | Get DBCS lead byte table pointer
2018-12-17T22:47:34.413340507Z 56 PC: 93ad9 | Get or set country info
2018-12-17T22:47:34.416609904Z 64 PC: 99528 | Write file or device (Write 2 bytes on handle 1)
2018-12-17T22:47:34.422053148Z 25 PC: 93b42 | Get default drive
2018-12-17T22:47:34.42535113Z 71 PC: 95dbd | Get current directory
2018-12-17T22:47:34.431182968Z 64 PC: 99528 | Write file or device (Write 3 bytes on handle 1)
2018-12-17T22:47:34.435319054Z 2 PC: 95d92 | Character output (Char = '3e')
2018-12-17T22:47:34.438375356Z 93 PC: 93c00 | File sharing functions
2018-12-17T22:47:34.441996218Z 93 PC: 93c07 | File sharing functions
2018-12-17T22:47:34.444722085Z 10 PC: 93c19 | Buffered keyboard input
2018-12-17T22:47:48.853546534Z 0 PC: 0 | Program terminate
2018-12-17T22:47:50.208107137Z 0 PC: 0 | Program terminate
2018-12-17T22:47:50.310739395Z 64 PC: 99528 | Write file or device (Write 2 bytes on handle 1)
2018-12-17T22:47:50.318302801Z 41 PC: 93c8e | Parse filename
2018-12-17T22:47:50.320898815Z 41 PC: 93d0f | Parse filename
2018-12-17T22:47:50.323895592Z 41 PC: 93d2c | Parse filename
2018-12-17T22:47:50.336182044Z 26 PC: 971d7 | Set disk transfer address
2018-12-17T22:47:50.338087273Z 71 PC: 973d3 | Get current directory
2018-12-17T22:47:50.346843659Z 78 PC: 9ed5b | Find first file
2018-12-17T22:47:50.356997838Z 47 PC: 9ed5b | Get disk transfer address
2018-12-17T22:47:50.358678226Z 61 PC: 9ed5b | Open file (Filename = 'PRINT.COM')
2018-12-17T22:47:50.365254149Z 63 PC: 9ed5b | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:47:50.387709646Z 66 PC: 9ed5b | Move file pointer
2018-12-17T22:47:50.389310456Z 66 PC: 9ed5b | Move file pointer
2018-12-17T22:47:50.390796836Z 63 PC: 9ed5b | Read file or device (Read 2 bytes on handle 5)
2018-12-17T22:47:50.394207406Z 66 PC: 9ed5b | Move file pointer
2018-12-17T22:47:50.395814742Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.398324189Z 71 PC: 9724c | Get current directory
2018-12-17T22:47:50.402580775Z 73 PC: 968e9 | Release memory
2018-12-17T22:47:50.4054117Z 47 PC: 9ed5b | Get disk transfer address
2018-12-17T22:47:50.406423732Z 26 PC: 9ed5b | Set disk transfer address
2018-12-17T22:47:50.40788336Z 78 PC: 9ed5b | Find first file
2018-12-17T22:47:50.413916903Z 61 PC: 9ed5b | Open file (Filename = 'A:\PRINT.COM')
2018-12-17T22:47:50.42082663Z 63 PC: 9ed5b | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:47:50.424543014Z 66 PC: 9ed5b | Move file pointer
2018-12-17T22:47:50.425856071Z 66 PC: 9ed5b | Move file pointer
2018-12-17T22:47:50.427160299Z 63 PC: 9ed5b | Read file or device (Read 2 bytes on handle 5)
2018-12-17T22:47:50.429706615Z 66 PC: 9ed5b | Move file pointer
2018-12-17T22:47:50.434332219Z 66 PC: 9ed5b | Move file pointer
2018-12-17T22:47:50.435661256Z 64 PC: 9ed5b | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:47:50.438592317Z 66 PC: 9ed5b | Move file pointer
2018-12-17T22:47:50.444206018Z 64 PC: 9fb2d | Write file or device (Write 4398 bytes on handle 5)
2018-12-17T22:47:50.463125162Z 87 PC: 9ed5b | Get or set file date and time
2018-12-17T22:47:50.465203874Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.473687058Z 67 PC: 9ed5b | Get or set file attributes
2018-12-17T22:47:50.481168525Z 26 PC: 9ed5b | Set disk transfer address
2018-12-17T22:47:50.482093526Z 75 PC: 11821 | Execute program
2018-12-17T22:47:50.498697056Z 9 PC: 12a47 | Display string (String= 'Hello, World! ')
2018-12-17T22:47:50.50266804Z 76 PC: 12a4b | Terminate with return code (Return code = '36')
2018-12-17T22:47:50.50579464Z 77 PC: 11fe0 | Get program return code
2018-12-17T22:47:50.507243153Z 72 PC: 12174 | Allocate memory
2018-12-17T22:47:50.511059306Z 72 PC: 1218d | Allocate memory
2018-12-17T22:47:50.513533962Z 44 PC: 9ed5b | Get time 0x9ed5b: ret
0x9ed5c: push ds
0x9ed5d: call 0x9f096
0x9ed60: shl bx, 1
0x9ed62: shl bx, 1
0x9ed64: cli
0x9ed65: mov ax, word ptr [bx]
0x9ed67: mov dx, word ptr [bx + 2]
0x9ed6a: sti
0x9ed6b: pop ds
0x9ed6c: ret
0x9ed6d: push cx
0x9ed6e: push ds
0x9ed6f: call 0x9f096
0x9ed72: mov cl, 2
0x9ed74: shl bx, cl
0x9ed76: cli
0x9ed77: mov word ptr [bx], dx
0x9ed79: mov word ptr [bx + 2], cs
0x9ed7c: sti
2018-12-17T22:47:50.517004028Z 37 PC: 123c4 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T22:47:50.51843666Z 44 PC: 9ed5b | Get time 0x9ed5b: ret
0x9ed5c: push ds
0x9ed5d: call 0x9f096
0x9ed60: shl bx, 1
0x9ed62: shl bx, 1
0x9ed64: cli
0x9ed65: mov ax, word ptr [bx]
0x9ed67: mov dx, word ptr [bx + 2]
0x9ed6a: sti
0x9ed6b: pop ds
0x9ed6c: ret
0x9ed6d: push cx
0x9ed6e: push ds
0x9ed6f: call 0x9f096
0x9ed72: mov cl, 2
0x9ed74: shl bx, cl
0x9ed76: cli
0x9ed77: mov word ptr [bx], dx
0x9ed79: mov word ptr [bx + 2], cs
0x9ed7c: sti
2018-12-17T22:47:50.520646941Z 37 PC: 123cb | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:47:50.522430114Z 44 PC: 9ed5b | Get time 0x9ed5b: ret
0x9ed5c: push ds
0x9ed5d: call 0x9f096
0x9ed60: shl bx, 1
0x9ed62: shl bx, 1
0x9ed64: cli
0x9ed65: mov ax, word ptr [bx]
0x9ed67: mov dx, word ptr [bx + 2]
0x9ed6a: sti
0x9ed6b: pop ds
0x9ed6c: ret
0x9ed6d: push cx
0x9ed6e: push ds
0x9ed6f: call 0x9f096
0x9ed72: mov cl, 2
0x9ed74: shl bx, cl
0x9ed76: cli
0x9ed77: mov word ptr [bx], dx
0x9ed79: mov word ptr [bx + 2], cs
0x9ed7c: sti
2018-12-17T22:47:50.524699849Z 37 PC: 123d2 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:47:50.526440908Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.528953606Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.530966037Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.532950374Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.535520997Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.537614986Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.539729926Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.542212787Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.544231904Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.546266306Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.54892758Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.551028458Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.553124588Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.555483492Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.557365028Z 62 PC: 9ed5b | Close file
2018-12-17T22:47:50.560293281Z 99 PC: 992b7 | Get DBCS lead byte table pointer
2018-12-17T22:47:50.56241448Z 56 PC: 93ad9 | Get or set country info
2018-12-17T22:47:50.564346366Z 64 PC: 99528 | Write file or device (Write 2 bytes on handle 1)
2018-12-17T22:47:50.568028252Z 25 PC: 93b42 | Get default drive
2018-12-17T22:47:50.569793887Z 71 PC: 95dbd | Get current directory
2018-12-17T22:47:50.572448443Z 64 PC: 99528 | Write file or device (Write 3 bytes on handle 1)
2018-12-17T22:47:50.574715367Z 2 PC: 95d92 | Character output (Char = '3e')
2018-12-17T22:47:50.576805557Z 93 PC: 93c00 | File sharing functions
2018-12-17T22:47:50.578039133Z 93 PC: 93c07 | File sharing functions
2018-12-17T22:47:50.579322351Z 10 PC: 93c19 | Buffered keyboard input