Sample viewer

vx.netlux.org/Virus.DOS.NightFall.5765

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:48:04.871399802Z 53 PC: 13fed | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-17T22:48:04.874404899Z 53 PC: 13fed | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:48:04.876142724Z 53 PC: 13fed | Get interrupt vector (Interrupt = '42' AKA 'Get date')
2018-12-17T22:48:04.8779818Z 88 PC: 13ebf | case 0xGet or set allocation strateg:
2018-12-17T22:48:04.882402116Z 88 PC: 13eca | case 0xGet or set allocation strateg:
2018-12-17T22:48:04.8840808Z 88 PC: 13ecf | case 0xGet or set allocation strateg:
2018-12-17T22:48:04.885670928Z 88 PC: 13ed9 | case 0xGet or set allocation strateg:
2018-12-17T22:48:04.888643204Z 88 PC: 13f19 | case 0xGet or set allocation strateg:
2018-12-17T22:48:04.890526332Z 88 PC: 13f1d | case 0xGet or set allocation strateg:
2018-12-17T22:48:04.892705587Z 98 PC: 13f2b | Get current PSP
2018-12-17T22:48:04.894672433Z 74 PC: 13f34 | Reallocate memory
2018-12-17T22:48:04.911396989Z 74 PC: 13f41 | Reallocate memory
2018-12-17T22:48:04.913683054Z 42 PC: 13f69 | Get date 0x13f69: mov al, 0xc3
0x13f6b: cmp cl, 0xcc
0x13f6e: jb 0x13f79
0x13f70: ja 0x13f77
0x13f72: cmp dh, 8
0x13f75: jb 0x13f79
0x13f77: mov al, 0x90
0x13f79: mov byte ptr [si + 0x4ea], al
0x13f7d: mov cx, 0x1685
0x13f80: push cs
0x13f81: lea ax, word ptr [si + 0x8c]
0x13f85: push ax
0x13f86: push es
0x13f87: push 0x22c
0x13f8a: rep movsb byte ptr es:[di], byte ptr [si]
0x13f8c: retf
0x13f8d: push si
0x13f8e: mov ds, di
0x13f90: cmp byte ptr [0x5e0], 0xea
0x13f95: jne 0x13fa6
2018-12-17T22:48:04.917167282Z 82 PC: 9e6af | Get DOS internal pointers (SYSVARS)
2018-12-17T22:48:04.920573553Z 98 PC: 13e5a | Get current PSP

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":9424,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:23:08.855605236Z 53 PC: 13fed | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T12:23:08.857116681Z 53 PC: 13fed | Get interrupt vector (See above)
2018-12-25T12:23:08.858145157Z 53 PC: 13fed | Get interrupt vector (See above)
2018-12-25T12:23:08.860423292Z 88 PC: 13ebf | case 0xGet or set allocation strateg:
2018-12-25T12:23:08.863698801Z 88 PC: 13eca | case 0xGet or set allocation strateg:
2018-12-25T12:23:08.864864626Z 88 PC: 13ecf | case 0xGet or set allocation strateg:
2018-12-25T12:23:08.866021273Z 88 PC: 13ed9 | case 0xGet or set allocation strateg:
2018-12-25T12:23:08.869166409Z 88 PC: 13f19 | case 0xGet or set allocation strateg:
2018-12-25T12:23:08.870316633Z 88 PC: 13f1d | case 0xGet or set allocation strateg:
2018-12-25T12:23:08.871141626Z 98 PC: 13f2b | Get current PSP
2018-12-25T12:23:08.871941174Z 74 PC: 13f34 | Reallocate memory
2018-12-25T12:23:08.873161422Z 74 PC: 13f41 | Reallocate memory
2018-12-25T12:23:08.874089337Z 42 PC: 13f69 | Get date 0x13f69: mov al, 0xc3
0x13f6b: cmp cl, 0xcc
0x13f6e: jb 0x13f79
0x13f70: ja 0x13f77
0x13f72: cmp dh, 8
0x13f75: jb 0x13f79
0x13f77: mov al, 0x90
0x13f79: mov byte ptr [si + 0x4ea], al
0x13f7d: mov cx, 0x1685
0x13f80: push cs
0x13f81: lea ax, word ptr [si + 0x8c]
0x13f85: push ax
0x13f86: push es
0x13f87: push 0x22c
0x13f8a: rep movsb byte ptr es:[di], byte ptr [si]
0x13f8c: retf
0x13f8d: push si
0x13f8e: mov ds, di
0x13f90: cmp byte ptr [0x5e0], 0xea
0x13f95: jne 0x13fa6
2018-12-25T12:23:08.875524467Z 82 PC: 9e6af | Get DOS internal pointers (SYSVARS)
2018-12-25T12:23:08.87682774Z 98 PC: 13e5a | Get current PSP

{"DateBased":true,"Day":1,"Month":1,"Year":1996,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":9424,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:23:09.043735233Z 53 PC: 13fed | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T12:23:09.055772578Z 53 PC: 13fed | Get interrupt vector (See above)
2018-12-25T12:23:09.057206284Z 53 PC: 13fed | Get interrupt vector (See above)
2018-12-25T12:23:09.058154228Z 88 PC: 13ebf | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.059809465Z 88 PC: 13eca | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.060795721Z 88 PC: 13ecf | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.061782473Z 88 PC: 13ed9 | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.063780701Z 88 PC: 13f19 | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.064761052Z 88 PC: 13f1d | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.065621168Z 98 PC: 13f2b | Get current PSP
2018-12-25T12:23:09.067333185Z 74 PC: 13f34 | Reallocate memory
2018-12-25T12:23:09.069229242Z 74 PC: 13f41 | Reallocate memory
2018-12-25T12:23:09.070577668Z 42 PC: 13f69 | Get date 0x13f69: mov al, 0xc3
0x13f6b: cmp cl, 0xcc
0x13f6e: jb 0x13f79
0x13f70: ja 0x13f77
0x13f72: cmp dh, 8
0x13f75: jb 0x13f79
0x13f77: mov al, 0x90
0x13f79: mov byte ptr [si + 0x4ea], al
0x13f7d: mov cx, 0x1685
0x13f80: push cs
0x13f81: lea ax, word ptr [si + 0x8c]
0x13f85: push ax
0x13f86: push es
0x13f87: push 0x22c
0x13f8a: rep movsb byte ptr es:[di], byte ptr [si]
0x13f8c: retf
0x13f8d: push si
0x13f8e: mov ds, di
0x13f90: cmp byte ptr [0x5e0], 0xea
0x13f95: jne 0x13fa6
2018-12-25T12:23:09.073069161Z 82 PC: 9e6af | Get DOS internal pointers (SYSVARS)
2018-12-25T12:23:09.074614332Z 98 PC: 13e5a | Get current PSP

{"DateBased":true,"Day":1,"Month":8,"Year":1996,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":9424,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:23:09.067140593Z 53 PC: 13fed | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T12:23:09.068738658Z 53 PC: 13fed | Get interrupt vector (See above)
2018-12-25T12:23:09.069982306Z 53 PC: 13fed | Get interrupt vector (See above)
2018-12-25T12:23:09.071382391Z 88 PC: 13ebf | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.073409987Z 88 PC: 13eca | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.074432962Z 88 PC: 13ecf | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.075630005Z 88 PC: 13ed9 | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.077859342Z 88 PC: 13f19 | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.079804646Z 88 PC: 13f1d | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.081554769Z 98 PC: 13f2b | Get current PSP
2018-12-25T12:23:09.082840856Z 74 PC: 13f34 | Reallocate memory
2018-12-25T12:23:09.08414834Z 74 PC: 13f41 | Reallocate memory
2018-12-25T12:23:09.085586186Z 42 PC: 13f69 | Get date 0x13f69: mov al, 0xc3
0x13f6b: cmp cl, 0xcc
0x13f6e: jb 0x13f79
0x13f70: ja 0x13f77
0x13f72: cmp dh, 8
0x13f75: jb 0x13f79
0x13f77: mov al, 0x90
0x13f79: mov byte ptr [si + 0x4ea], al
0x13f7d: mov cx, 0x1685
0x13f80: push cs
0x13f81: lea ax, word ptr [si + 0x8c]
0x13f85: push ax
0x13f86: push es
0x13f87: push 0x22c
0x13f8a: rep movsb byte ptr es:[di], byte ptr [si]
0x13f8c: retf
0x13f8d: push si
0x13f8e: mov ds, di
0x13f90: cmp byte ptr [0x5e0], 0xea
0x13f95: jne 0x13fa6
2018-12-25T12:23:09.088001165Z 82 PC: 9e6af | Get DOS internal pointers (SYSVARS)
2018-12-25T12:23:09.089210626Z 98 PC: 13e5a | Get current PSP

{"DateBased":true,"Day":1,"Month":1,"Year":1997,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":9424,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:23:09.099990509Z 53 PC: 13fed | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T12:23:09.101723202Z 53 PC: 13fed | Get interrupt vector (See above)
2018-12-25T12:23:09.10307474Z 53 PC: 13fed | Get interrupt vector (See above)
2018-12-25T12:23:09.104368677Z 88 PC: 13ebf | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.106008629Z 88 PC: 13eca | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.107124012Z 88 PC: 13ecf | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.10846131Z 88 PC: 13ed9 | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.110881619Z 88 PC: 13f19 | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.112176124Z 88 PC: 13f1d | case 0xGet or set allocation strateg:
2018-12-25T12:23:09.113375605Z 98 PC: 13f2b | Get current PSP
2018-12-25T12:23:09.11449991Z 74 PC: 13f34 | Reallocate memory
2018-12-25T12:23:09.11592326Z 74 PC: 13f41 | Reallocate memory
2018-12-25T12:23:09.117321012Z 42 PC: 13f69 | Get date 0x13f69: mov al, 0xc3
0x13f6b: cmp cl, 0xcc
0x13f6e: jb 0x13f79
0x13f70: ja 0x13f77
0x13f72: cmp dh, 8
0x13f75: jb 0x13f79
0x13f77: mov al, 0x90
0x13f79: mov byte ptr [si + 0x4ea], al
0x13f7d: mov cx, 0x1685
0x13f80: push cs
0x13f81: lea ax, word ptr [si + 0x8c]
0x13f85: push ax
0x13f86: push es
0x13f87: push 0x22c
0x13f8a: rep movsb byte ptr es:[di], byte ptr [si]
0x13f8c: retf
0x13f8d: push si
0x13f8e: mov ds, di
0x13f90: cmp byte ptr [0x5e0], 0xea
0x13f95: jne 0x13fa6
2018-12-25T12:23:09.119812375Z 82 PC: 9e6af | Get DOS internal pointers (SYSVARS)
2018-12-25T12:23:09.121460226Z 98 PC: 13e5a | Get current PSP