Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Cheska.4630

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T21:58:38.6126989Z 53 PC: 1317a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T21:58:38.615081408Z 53 PC: 1317a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T21:58:38.61661529Z 53 PC: 1317a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T21:58:38.618390971Z 53 PC: 1317a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T21:58:38.620517118Z 53 PC: 1317a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T21:58:38.621716401Z 53 PC: 1317a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T21:58:38.622853898Z 53 PC: 1317a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T21:58:38.624509182Z 53 PC: 1317a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T21:58:38.628115834Z 53 PC: 1317a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T21:58:38.629868262Z 53 PC: 1317a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T21:58:38.632128416Z 53 PC: 1317a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T21:58:38.633664058Z 53 PC: 1317a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T21:58:38.634946396Z 53 PC: 1317a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T21:58:38.636768507Z 53 PC: 1317a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T21:58:38.63804406Z 53 PC: 1317a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T21:58:38.639272116Z 53 PC: 1317a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T21:58:38.641090068Z 53 PC: 1317a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T21:58:38.642798845Z 53 PC: 1317a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T21:58:38.644837558Z 53 PC: 1317a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T21:58:38.647327867Z 37 PC: 1318f | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T21:58:38.649712902Z 37 PC: 13197 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T21:58:38.652153636Z 37 PC: 1319f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T21:58:38.653682044Z 37 PC: 131a7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T21:58:38.66584803Z 68 PC: 13a05 | I/O control for devices (Set for = '')
2018-12-17T21:58:38.672805297Z 44 PC: 12f86 | Get time 0x12f86: mov byte ptr [0x58], dh
0x12f8a: mov di, 0x5a
0x12f8d: push ds
0x12f8e: push di
0x12f8f: call 0x22a40
0x12f92: cmp byte ptr [0x58], 0x1e
0x12f97: jb 0x12fa7
0x12f99: mov ah, 0x40
0x12f9b: mov bx, 1
0x12f9e: lea dx, word ptr [0x5a]
0x12fa2: mov cx, 0x3b
0x12fa5: int 0x21
0x12fa7: push ax
0x12fa8: in al, 0x21
0x12faa: or al, 3
0x12fac: out 0x21, al
0x12fae: pop ax
0x12faf: call 0x22a99
0x12fb2: call 0x22ed7
0x12fb5: push ax
2018-12-17T21:58:38.675430056Z 48 PC: 13730 | Get DOS version
2018-12-17T21:58:38.677516996Z 48 PC: 13730 | Get DOS version
2018-12-17T21:58:38.679740317Z 61 PC: 135e2 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T21:58:38.686617921Z 63 PC: 136b5 | Read file or device (Read 4624 bytes on handle 5)
2018-12-17T21:58:38.69820747Z 62 PC: 13632 | Close file
2018-12-17T21:58:38.701446397Z 26 PC: 12ff5 | Set disk transfer address
2018-12-17T21:58:38.702514399Z 78 PC: 13001 | Find first file
2018-12-17T21:58:38.708965924Z 61 PC: 135e2 | Open file (Filename = 'TEST.EXE')
2018-12-17T21:58:38.717541267Z 66 PC: 13714 | Move file pointer
2018-12-17T21:58:38.718992245Z 63 PC: 136b5 | Read file or device (Read 6 bytes on handle 5)
2018-12-17T21:58:38.725911015Z 26 PC: 13019 | Set disk transfer address
2018-12-17T21:58:38.727869088Z 79 PC: 1301e | Find next file
2018-12-17T21:58:38.731129728Z 48 PC: 13730 | Get DOS version
2018-12-17T21:58:38.732494578Z 26 PC: 12ff5 | Set disk transfer address
2018-12-17T21:58:38.734103677Z 78 PC: 13001 | Find first file
2018-12-17T21:58:38.740231653Z 48 PC: 13730 | Get DOS version
2018-12-17T21:58:38.741615793Z 67 PC: 12baa | Get or set file attributes
2018-12-17T21:58:38.746086369Z 61 PC: 135e2 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T21:58:38.75252885Z 66 PC: 13714 | Move file pointer
2018-12-17T21:58:38.753932703Z 63 PC: 136b5 | Read file or device (Read 4624 bytes on handle 6)
2018-12-17T21:58:38.762143161Z 66 PC: 13714 | Move file pointer
2018-12-17T21:58:38.763610481Z 64 PC: 13613 | Write file or device (Write 0 bytes on handle 6)
2018-12-17T21:58:38.776996377Z 66 PC: 13714 | Move file pointer
2018-12-17T21:58:38.778654992Z 64 PC: 136b5 | Write file or device (Write 4624 bytes on handle 6)
2018-12-17T21:58:38.78474469Z 62 PC: 13632 | Close file
2018-12-17T21:58:38.792191317Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T21:58:38.793491585Z 37 PC: 130ff | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T21:58:38.794674804Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T21:58:38.795859871Z 37 PC: 130ff | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T21:58:38.797117421Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T21:58:38.798494861Z 37 PC: 130ff | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T21:58:38.799525272Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T21:58:38.800684079Z 37 PC: 130ff | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T21:58:38.802069943Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T21:58:38.803060916Z 37 PC: 130ff | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T21:58:38.804197487Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T21:58:38.805519535Z 37 PC: 130ff | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T21:58:38.806681801Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T21:58:38.808023304Z 37 PC: 130ff | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T21:58:38.809112776Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T21:58:38.810083979Z 37 PC: 130ff | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T21:58:38.811193879Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T21:58:38.81239097Z 37 PC: 130ff | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T21:58:38.81337041Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T21:58:38.814688737Z 37 PC: 130ff | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T21:58:38.815695062Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T21:58:38.816585944Z 37 PC: 130ff | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T21:58:38.817676972Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T21:58:38.819072692Z 37 PC: 130ff | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T21:58:38.82005492Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T21:58:38.821225568Z 37 PC: 130ff | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T21:58:38.822337001Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T21:58:38.823205218Z 37 PC: 130ff | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T21:58:38.824179938Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T21:58:38.825505424Z 37 PC: 130ff | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T21:58:38.826397427Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T21:58:38.827773734Z 37 PC: 130ff | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T21:58:38.828854126Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T21:58:38.829896718Z 37 PC: 130ff | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T21:58:38.831142229Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T21:58:38.832504208Z 37 PC: 130ff | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T21:58:38.833580977Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T21:58:38.834847843Z 37 PC: 130ff | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T21:58:38.83643387Z 41 PC: 130ad | Parse filename
2018-12-17T21:58:38.837666546Z 41 PC: 130bb | Parse filename
2018-12-17T21:58:38.839059921Z 75 PC: 130c6 | Execute program
2018-12-17T21:58:38.849222261Z 9 PC: 17148 | Display string (Could not find end pointer)
2018-12-17T21:58:38.859943069Z 76 PC: 1714c | Terminate with return code (Return code = '36')
2018-12-17T21:58:38.862972311Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T21:58:38.864098233Z 37 PC: 130ff | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T21:58:38.865137627Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T21:58:38.866383639Z 37 PC: 130ff | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T21:58:38.867558259Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T21:58:38.868384469Z 37 PC: 130ff | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T21:58:38.869329276Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T21:58:38.870223346Z 37 PC: 130ff | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T21:58:38.871374912Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T21:58:38.872384266Z 37 PC: 130ff | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T21:58:38.8734097Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T21:58:38.874230491Z 37 PC: 130ff | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T21:58:38.875147963Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T21:58:38.876268371Z 37 PC: 130ff | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T21:58:38.877052623Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T21:58:38.877917467Z 37 PC: 130ff | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T21:58:38.879583227Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T21:58:38.880404161Z 37 PC: 130ff | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T21:58:38.881242446Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T21:58:38.882141514Z 37 PC: 130ff | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T21:58:38.882951464Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T21:58:38.883672437Z 37 PC: 130ff | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T21:58:38.884535645Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T21:58:38.885358133Z 37 PC: 130ff | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T21:58:38.886217163Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T21:58:38.887142047Z 37 PC: 130ff | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T21:58:38.887920439Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T21:58:38.888649475Z 37 PC: 130ff | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T21:58:38.889545655Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T21:58:38.890386958Z 37 PC: 130ff | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T21:58:38.891090389Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T21:58:38.892071619Z 37 PC: 130ff | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T21:58:38.892996724Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T21:58:38.893832993Z 37 PC: 130ff | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T21:58:38.894717878Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T21:58:38.895534002Z 37 PC: 130ff | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T21:58:38.896301846Z 53 PC: 130f6 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T21:58:38.897424662Z 37 PC: 130ff | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T21:58:38.89825998Z 48 PC: 13730 | Get DOS version
2018-12-17T21:58:38.899490607Z 61 PC: 135e2 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T21:58:38.90471825Z 64 PC: 136b5 | Write file or device (Write 4624 bytes on handle 6)
2018-12-17T21:58:38.911024219Z 66 PC: 13714 | Move file pointer
2018-12-17T21:58:38.912266593Z 64 PC: 136b5 | Write file or device (Write 4624 bytes on handle 6)
2018-12-17T21:58:38.918782074Z 66 PC: 13714 | Move file pointer
2018-12-17T21:58:38.919847893Z 64 PC: 136b5 | Write file or device (Write 6 bytes on handle 6)
2018-12-17T21:58:38.922036765Z 62 PC: 13632 | Close file
2018-12-17T21:58:38.928750947Z 64 PC: 1353d | Write file or device (Write 0 bytes on handle 1)
2018-12-17T21:58:38.929972975Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T21:58:38.931272845Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T21:58:38.932102892Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T21:58:38.93290173Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T21:58:38.934014504Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T21:58:38.934822492Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T21:58:38.935653205Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T21:58:38.936928367Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T21:58:38.937759963Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T21:58:38.938577505Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T21:58:38.939993098Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T21:58:38.940818284Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T21:58:38.941658573Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T21:58:38.943480377Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T21:58:38.944355463Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T21:58:38.945154889Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T21:58:38.946275828Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T21:58:38.947069327Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T21:58:38.947783446Z 37 PC: 132d1 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T21:58:38.949001065Z 76 PC: 13310 | Terminate with return code (Return code = '0')