Sample viewer

vx.netlux.org/Virus.DOS.IVP.Empire.412

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:49:29.421538656Z 53 PC: 12a53 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:49:29.423341428Z 37 PC: 12a64 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:49:29.424975259Z 78 PC: 12a8a | Find first file
2018-12-17T22:49:29.431277596Z 79 PC: 12a8a | Find next file
2018-12-17T22:49:29.433985354Z 79 PC: 12a8a | Find next file
2018-12-17T22:49:29.437173526Z 79 PC: 12a8a | Find next file
2018-12-17T22:49:29.440037845Z 79 PC: 12a8a | Find next file
2018-12-17T22:49:29.442865065Z 79 PC: 12a8a | Find next file
2018-12-17T22:49:29.445805609Z 79 PC: 12a8a | Find next file
2018-12-17T22:49:29.449023054Z 79 PC: 12a8a | Find next file
2018-12-17T22:49:29.451590569Z 79 PC: 12a8a | Find next file
2018-12-17T22:49:29.45462718Z 42 PC: 12ae3 | Get date 0x12ae3: cmp cx, 0x7ca
0x12ae7: jb 0x12b2b
0x12ae9: mov ah, 9
0x12aeb: mov dx, 0x213
0x12aee: int 0x21
0x12af0: mov cx, 1
0x12af3: push cx
0x12af4: cli
0x12af5: mov dx, 0x2ee0
0x12af8: sub dx, word ptr cs:[0x1388]
0x12afd: mov bx, 0x64
0x12b00: mov al, 0xb6
0x12b02: out 0x43, al
0x12b04: mov ax, bx
0x12b06: out 0x42, al
0x12b08: mov al, ah
0x12b0a: out 0x42, al
0x12b0c: in al, 0x61
0x12b0e: mov ah, 0
0x12b10: or ax, 3
2018-12-17T22:49:29.45681918Z 9 PC: 12af0 | Display string (String= 'Somehing is growing inside! And your not going to like it! [IVP] ')
2018-12-17T22:49:29.483437194Z 37 PC: 12a77 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')

{"DateBased":true,"Day":1,"Month":1,"Year":1994,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":9904,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:24:04.616954891Z 53 PC: 12a53 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:24:04.618226366Z 37 PC: 12a64 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:24:04.622445531Z 78 PC: 12a8a | Find first file
2018-12-25T12:24:04.628215935Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:04.630702402Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:04.633555685Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:04.636665166Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:04.639125272Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:04.641486543Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:04.644627108Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:04.647099491Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:04.649532906Z 42 PC: 12ae3 | Get date 0x12ae3: cmp cx, 0x7ca
0x12ae7: jb 0x12b2b
0x12ae9: mov ah, 9
0x12aeb: mov dx, 0x213
0x12aee: int 0x21
0x12af0: mov cx, 1
0x12af3: push cx
0x12af4: cli
0x12af5: mov dx, 0x2ee0
0x12af8: sub dx, word ptr cs:[0x1388]
0x12afd: mov bx, 0x64
0x12b00: mov al, 0xb6
0x12b02: out 0x43, al
0x12b04: mov ax, bx
0x12b06: out 0x42, al
0x12b08: mov al, ah
0x12b0a: out 0x42, al
0x12b0c: in al, 0x61
0x12b0e: mov ah, 0
0x12b10: or ax, 3
2018-12-25T12:24:04.652346159Z 9 PC: 12af0 | Display string (String= 'Somehing is growing inside! And your not going to like it! [IVP] ')
2018-12-25T12:24:04.678757312Z 37 PC: 12a77 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":9904,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:24:06.940513022Z 53 PC: 12a53 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:24:06.943018626Z 37 PC: 12a64 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:24:06.944347563Z 78 PC: 12a8a | Find first file
2018-12-25T12:24:06.950462582Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:06.953461435Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:06.956263102Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:06.958989836Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:06.96236123Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:06.966254662Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:06.968907661Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:06.971579161Z 79 PC: 12a8a | Find next file (See above)
2018-12-25T12:24:06.974712417Z 42 PC: 12ae3 | Get date 0x12ae3: cmp cx, 0x7ca
0x12ae7: jb 0x12b2b
0x12ae9: mov ah, 9
0x12aeb: mov dx, 0x213
0x12aee: int 0x21
0x12af0: mov cx, 1
0x12af3: push cx
0x12af4: cli
0x12af5: mov dx, 0x2ee0
0x12af8: sub dx, word ptr cs:[0x1388]
0x12afd: mov bx, 0x64
0x12b00: mov al, 0xb6
0x12b02: out 0x43, al
0x12b04: mov ax, bx
0x12b06: out 0x42, al
0x12b08: mov al, ah
0x12b0a: out 0x42, al
0x12b0c: in al, 0x61
0x12b0e: mov ah, 0
0x12b10: or ax, 3
2018-12-25T12:24:06.977014677Z 37 PC: 12a77 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')