Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Zodiak.6128

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:49:38.255646084Z 53 PC: 1319a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:49:38.257482654Z 53 PC: 1319a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:49:38.26056227Z 53 PC: 1319a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:49:38.261999891Z 53 PC: 1319a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:49:38.263387939Z 53 PC: 1319a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:49:38.266058045Z 53 PC: 1319a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:49:38.267514151Z 53 PC: 1319a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:49:38.269188186Z 53 PC: 1319a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:49:38.276645337Z 53 PC: 1319a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:49:38.278246314Z 53 PC: 1319a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:49:38.279536669Z 53 PC: 1319a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:49:38.280810362Z 53 PC: 1319a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:49:38.291377856Z 53 PC: 1319a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:49:38.293281662Z 53 PC: 1319a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:49:38.295243098Z 53 PC: 1319a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:49:38.297185096Z 53 PC: 1319a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:49:38.299171097Z 53 PC: 1319a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:49:38.301703105Z 53 PC: 1319a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:49:38.303423046Z 53 PC: 1319a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:49:38.305455074Z 37 PC: 131af | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:49:38.307763841Z 37 PC: 131b7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:49:38.31074404Z 37 PC: 131bf | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:49:38.31238335Z 37 PC: 131c7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:49:38.314484869Z 68 PC: 14074 | I/O control for devices (Set for = '')
2018-12-17T22:49:38.317677697Z 42 PC: 12fb7 | Get date 0x12fb7: xor ah, ah
0x12fb9: les di, ptr [bp + 6]
0x12fbc: stosw word ptr es:[di], ax
0x12fbd: mov al, dl
0x12fbf: les di, ptr [bp + 0xa]
0x12fc2: stosw word ptr es:[di], ax
0x12fc3: mov al, dh
0x12fc5: les di, ptr [bp + 0xe]
0x12fc8: stosw word ptr es:[di], ax
0x12fc9: xchg ax, cx
0x12fca: les di, ptr [bp + 0x12]
0x12fcd: stosw word ptr es:[di], ax
0x12fce: pop bp
0x12fcf: retf 0x10
0x12fd2: push bp
0x12fd3: mov bp, sp
0x12fd5: mov cx, word ptr [bp + 0xa]
0x12fd8: mov dh, byte ptr [bp + 8]
0x12fdb: mov dl, byte ptr [bp + 6]
0x12fde: mov ah, 0x2b
2018-12-17T22:49:38.320493117Z 26 PC: 13047 | Set disk transfer address
2018-12-17T22:49:38.321610526Z 78 PC: 13053 | Find first file
2018-12-17T22:49:38.33537178Z 26 PC: 1306b | Set disk transfer address
2018-12-17T22:49:38.337497915Z 79 PC: 13070 | Find next file
2018-12-17T22:49:38.341087089Z 63 PC: 13b96 | Read file or device (Read 3 bytes on handle 0)