There are 12 variants in 4 versions, represented by the following:
When the virus is loaded into memory, it hooks INT 21h to infect any executable file that is run. No file size change can be observed as long as the virus stays in memory.
The virus might corrupt files during infection that may hang the system when an infected program is run.
Ukraine.3400 does not infect EXE files.
The following table shows the memory usage of the variants.
|Variant||Memory usage in bytes|
|Ukraine.3201 (A and C)||3,664|
The virus activates on 24th day in any month, except Ukraine.3426.b and 3537.
When any program is run when the virus is in memory, a full screen ASCII image of Ukrainian flag with the Tryzub (Ukrainian for "Trident", the symbol in the coat of arms of said nation) is displayed and the national anthem of Ukraine (Shche ne vmerla Ukraina) is played in the 8 bit style.
After a while, a text is displayed at the bottom of the screen:
24 СЕРПНЯ - ДЕНЬ НЕЗАЛЕЖНОСТІ УКРАІНИ !!!
Translation (from Ukrainian):
24 August - INDEPENDENCE DAY of UKRAINE!!!
And then it erases the disk sectors.
Ukraine.3400 display another text instead.
Ukraine.3426.b activates on 24th of September and December only. Ukraine.3537 activates on 24th in every month except February, June, August and October.
This family has 12 variants in total:
- Virus.DOS.Ukraine.3201 (A, B and C)
Ukraine.3400 is a cracked version of the virus.
The infection size of Ukraine.3633 is 3,624 bytes instead of 3,633 bytes.
- List of variants of the Ukraine virus on VX Heaven