Static task
static1
Behavioral task
behavioral1
Sample
wininitoverwriter.exe
Resource
win7-20231020-en
General
-
Target
wininitoverwriter.exe
-
Size
1.1MB
-
MD5
6b10b1ccb93e68986628cc285ea034df
-
SHA1
b2da46a7d5542110691a44bca53005aa94bfc795
-
SHA256
4903af6f93e8071209af7b5ba37337d22c72676fc3ccc9b2e1313b0a384f1995
-
SHA512
e8b7d3ab9d1e56532661911e97f1345743a2e47afb3e47db070d9b5b29aaf3e550f86bfb50a5c54f624446f07350e99e822fb1a5d305741b9086d6b21e7b8da2
-
SSDEEP
24576:ldz8yaFhsKrh0hg6TKnHYxERyMHdRE3LgLAOh7bCLsgi8fBi6dS:kkPKyqyuE3tOlmsh8f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource wininitoverwriter.exe
Files
-
wininitoverwriter.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 91KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ