DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Overview
overview
6Static
static
3Stuxnet-So...in.zip
windows7-x64
6Stuxnet-So...in.zip
windows10-2004-x64
1Stuxnet-So..._1.pdf
windows7-x64
1Stuxnet-So..._1.pdf
windows10-2004-x64
1Stuxnet-So..._2.pdf
windows7-x64
1Stuxnet-So..._2.pdf
windows10-2004-x64
1Stuxnet-So....0.pdf
windows7-x64
1Stuxnet-So....0.pdf
windows10-2004-x64
100000000.dll
windows7-x64
100000000.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Stuxnet-Source-main.zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Stuxnet-Source-main.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Stuxnet-Source-main/Docs/Stuxnet_1.pdf
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
Stuxnet-Source-main/Docs/Stuxnet_1.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Stuxnet-Source-main/Docs/Stuxnet_2.pdf
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Stuxnet-Source-main/Docs/Stuxnet_2.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Stuxnet-Source-main/Docs/Symantec - Stuxnet 0.5 - The Missing Link v1.0.pdf
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Stuxnet-Source-main/Docs/Symantec - Stuxnet 0.5 - The Missing Link v1.0.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
00000000.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
00000000.dll
Resource
win10v2004-20231215-en
Target
Stuxnet-Source-main.zip
Size
13.1MB
MD5
e0153af3dc9c458b474fc50e1c399a68
SHA1
57ade59cbd405c68682aca82d423f67c585e0d57
SHA256
c1cd0a13140754775f6e76c73115bbf35eb1513730fa2fd5532d88bc858e558a
SHA512
45cc3955f80ced55e8d2d55608e027582013e4828a50e2950f792d97913ac7281b4659bd0662184a46efd756deb89582ef224da612bb148e81fa29c674f03e62
SSDEEP
393216:e0xXjUgBGOyVv5A9XBQYGAHAgIjMyPRRbI/k2:eNOyVvOQYp1yp1I/k2
http://www.windowsupdate.com
http://www.msn.com
http://www.mypremierfutbol.com
http://www.todaysfutbol.com
http://www.mypremierfutbol.com
http://www.todaysfutbol.com
http://www.isis-online.org
http://isis-online.org/uploads/isis-reports/documents/stuxnet_FEP_22Dec%2010.pdf,December2010.3DavidAlbright,PaulBrannan,andChristinaWalrond.Stuxnetmalwareandnatanz:Updateofisisdecember22,2010report.Technicalreport,WorldWideWeb,http://isis-online.org/uploads/isis-reports/documents/stuxnet_update_15%Feb2011.pdf,February2011.4MarkClayton.Stuxnetcyberweaponlookstobeoneonaproductionline,researcherssay.Technicalreport,WorldWideWeb,http://www.csmonitor.com/USA/2012/0106/Stuxnet-cyberweapon-looks-to-be-%one-on-a-production-line-researchers-say,January2012.5Contributors.Stuxnet.Technicalreport,WorldWideWeb,http://en.wikipedia.org/wiki/Stuxnet.6RalphLangneret.al.Theblogoflangner.com.Technicalreport,WorldWideWeb,http://www.langner.com/en/blog/.7NicolasFalliere,LiamOMurchu,andEricChien.W32.stuxnetdossier
http://www.symantec.com/content/en/us/enterprise/media/security_respons%e/whitepapers/w32_stuxnet_dossier.pdf,February2011.8MarkHosenball.Expertssayiranhas
http://www.reuters.com/article/2012/02/14/us-iran-usa-stuxnet-idUSTRE81%D24Q20120214,February2012.9NuclearThreatInitiative.Iran'spro
http://www.nti.org/country-profiles/iran/nuclear/,March2012.[10]RalphLangnerandassociates.Theprezshowshiscascadeshape.Technicalreport,WorldWideWeb,http://www.langner.com/en/2011/12/07/the-prez-shows-his-cascade-shape/,December2011.[11]AleksandrMatrosov,EugeneRodionov,DavidHarley,andJurajMalcho.Stuxnetunderthemicroscope
http://go.eset.com/us/resources/white-papers/Stuxnet_Under_the_Microscope.pdf.[12]SymantecSecurityResponse.W32.duqu-theprecursortothenextstuxnet.Technicalre-port,WorldWideWeb,http://www.symantec.com/connect/w32_duqu_precursor_next_stuxnet,October2011.[13]MarkRussinovich.Analyzingastuxnetinfectionwiththesysinternalstools,part1.Technicalreport,WorldWideWeb,http://blogs.technet.com/b/markrussinovich/archive/2011/03/30/3416253.a%spx,March2011.[14]Wikipedia.Simatics5plc.Technicalreport,WorldWideWeb,http://en.wikipedia.org/wiki/Simatic_S5_PLC/,February2012.11
http://www.telegraph.co.uk/technology/news/8326274/Israeli-security-chi%ef-celebrates-Stuxnet-cyber-attack.html,February2011.[16]KimZetter.Howdigitaldetectivesdecipheredstuxnet,themostmenacingmalwareinhis-tory.Technicalreport,WorldWideWeb,http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphe%red-stuxnet/all/1,2011.5CreditsforImagesUsedintheFiguresTheUSandIsrael
http://ThenuclearpowerplantimageisfromMSN.com
http://www.msnbc.msn.com/id/45524978/ns/technologyandscience-space/t/could-natural-nuclear-reactors-have-boosted-life/
http://ThePLCimageisfromalibaba.com
http://rashdriveimageisfrompsdgraphics.com
http://www.turbosquid.com/3d-models/blender-nuclear-centrifuge/66310412
http://www.securityfocus.com/bid/54651
http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf
http://www.isa.org/Template.cfm?Section=Standards8&Template=/Ecommerce/ProductDisplay.cfm&ProductID=10768
http://www.symantec.com/security_response/writeup.jsp?docid=2011-101814-1119-99
http://www.symantec.com/security_response/writeup.jsp?docid=2012-052811-0308-99
http://www.symantec.com/security_response/writeup.jsp?docid=2010-071400-3123-99
http://www.symantec.com/connect/blogs/stuxnet-05-missing-link
http://www.symantec.com/connect/blogs/stuxnet-05-disrupting-uranium-processing-natanz
http://www.symantec.com/connect/blogs/stuxnet-05-how-it-evolved
http://www.symantec.com/connect/blogs/stuxnet-05-command-and-control-capabilities
http://isis-online.org/
http://www.symantec.com
http://go.symantec.com/socialmedia
http://smartclick.org
http://best-advertising.net
http://internetadvertising4u.com
http://ad-marketing.net
http://www.symantec.com/security_response/writeup.jsp?docid=2011-101814-1119-99W32.Flamerhttp://www.symantec.com/security_response/writeup.jsp?docid=2012-052811-0308-99W32.Stuxnethttp://www.symantec.com/security_response/writeup.jsp?docid=2010-071400-3123-99Multiple
http://www.securityfocus.com/bid/54651Stuxnet
http://www.symantec.com/connect/blogs/stuxnet-05-missing-linkStuxnet
http://www.symantec.com/connect/blogs/stuxnet-05-disrupting-uranium-processing-natanzStuxnet
http://www.symantec.com/connect/blogs/stuxnet-05-how-it-evolvedStuxnet
http://www.symantec.com/connect/blogs/stuxnet-05-command-and-control-capabilitiesCommunity
http://go.symantec.com/socialmedia.
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
EnumProcessModules
GetModuleBaseNameW
GetFileSize
GetFileAttributesExW
RtlUnwind
GetModuleHandleW
SetFileTime
WriteFile
GetFileAttributesW
CreateFileW
lstrlenW
GetProcAddress
CloseHandle
DeleteFileW
lstrcpyW
SetFileAttributesW
GetCurrentProcess
SetLastError
lstrcmpiW
GetCurrentThreadId
GetCurrentProcessId
lstrcmpA
IsBadReadPtr
GetModuleFileNameW
lstrcmpiA
GetModuleHandleA
VirtualProtect
lstrcatW
VirtualFree
lstrcpynW
ReadFile
VirtualAlloc
CreateMutexW
SetErrorMode
FreeLibrary
HeapAlloc
WaitForSingleObject
GetTickCount
GetProcessHeap
Sleep
GetLastError
DisableThreadLibraryCalls
ReleaseMutex
CreateThread
SetFilePointer
GetWindowThreadProcessId
SendMessageW
IsWindowVisible
EnumChildWindows
GetClassNameW
EnumWindows
PostMessageW
wsprintfW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ