Static task
static1
Behavioral task
behavioral1
Sample
wininit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
wininit.exe
Resource
win10ltsc2021-20250113-en
General
-
Target
wininit.exe
-
Size
259KB
-
MD5
40423a099938afe0b1f39a1317049914
-
SHA1
f54513aa10b40f8f4eb2f1df73680bd34750c9b3
-
SHA256
fdabe139cac0f7474c8d1ab0b0436e56c17a765a8b80ba4651d23d3e5188868e
-
SHA512
84745d42d2c309f4c2b992a77ea65ab3fb8fa89aaa749c7404db1d6fc1d5439a91068397753be26e887b1a73ec852a57499e9f2896bcf6c67d67d337d0a7ff77
-
SSDEEP
6144:O3J/lKaBuZxpbGn1PPT4WZuOusQY1H9X7iGZeSE:gKaIrRfOuRYtlyS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource wininit.exe
Files
-
wininit.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
^nlo Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Yzqth Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 247KB - Virtual size: 246KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Invalid Size: 512B - Virtual size: 10B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Wrong Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Xerin Size: 512B - Virtual size: 141B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ