View source for Shamoon the Wiper in details

{{Publication
|Image=Shamoon-files.jpg
|Legend=
|Document=
|Licence=
|Video=
|Link=https://www.securelist.com/en/blog/208193795/Shamoon_the_Wiper_in_details
|Author=Dmitry Tarakanov, 
|NomRevue=Securelist
|Date=21 aug2012
|Editor=Kaspersky lab
|Year=2012
|ISBN=
|Page=
|Abstract=We continue to analyse the Shamoon malware. This blog contains information about the internals of the malicious samples involved in this campaign.
''Samples nesting''
The main executable (dropper) includes 3 resources, each maintains a ciphered program. The cipher is pretty simple – xor by dword. This was mentioned in our first blog-post.
Resource PKCS12:112 maintains an encoded executable, xor’ed with key value 0xFB5D7F25. It is saved to disk using a name taken from a hardcoded list in the %WINDIR%\System32 folder during the dropper execution. In turn, this module maintains resource READONE :101 (xor key: 0xF052AF15), a driver decoded and saved to disk as %WINDIR%\System32\Drivers\DRDISK.SYS.
|Botnet=Shamoon, 
|Malware=, 
|ExploitKit=, 
|CCProtocol=, 
|Operation=, 
|Keyword=, 
}}