CRITICAL

NotPetya Destructive Wiper

Interactive simulation and visual analysis of the attack vector.

01Static Triage

During incident response, analysts examine the binary's PE structure and calculate its cryptographic hashes (MD5, SHA-256) to match it against threat intelligence databases.

Static File Analyzer

PE Structure

DOS Header (MZ)

NT Headers (PE\0\0)

.text (Code)

.data (Variables)

.rsrc (Resources)

Waiting for analysis...

02System Subversion

NotPetya escalates its privileges to gain raw disk access, overwrites the Master Boot Record (MBR), and forces an abrupt system reboot.

Kernel-Level Subversion

1. AdjustTokenPrivileges()

Elevates malware process privileges to SE_SHUTDOWN_NAME, allowing it to force a system restart.

2. DeviceIoControl(\.\PhysicalDrive0)

Gains raw disk access to overwrite the Master Boot Record (MBR) with its own custom bootloader.

3. ExitWindowsEx(EWX_REBOOT)

Forces an immediate Windows blue screen or restart, triggering the corrupted MBR on the next boot sequence.

03Destructive Wiper

Upon rebooting, the custom MBR executes. It fakes a 'CHKDSK' screen while actually encrypting the Master File Table (MFT) and permanently destroying the disk.