D:\Project\Loader\x64\Release\Nidavellir loader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Nidavellir_loader.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
Nidavellir_loader.exe
Resource
win11-20240221-en
General
-
Target
Nidavellir_loader.exe
-
Size
974KB
-
MD5
33c150e4331c42326a7efb3b1a6ff13c
-
SHA1
281d335aff2e4aff205cf55ebe5617e8eae0efa9
-
SHA256
7dcb90ab141f50bcfb727f4f1b32acb54fe50c74256d8a53c3955f23883f6662
-
SHA512
d360ac44beb52631aa00e5c7dcc59488baccb66bd54d0f0627b4f63d03ea7332486c9a8c34b4118add757c87f653053b49840f04e5d02751981bba5edcd4bb86
-
SSDEEP
24576:jGViDvsGh2pGSu8cA3fZ1Ic0GWXJnlRdpG0+E:jigEBGf8d3fHRNWZnW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Nidavellir_loader.exe
Files
-
Nidavellir_loader.exe.exe windows:6 windows x64 arch:x64
8aa6b54b95e614206a32fc5ee968dff7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
TerminateProcess
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
GetLastError
LoadLibraryA
Process32Next
CloseHandle
GetProcAddress
VirtualAllocEx
LocalFree
FreeLibrary
CreateRemoteThread
VirtualFreeEx
ConnectNamedPipe
CreateDirectoryW
GetCurrentProcess
K32GetProcessMemoryInfo
GetCurrentThread
MultiByteToWideChar
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
QueryPerformanceFrequency
VerSetConditionMask
IsDebuggerPresent
GetVolumeInformationW
GetThreadContext
CheckRemoteDebuggerPresent
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetLastError
GetStartupInfoW
GetModuleHandleW
WriteFile
CreateNamedPipeA
WriteProcessMemory
Process32First
ReadFile
GetModuleHandleA
GlobalAlloc
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
user32
UpdateWindow
MessageBoxA
GetWindowLongW
AdjustWindowRectEx
GetKeyState
LoadCursorA
GetDC
EnumDisplayMonitors
ScreenToClient
SetWindowTextW
WindowFromPoint
GetCapture
SetWindowLongA
ClientToScreen
IsChild
TrackMouseEvent
GetForegroundWindow
SetWindowPos
SetFocus
BringWindowToTop
SetCapture
SetCursor
SetWindowLongW
GetClientRect
DestroyWindow
DispatchMessageA
SetClipboardData
GetClipboardData
SetProcessDPIAware
ReleaseCapture
MonitorFromWindow
ShowWindow
GetAsyncKeyState
GetMonitorInfoA
DefWindowProcA
CreateWindowExA
TranslateMessage
PeekMessageA
SetForegroundWindow
IsIconic
SetCursorPos
ReleaseDC
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
SetLayeredWindowAttributes
UnregisterClassA
PostQuitMessage
RegisterClassExA
gdi32
GetDeviceCaps
ole32
CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoInitializeSecurity
oleaut32
SysAllocString
VariantClear
SysFreeString
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Xbad_function_call@std@@YAXXZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Strxfrm
_Strcoll
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_Query_perf_frequency
_Query_perf_counter
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
_Thrd_id
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
urlmon
URLDownloadToFileA
imm32
ImmAssociateContextEx
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_47
D3DCompile
bcrypt
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
__current_exception_context
__C_specific_handler
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
strchr
_purecall
memcmp
memcpy
memmove
memset
__std_type_info_compare
__std_type_info_name
_CxxThrowException
memchr
api-ms-win-crt-heap-l1-1-0
realloc
_set_new_mode
free
_aligned_free
_callnewh
_aligned_malloc
malloc
api-ms-win-crt-runtime-l1-1-0
system
_invalid_parameter_noinfo_noreturn
_initterm
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
exit
_errno
_get_wide_winmain_command_line
_initialize_wide_environment
_invalid_parameter_noinfo
_configure_wide_argv
_set_app_type
_seh_filter_exe
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
terminate
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vfprintf
__stdio_common_vsscanf
fseek
_read
clearerr
fclose
fflush
_set_fmode
__acrt_iob_func
fopen
_setmode
_close
__p__commode
_write
_wfopen
fgets
_open
_fileno
fwrite
_lseek
ferror
feof
ftell
fread
api-ms-win-crt-time-l1-1-0
_time64
clock
_localtime64_s
api-ms-win-crt-string-l1-1-0
_wcsicmp
strlen
_stricmp
strcmp
tolower
isdigit
strncpy
strncmp
api-ms-win-crt-convert-l1-1-0
strtoull
strtol
strtod
strtoll
strtoul
api-ms-win-crt-utility-l1-1-0
rand
qsort
_byteswap_ulong
api-ms-win-crt-math-l1-1-0
_dsign
_dtest
__setusermatherr
fmodf
cosf
ceilf
acosf
sinf
sqrtf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
ws2_32
__WSAFDIsSet
closesocket
connect
ioctlsocket
getpeername
getsockname
getsockopt
getnameinfo
freeaddrinfo
getaddrinfo
WSASocketW
WSAGetLastError
WSACleanup
WSAStartup
socket
shutdown
setsockopt
ntohs
send
select
recv
Exports
Exports
OPENSSL_Applink
Sections
.text Size: 683KB - Virtual size: 682KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 88KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ