NVL LOADER[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
NVL LOADER.exe
Size 6.1MB
Sample260627-3bp2caes5k
SHA256 e7ac72e91fce5d5a793ac7a95dfcdb62164d05a67d9b459247d791477b1e6c76
MD5 85f009cd17a3b1e3fd16b1f15684a44e
SHA1 a4b020611ac597eb2bc468ce59e3ad4fa5465717
SHA512 742077f63fe939380ceb86a8e46805bb41c0d0068eb8c9b1d5e281db96fb80bd5a87efc858fe39f5f46dbd2aae2140331722cad471334fa91eb8f7af534a69b0
SSDEEP 98304:6ElslAnBaPXML/qtG6WAasGCq5bCAGFX5obwVtItcVbJOBIxglpmTy9:ZWjP8uQAasGCoCAuX5HMMcyWbT
TLSH
T13956122FF265826CD5921675CE62C312F77378021B2283CFBB8869528E636D45EB77C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NVL LOADER.exe

File Explorer

NVL LOADER.exe

.exe 6.1MB

NVL LOADER.exe

IMPHASH 22cd021b067ab55067bcfd2e6a89f77b
SHA256 e7ac72e91fce5d5a793ac7a95dfcdb62164d05a67d9b459247d791477b1e6c76
MD5 85f009cd17a3b1e3fd16b1f15684a44e
SHA1 a4b020611ac597eb2bc468ce59e3ad4fa5465717
SHA512 742077f63fe939380ceb86a8e46805bb41c0d0068eb8c9b1d5e281db96fb80bd5a87efc858fe39f5f46dbd2aae2140331722cad471334fa91eb8f7af534a69b0
SSDEEP 98304:6ElslAnBaPXML/qtG6WAasGCq5bCAGFX5obwVtItcVbJOBIxglpmTy9:ZWjP8uQAasGCoCAuX5HMMcyWbT
TLSH
T13956122FF265826CD5921675CE62C312F77378021B2283CFBB8869528E636D45EB77C1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

478692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\project prem\PRM LOADER\NVL LOADER\examples\Dark Aura Loader Project\EXE\NVL LOADER.pdb

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

wininet

InternetOpenA HttpOpenRequestA InternetConnectA HttpSendRequestA InternetReadFile InternetOpenUrlA InternetCloseHandle

kernel32

FreeLibrary QueryPerformanceCounter GetModuleFileNameA RemoveVectoredExceptionHandler Process32First WriteProcessMemory GetCurrentProcess TerminateProcess K32GetProcessImageFileNameA GetEnvironmentVariableA WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Sleep GetTickCount64 Process32NextW GetCurrentThread GetSystemDirectoryA Process32Next Process32FirstW CloseHandle SetFileAttributesA AddVectoredExceptionHandler GetThreadContext VirtualAllocEx GetProcAddress CreateRemoteThread CreateDirectoryA VirtualFreeEx GlobalLock GlobalFree LoadLibraryA GetFileAttributesExW FindFirstFileW FindClose CreateFileW GetLocaleInfoEx FormatMessageA LocalFree GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentProcessId SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceFrequency GetModuleHandleA GlobalUnlock GlobalAlloc WideCharToMultiByte GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar GetModuleHandleW GetTempPathA SetFileInformationByHandle AreFileApisANSI GetLastError

user32

ScreenToClient DispatchMessageA GetWindowRect GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow SetCapture SetCursor GetClientRect DestroyWindow SetWindowPos SetWindowRgn CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow SetWindowLongA GetWindowLongA MessageBoxA DefWindowProcA SetLayeredWindowAttributes TranslateMessage LoadIconA IsWindowUnicode ReleaseCapture PeekMessageA PostQuitMessage FindWindowA UpdateWindow GetKeyState LoadCursorA SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetSystemMetrics

gdi32

CreateRoundRectRgn

advapi32

RegOpenKeyExA GetCurrentHwProfileA RegQueryValueExA RegCloseKey RegSetValueExA

shell32

ShellExecuteExA ShellExecuteA

msvcp140

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Query_perf_frequency ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ _Mtx_lock _Query_perf_counter _Mtx_unlock ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileW

winmm

PlaySoundA

ntdll

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

iphlpapi

GetAdaptersInfo

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __current_exception_context _CxxThrowException memmove memcpy __C_specific_handler __std_exception_destroy memset memchr memcmp strchr strstr __std_terminate __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

fseek __stdio_common_vfprintf ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite __stdio_common_vsscanf fgetc _wfopen fclose fflush __acrt_iob_func fputc _set_fmode __p__commode __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _seh_filter_exe _set_app_type _initialize_onexit_table _get_narrow_winmain_command_line _initterm _initterm_e _exit _initialize_narrow_environment _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv abort _errno _wassert _invoke_watson _beginthreadex terminate system exit _cexit

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

strcmp strncpy _strdup tolower strncpy_s _wcsicmp strncmp

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

powf sqrtf cosf acosf fmod sin sinf fmodf ceilf cos __setusermatherr