NVLLOADER[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
NVLLOADER.exe
Size 6.1MB
Sample260628-a2v13aew81
SHA256 3cdf200a32cdb881d3cb53c41a8799f5c8c4b478e7c0223ed9d2d991ddc3aea3
MD5 bd11bead9705b0de1e47ef6e0233eaf8
SHA1 c1df485c03e35883ac6dcf4a05c220b16a790444
SHA512 832f856b5d3dd2d5b94f969acc9a8dd6d4607961dcd780646724e32fc4cddafa7612cfb5d719f0a887fcfd7d12b6c06b7d367af84d97166cf369e70dfdac7f28
SSDEEP 98304:6ElslAnBaPXML/qtG6WAasGCq5bCAGFX5obwVtItcVbJOBIxglpmTy9:ZWjP8uQAasGCoCAuX5HMMcyWbT
TLSH
T13756221BF2A2826CD5A716798AA2C313F67378011B3183CFB7845552CFA32D49EB7791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NVLLOADER.exe

File Explorer

NVLLOADER.exe

.exe 6.1MB

NVLLOADER.exe

IMPHASH 0cec09780d0c26f6c9c8a6c236a49dcb
SHA256 3cdf200a32cdb881d3cb53c41a8799f5c8c4b478e7c0223ed9d2d991ddc3aea3
MD5 bd11bead9705b0de1e47ef6e0233eaf8
SHA1 c1df485c03e35883ac6dcf4a05c220b16a790444
SHA512 832f856b5d3dd2d5b94f969acc9a8dd6d4607961dcd780646724e32fc4cddafa7612cfb5d719f0a887fcfd7d12b6c06b7d367af84d97166cf369e70dfdac7f28
SSDEEP 98304:6ElslAnBaPXML/qtG6WAasGCq5bCAGFX5obwVtItcVbJOBIxglpmTy9:ZWjP8uQAasGCoCAuX5HMMcyWbT
TLSH
T13756221BF2A2826CD5A716798AA2C313F67378011B3183CFB7845552CFA32D49EB7791
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

463304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\project prem\PRM LOADER\NVL LOADER\NVL LOADER\examples\Dark Aura Loader Project\EXE\NVL LOADER.pdb

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

wininet

InternetSetOptionA InternetCloseHandle InternetOpenA HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetConnectA InternetReadFile

kernel32

Process32First WriteProcessMemory GetCurrentProcess TerminateProcess GetEnvironmentVariableA GetVolumeInformationA WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Sleep GetTickCount64 Process32NextW CreateFileA GetSystemDirectoryA Process32Next Process32FirstW CloseHandle VirtualAllocEx GetFileSize CreateRemoteThread CreateProcessA QueryPerformanceCounter GetComputerNameA FindFirstFileW GetModuleHandleA GetLocaleInfoEx FormatMessageA LocalFree GetFileInformationByHandleEx ReleaseSRWLockExclusive ReadFile VirtualFreeEx AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter FreeLibrary GetProcAddress QueryPerformanceFrequency FindNextFileW LoadLibraryA GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetTempPathA GetFileAttributesExW CreateFileW AreFileApisANSI FindClose SetFileInformationByHandle GetLastError GetModuleHandleW FindFirstFileExW

user32

TrackMouseEvent DispatchMessageA GetForegroundWindow SetCapture ReleaseDC GetSystemMetrics GetDC SetCursor GetWindowRect DestroyWindow SetWindowPos SetWindowRgn CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow SetWindowLongA GetWindowLongA MessageBoxA DefWindowProcA SetLayeredWindowAttributes TranslateMessage LoadIconA PeekMessageA PostQuitMessage SetClipboardData GetClipboardData UpdateWindow GetKeyState LoadCursorA ScreenToClient GetCapture GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard ClientToScreen

gdi32

CreateRoundRectRgn GetDIBits BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject

advapi32

RegCloseKey RegQueryValueExA LookupPrivilegeValueA GetUserNameA OpenProcessToken RegOpenKeyExA GetCurrentHwProfileA AdjustTokenPrivileges

shell32

ShellExecuteExA ShellExecuteA

msvcp140

??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Strxfrm _Query_perf_frequency ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?uncaught_exception@std@@YA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Mtx_lock _Strcoll _Query_perf_counter _Mtx_unlock ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?_Incref@facet@locale@std@@UEAAXXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileW

winmm

PlaySoundA

ntdll

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

iphlpapi

GetAdaptersInfo

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context _CxxThrowException __current_exception __C_specific_handler memmove memcpy memchr memcmp strchr strstr __std_terminate __std_exception_copy __std_exception_destroy memset

api-ms-win-crt-stdio-l1-1-0

ungetc _fseeki64 fwrite fread fsetpos fgetc setvbuf fclose fflush fgetpos __p__commode fputc _get_stream_buffer_pointers _set_fmode __stdio_common_vsscanf __stdio_common_vsprintf _wfopen ftell __acrt_iob_func fseek __stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

realloc malloc free _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _initterm _initialize_onexit_table _exit _wassert _c_exit _register_thread_local_exe_atexit_callback abort _initialize_narrow_environment exit _invoke_watson _beginthreadex terminate _errno _initterm_e _configure_narrow_argv

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

isalnum _strdup strncpy_s _wcsicmp strncmp strncpy strcmp

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

acosf sqrtf sinf powf cosf ceilf __setusermatherr fmodf