Nova[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nova.exe
Size 10.0MB
Sample260810-t14fladj7x
SHA256 9a53a0a3279b20ecf0b52b574aa69a3dade5ad807d4578041b2cd39f9305de57
MD5 18d8c6b66e3d330925305f570bb23bc7
SHA1 dd7832ea78f24d4a650e830a4997eba6329fff79
SHA512 b04de2402e995c9d62bfdb212c2494dbc932b1aceb152a584a3c14fe00bfe03c836e55abf7d9b5593dc8bff102ff134ffd30a9bc7f40aab2bc810cd6d3621f46
SSDEEP 196608:iE22uRjbFfpdOwW9nH5D7slYXCVT/tVCiptqMsdyql:j7unfOwsX8jptqMsdyql
TLSH
T1B7B6AE27B2D441ACD077D078CE9BAA93E772340903306AFB1AE059651F776E05BBE712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Nova.exe

File Explorer

Nova.exe

.exe 10.0MB

Nova.exe

IMPHASH 4ac23fbce5660b162d3e96f395874001
SHA256 9a53a0a3279b20ecf0b52b574aa69a3dade5ad807d4578041b2cd39f9305de57
MD5 18d8c6b66e3d330925305f570bb23bc7
SHA1 dd7832ea78f24d4a650e830a4997eba6329fff79
SHA512 b04de2402e995c9d62bfdb212c2494dbc932b1aceb152a584a3c14fe00bfe03c836e55abf7d9b5593dc8bff102ff134ffd30a9bc7f40aab2bc810cd6d3621f46
SSDEEP 196608:iE22uRjbFfpdOwW9nH5D7slYXCVT/tVCiptqMsdyql:j7unfOwsX8jptqMsdyql
TLSH
T1B7B6AE27B2D441ACD077D078CE9BAA93E772340903306AFB1AE059651F776E05BBE712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

793200

PE Signature issue

Digest

35:d6:19:d0:ac:63:a4:50:59:62:1c:c9:3c:58:79:fb:2d:43:5e:7c:f4:33:36:68:ed:b3:47:a0:e7:44:55:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nova Self-Signed Publisher

Chains

Aug 6, 2026

CN=Nova Self-Signed Publisher

Minor OS version

Major OS version

Entry point

6448608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmGetWindowAttribute

winhttp

WinHttpOpenRequest WinHttpWebSocketSend WinHttpCloseHandle WinHttpWebSocketReceive WinHttpQueryHeaders WinHttpWebSocketQueryCloseStatus WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpSetOption WinHttpQueryDataAvailable WinHttpWebSocketCompleteUpgrade WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpWebSocketClose WinHttpReadData

gdi32

CreateRectRgn DeleteObject CombineRgn CreateRoundRectRgn

user32

TrackMouseEvent GetKeyboardLayout LoadCursorW GetCursorPos SetCapture SetCursor IsWindowUnicode GetClipboardData GetWindowThreadProcessId DefWindowProcW UnregisterHotKey PostMessageW SetCursorPos MapVirtualKeyW IsIconic GetWindow GetAncestor SetForegroundWindow GetWindowRect SendMessageTimeoutW DestroyWindow GetMessageExtraInfo SetWindowPos ReleaseCapture UpdateWindow EqualRect MessageBoxW keybd_event PtInRect SetActiveWindow RegisterWindowMessageW EnumChildWindows SetWindowLongPtrW SetWindowRgn GetKeyState CreateWindowExW ScreenToClient SendInput SetProcessDPIAware SystemParametersInfoW GetSystemMetrics UnregisterClassW CreatePopupMenu PostQuitMessage PostThreadMessageW MsgWaitForMultipleObjects GetWindowLongPtrW GetWindowDisplayAffinity AppendMenuW RegisterClassExW WindowFromPoint VkKeyScanA GetClientRect IsWindowVisible GetWindowPlacement TrackPopupMenu GetActiveWindow ShowWindow IsWindow GetKeyNameTextA GetAsyncKeyState OpenClipboard GetCapture SetClipboardData DispatchMessageW ClientToScreen SetWindowsHookExW mouse_event ClipCursor CloseClipboard FindWindowW LoadIconW EmptyClipboard PeekMessageW MsgWaitForMultipleObjectsEx GetRawInputData TranslateMessage GetClipCursor RegisterRawInputDevices SetWindowDisplayAffinity AttachThreadInput MapVirtualKeyA BringWindowToTop SetFocus MessageBoxA RegisterHotKey BlockInput SetLayeredWindowAttributes GetTopWindow GetForegroundWindow UnhookWindowsHookEx EnumWindows CallNextHookEx DestroyMenu

kernel32

InitializeCriticalSectionEx InitOnceBeginInitialize InitOnceComplete TryAcquireSRWLockShared AcquireSRWLockShared ReleaseSRWLockShared GetExitCodeThread GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException RtlPcToFileHeader SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCPInfo GetStartupInfoW InitializeSListHead RtlUnwindEx InterlockedPushEntrySList RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc EnterCriticalSection TlsGetValue TlsSetValue TlsFree LeaveCriticalSection ExitThread DeleteCriticalSection FreeLibraryAndExitThread SetConsoleCtrlHandler DuplicateHandle GetStdHandle GetConsoleMode ReadConsoleW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW EncodePointer GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale DecodePointer GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetStringTypeW GetConsoleOutputCP HeapReAlloc GetFileAttributesExW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap IsDebuggerPresent SetUnhandledExceptionFilter SetStdHandle HeapSize WriteConsoleW CreateDirectoryW ReadFile GetModuleFileNameA SizeofResource QueryDosDeviceW GetVolumeInformationW GetFileInformationByHandleEx CompareFileTime FindFirstFileW GetFileSizeEx GetFileAttributesExA WriteProcessMemory SetHandleInformation SetLastError SetDefaultDllDirectories GetCommandLineW GetFullPathNameW FindNextFileW GetLongPathNameW GetCurrentProcess Heap32ListFirst Heap32Next WriteFile TerminateProcess RemoveDirectoryW GetFinalPathNameByHandleW GetProcessIdOfThread GetModuleFileNameW WaitForMultipleObjects InitializeProcThreadAttributeList CompareStringOrdinal SetThreadPriority CreatePipe SetErrorMode GetProcessMitigationPolicy GetEnvironmentVariableW SetEndOfFile GetTempPathW CreateMutexW Heap32ListNext CreateHardLinkW GetEnvironmentVariableA FindClose WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId OpenEventW UnmapViewOfFile OpenProcess SetProcessMitigationPolicy SetFileAttributesW CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar Sleep GetFileInformationByHandle GetTempPathA CancelSynchronousIo GetTickCount64 LCMapStringEx GetLastError UpdateProcThreadAttribute GetFileAttributesA ReleaseSRWLockExclusive Process32NextW SetFileInformationByHandle QueryFullProcessImageNameA CreateFileA SetEvent GetCurrentThread AcquireSRWLockExclusive WaitForSingleObjectEx SetWaitableTimerEx LockResource QueryPerformanceFrequency GlobalAlloc DeleteFileW Process32FirstW GlobalFree CloseHandle GetSystemInfo CancelIoEx CreateThread HeapSetInformation GetWindowsDirectoryA LoadResource DeleteProcThreadAttributeList FindResourceW Module32FirstW GetLocalTime GetOverlappedResult SwitchToThread GetWindowsDirectoryW GetProcAddress GlobalLock SetFilePointerEx LocalFree MoveFileExW ReplaceFileW ExitProcess ReadProcessMemory GetCurrentProcessId CreateProcessW GetModuleHandleW FreeLibrary CopyFileW WideCharToMultiByte Module32NextW QueryFullProcessImageNameW GetSystemTimeAsFileTime GetFileType CreateDirectoryA FormatMessageA CreateWaitableTimerExW CreateFileMappingW MapViewOfFile QueryPerformanceCounter GlobalUnlock Heap32First SetDllDirectoryW VirtualQuery GetProcessTimes GetDriveTypeW OpenThread LoadLibraryExW VirtualQueryEx LoadLibraryExA FlushFileBuffers GetExitCodeProcess OutputDebugStringA GetLocaleInfoA IsDBCSLeadByte GetProcessId VirtualProtectEx VirtualAllocEx FlushInstructionCache VirtualFreeEx RtlCaptureContext

shell32

ShellExecuteExW SHGetKnownFolderPath ShellExecuteW CommandLineToArgvW ShellExecuteA Shell_NotifyIconW

ole32

CoCreateFreeThreadedMarshaler CoInitializeEx CoTaskMemFree CoUninitialize CoCreateInstance

comdlg32

GetSaveFileNameW GetOpenFileNameW

api-ms-win-security-base-l1-1-0

InitializeAcl GetLengthSid IsValidSid GetSecurityDescriptorControl CreateWellKnownSid InitializeSecurityDescriptor AddAccessAllowedAceEx SetSecurityDescriptorDacl SetSecurityDescriptorControl GetSecurityDescriptorDacl EqualSid GetAce GetTokenInformation SetSecurityDescriptorOwner

api-ms-win-mm-time-l1-1-0

timeEndPeriod timeBeginPeriod

ws2_32

__WSAFDIsSet getsockname send ntohs accept inet_pton WSASocketW recv htonl inet_ntop setsockopt bind listen WSACleanup shutdown ntohl select WSAStartup closesocket

api-ms-win-security-provider-l1-1-0

GetSecurityInfo SetNamedSecurityInfoW

ncrypt

NCryptFinalizeKey NCryptSignHash NCryptDeleteKey NCryptOpenKey NCryptGetProperty NCryptCreatePersistedKey NCryptSetProperty NCryptFreeObject NCryptOpenStorageProvider NCryptExportKey

bcrypt

BCryptCloseAlgorithmProvider BCryptHashData BCryptDeriveKey BCryptImportKeyPair BCryptFinishHash BCryptExportKey BCryptGenRandom BCryptGetProperty BCryptDestroyHash BCryptSetProperty BCryptCreateHash BCryptVerifySignature BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptGenerateKeyPair BCryptSecretAgreement BCryptGenerateSymmetricKey BCryptDestroySecret BCryptDecrypt BCryptFinalizeKeyPair

crypt32

CertVerifyTimeValidity CryptStringToBinaryA CryptUnprotectMemory CryptProtectMemory CertCompareCertificate CertCompareCertificateName CertGetCertificateContextProperty CertGetNameStringA CertGetEnhancedKeyUsage CryptBinaryToStringA CryptVerifyCertificateSignatureEx

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-registry-l1-1-0

RegGetValueW RegCloseKey RegSetValueExW RegCreateKeyExW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken

iphlpapi

GetExtendedUdpTable

oleaut32

GetErrorInfo SysAllocString SysStringLen SetErrorInfo SysFreeString

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

wintrust

WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WinVerifyTrust WTHelperCertCheckValidSignature WTHelperGetProvSignerFromChain

version

GetFileVersionInfoSizeW

winmm

mciSendStringW mciGetErrorStringA

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

98KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

198KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

696KB

Virtual Size

696KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Nova.exe

PE Signature issue

dwmapi

winhttp

gdi32

user32

kernel32

shell32

ole32

comdlg32

api-ms-win-security-base-l1-1-0

api-ms-win-mm-time-l1-1-0

ws2_32

api-ms-win-security-provider-l1-1-0

ncrypt

bcrypt

crypt32

api-ms-win-core-version-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

iphlpapi

oleaut32

api-ms-win-core-version-l1-1-1

wintrust

version

winmm

imm32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic