NebulaLoader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NebulaLoader.exe
Size 4.0MB
Sample260907-xkwycstdkc
SHA256 2fd7a76367f9ee8ad909c719edddd5e0ef456946177937221bed8c8b3c1b2577
MD5 0cdc49b280de07706020497eed129247
SHA1 c1af8c771174e5265aa0e08ab614c6d9adf6b633
SHA512 01a966354999bd8b231b16c23afff67e4ac80d7effa7cacfde19f389c9e39dfbd6f350da66f6737ecfb13e5f0d92dc9339fda1855e992527742653c2809dba97
SSDEEP 49152:iopBWmEdsQ8EnYvBjX2/VKcdQX/EX6PqtPKvJYogGqfgXjAX8zu3n99llL+XxX9:iMAzl/00X8zuHfk9
TLSH
T18416AE45F7A810E9D036E13CDD93662BE6327845473086DB27E40A2D5FA37E05BBAF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NebulaLoader.exe

File Explorer

NebulaLoader.exe

.exe 4.0MB

NebulaLoader.exe

IMPHASH e43d980109f94e5a8cf58c5a4928cd51
SHA256 2fd7a76367f9ee8ad909c719edddd5e0ef456946177937221bed8c8b3c1b2577
MD5 0cdc49b280de07706020497eed129247
SHA1 c1af8c771174e5265aa0e08ab614c6d9adf6b633
SHA512 01a966354999bd8b231b16c23afff67e4ac80d7effa7cacfde19f389c9e39dfbd6f350da66f6737ecfb13e5f0d92dc9339fda1855e992527742653c2809dba97
SSDEEP 49152:iopBWmEdsQ8EnYvBjX2/VKcdQX/EX6PqtPKvJYogGqfgXjAX8zu3n99llL+XxX9:iMAzl/00X8zuHfk9
TLSH
T18416AE45F7A810E9D036E13CDD93662BE6327845473086DB27E40A2D5FA37E05BBAF12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

425280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\CS2-Internel-cheat--main\NebulaLoader\bin\x64\Release\NebulaLoader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

wininet

InternetOpenA InternetSetOptionA HttpOpenRequestA HttpQueryInfoA InternetCloseHandle InternetReadFile InternetConnectA HttpSendRequestA

kernel32

WriteProcessMemory GetCurrentProcess FindResourceA GetVolumeInformationA WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetTempPathA GetFileAttributesA Process32NextW GetCurrentThread GetSystemDirectoryA LockResource DeleteFileA Process32FirstW CloseHandle LoadResource Module32FirstW VirtualProtectEx GetThreadContext GetProcAddress VirtualAllocEx ExitProcess CreateRemoteThread Module32NextW CreateProcessA CreateDirectoryA VirtualFreeEx IsDebuggerPresent CheckRemoteDebuggerPresent OutputDebugStringA GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte SizeofResource QueryPerformanceCounter GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetModuleFileNameW TerminateProcess IsProcessorFeaturePresent GetModuleFileNameA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle CreateFileW ReadFile GetModuleHandleExW FreeLibraryAndExitThread HeapSize RtlUnwind WriteConsoleW SetEndOfFile FreeLibrary ExitThread CreateThread FlsFree GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue

user32

PostQuitMessage UpdateWindow CloseClipboard TranslateMessage GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard EnumWindows EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW GetWindowTextA

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteW SHGetFolderPathA

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

595KB

Virtual Size

595KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

157KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

NebulaLoader.exe

d3d11

d3dcompiler_47

wininet

kernel32

user32

advapi32

shell32

imm32

generic