NOKS-Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
NOKS-Loader.exe
Size 9.0MB
Sample261107-xt7ffsft2m
SHA256 1ba07f478b0c9bdec5910ae1c9c8d5fa9560df8eedf515d48dd874dc80ecb24e
MD5 165a93dc769d754d69a893d47814731b
SHA1 38dd8eb91aece44f92db4e21b0ca7f32f3625efa
SHA512 719a0acd45164dc4a70f786d1ae839a37630b653bde53f9284b416285ca79feb1e9cd3e79c2bda8d64b2acddb95cc7bdfd129b44581ced549575a534a564abf1
SSDEEP 98304:fZ29ILtAg/dTBClq+A2YUiEZdmIdUwpHF9VZl:OAAg/QDA2tiEZ/dTHZl
TLSH
T1C596C003B3DA869AC12B59344A11E2179FB2BC050736E3CFB2D469595E233E01E7E797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NOKS-Loader.exe

File Explorer

NOKS-Loader.exe

.exe 9.0MB

NOKS-Loader.exe

IMPHASH 11869e5c21a1d9939054a133ccd85b60
SHA256 1ba07f478b0c9bdec5910ae1c9c8d5fa9560df8eedf515d48dd874dc80ecb24e
MD5 165a93dc769d754d69a893d47814731b
SHA1 38dd8eb91aece44f92db4e21b0ca7f32f3625efa
SHA512 719a0acd45164dc4a70f786d1ae839a37630b653bde53f9284b416285ca79feb1e9cd3e79c2bda8d64b2acddb95cc7bdfd129b44581ced549575a534a564abf1
SSDEEP 98304:fZ29ILtAg/dTBClq+A2YUiEZdmIdUwpHF9VZl:OAAg/QDA2tiEZ/dTHZl
TLSH
T1C596C003B3DA869AC12B59344A11E2179FB2BC050736E3CFB2D469595E233E01E7E797
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

766048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\nokgg\Desktop\NOKS UI PORT - No Exploits\noks-loader\thirdparty\imgui\examples\example_win32_directx11\Release\example_win32_directx11.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

LoadResource FindResourceW CreateProcessA GetExitCodeProcess GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock SizeofResource Sleep GetStdHandle DeleteFileA LockResource CreateDirectoryA IsDebuggerPresent SetHandleInformation CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead CloseHandle WaitForSingleObject CreatePipe SetFileAttributesA WriteFile SetUnhandledExceptionFilter GetTempPathA GetStartupInfoW

user32

DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW MessageBoxA SetLayeredWindowAttributes TranslateMessage LoadIconW PostQuitMessage UpdateWindow OpenClipboard CloseClipboard EmptyClipboard GetClipboardData DefWindowProcW GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen ReleaseCapture SetCursorPos GetCursorPos GetCapture SendMessageW GetWindowRect ScreenToClient IsWindowUnicode MoveWindow SetClipboardData GetKeyState GetMessageExtraInfo

shell32

ShellExecuteA

msvcp140

?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ??Bios_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ??7ios_base@std@@QEBA_NXZ

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winmm

PlaySoundA

winhttp

WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpOpen WinHttpCrackUrl WinHttpReadData WinHttpConnect WinHttpCloseHandle

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate strstr strrchr longjmp memcpy memmove memset memchr memcmp __current_exception __current_exception_context __C_specific_handler _CxxThrowException __intrinsic_setjmp

api-ms-win-crt-runtime-l1-1-0

_wassert _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _register_thread_local_exe_atexit_callback _c_exit

api-ms-win-crt-stdio-l1-1-0

fsetpos __p__commode ungetc _set_fmode setvbuf fgetpos fwrite fread fgetc _fseeki64 _get_stream_buffer_pointers fclose fopen ftell fflush fputc __acrt_iob_func __stdio_common_vsscanf fseek _wfopen __stdio_common_vfprintf __stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strncpy strncmp isdigit isupper strlen islower strcmp

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

__setusermatherr powf sinf sqrtf ceilf acosf cosf fmodf fmod

api-ms-win-crt-locale-l1-1-0

_configthreadlocale