NOKS-Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
NOKS-Loader.exe
Size 9.0MB
Sample261113-vxcddad16x
SHA256 abdc0f44d3b551b3457889409b251440b4af04d9922a57464a95cc6aef838af3
MD5 8d3997360f7b0d3a98be0f3b32155a6e
SHA1 a612b8b2b1e673a530df95124559a43ebcc8f32a
SHA512 c5f746ce97cfbc3196531108ca341fbb6ed710357a1079889145cadf3bdb331370d93175f7c66028eb66418dcce2340eaff4c1c7e05cde2738aa0d4cb83e6cd2
SSDEEP 98304:fbTYoO2LtAg/rY2JufA2YUiEZdmIdUwpss9VZl:fb+GAgzmA2tiEZ/d5HZl
TLSH
T11C96C003B3DA8A9AC12B59344A11E2179FB2BC050736E3CFB2D459595E233E01E7E797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NOKS-Loader.exe

File Explorer

NOKS-Loader.exe

.exe 9.0MB

NOKS-Loader.exe

IMPHASH af5dbefd75fa966f7e923f198b062fff
SHA256 abdc0f44d3b551b3457889409b251440b4af04d9922a57464a95cc6aef838af3
MD5 8d3997360f7b0d3a98be0f3b32155a6e
SHA1 a612b8b2b1e673a530df95124559a43ebcc8f32a
SHA512 c5f746ce97cfbc3196531108ca341fbb6ed710357a1079889145cadf3bdb331370d93175f7c66028eb66418dcce2340eaff4c1c7e05cde2738aa0d4cb83e6cd2
SSDEEP 98304:fbTYoO2LtAg/rY2JufA2YUiEZdmIdUwpss9VZl:fb+GAgzmA2tiEZ/d5HZl
TLSH
T11C96C003B3DA8A9AC12B59344A11E2179FB2BC050736E3CFB2D459595E233E01E7E797
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

769984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\nokgg\Desktop\NOKS UI PORT - No Exploits\noks-loader\thirdparty\imgui\examples\example_win32_directx11\Release\example_win32_directx11.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

GetLastError LockResource CloseHandle CreateThread LoadResource FindResourceW GetLocalTime CreateProcessA GetExitCodeProcess GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GetStdHandle SizeofResource Sleep DeleteFileA SetFileAttributesA CreateDirectoryA IsDebuggerPresent SetHandleInformation CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetTempPathA WaitForSingleObject CreatePipe GetFileAttributesA WriteFile SetUnhandledExceptionFilter GlobalUnlock GetStartupInfoW

user32

DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW MessageBoxA SetLayeredWindowAttributes TranslateMessage LoadIconW PostQuitMessage UpdateWindow MoveWindow OpenClipboard CloseClipboard EmptyClipboard GetClipboardData DefWindowProcW GetWindowRect SendMessageW ScreenToClient ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect GetMessageExtraInfo GetKeyState GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode SetClipboardData GetCapture

shell32

ShellExecuteA

msvcp140

?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ??Bios_base@std@@QEBA_NXZ _Mtx_unlock _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winmm

PlaySoundA

winhttp

WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpReceiveResponse

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __std_exception_destroy __std_exception_copy __std_terminate strstr strrchr longjmp memcpy memmove memset memchr memcmp __current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit terminate _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _initterm_e _get_narrow_winmain_command_line _initterm _exit exit _wassert

api-ms-win-crt-stdio-l1-1-0

ungetc __stdio_common_vsscanf _wfopen __p__commode setvbuf _set_fmode fsetpos fgetpos fseek __stdio_common_vsprintf __stdio_common_vfprintf __acrt_iob_func fgetc ftell _get_stream_buffer_pointers _fseeki64 fread fclose fflush fopen fputc fwrite

api-ms-win-crt-string-l1-1-0

tolower isupper strncmp strcmp strncpy isspace strlen islower isdigit

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

sqrtf cosf fmod ceilf acosf sinf fmodf powf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale