PavokwiLoader

PavokwiLoader buries its logic in more than 2,000 mixed boolean-arithmetic predicates

Malbear Labs found PavokwiLoader resolves the 48 ntdll functions it uses by hash while importing 68 KERNEL32 functions it never calls. Static and import-based detection see nothing, so reading it means emulating the loader's own resolver.