PavokwiLoader buries its logic in more than 2,000 mixed boolean-arithmetic predicates

A resolver walks ntdll's export directory at runtime, hashing each export name until it matches one of forty-eight 32-bit values the loader stores ^[7]. The hash is FNV-1a with both constants replaced: seed 0x676092FE for the usual 0x811C9DC5, multiplier 0xE6006695 for 0x01000193, and each character is OR'd with 0x20 before it goes in ^[8]. Malbear Labs did not reverse that by hand. They built a PE with valid headers and an export directory laid out exactly like ntdll's, filled the name table from public syscall lists, pointed the loader's own resolver at it, and hooked the hash loop to catch each name and the value it produced. All forty-eight came back ^[9]. Most are what a loader needs: memory, process and thread control, sections, files and registry ^[10].

The constants that would give any of this away are assembled at runtime by those predicates. Twelve bitwise instructions between 0x140054E32 and 0x140054E5D do nothing more than compute a minus b ^[5]. The FNV seed is in the open, a variable set to 1734382334, which is 0x676092FE, and it is still effectively hidden, because the code around it zeroes and sets neighbouring variables on comparisons a reader cannot follow ^[11].

The anti-analysis checks follow the same rule. The loader looks for a debugger three times. It reads its own thread context with ContextFlags set to 0x00100010, which tells the kernel to fill in the hardware breakpoint registers Dr0 through Dr3 and the Dr7 control register ^[12]. Then it calls ZwQueryInformationProcess twice, for ProcessDebugPort and ProcessDebugObjectHandle. The port is what CheckRemoteDebuggerPresent reads. The object handle catches a debugger that has nulled the port but left the object behind. Neither is the PEB BeingDebugged byte that IsDebuggerPresent checks and that an analyst clears first ^[13]. Search the binary for 0x00100010 and you get nothing, because the value is built when the call is made ^[14].

The anti-VM checks read two registry keys through ZwOpenKey, ZwEnumerateKey and ZwQueryValueKey. The display adapter class key is enumerated one subkey at a time, and the loader accepts only nvidia or intel; there is no amd entry, so a Radeon workstation fails exactly as a VM does. The disk enumeration key is checked for virtual controller strings ^[15]. A separate check compares the logged-in username against thirteen hardcoded names, among them sandbox, analyst, cuckoo and malware ^[16][18]. The loader also reads SystemBasicInformation for the processor count and physical memory ^[17].

PavokwiLoader is the loader stage of the intrusion chain Kostas documented, which ran from SEO poisoning into a custom RMM tool and Cobalt Strike ^[1].