SHA-256:
044539a2eacfd520e93aecc7f977b7ebea9d15c941a7101f5682ccb9fec68e1funattributed: 044539a2 — twenty-third confirmed sibling in MSVC 14.12 PEB-walking reflective-loader cluster
Executive Summary
Twenty-third confirmed sibling in the MSVC 14.12 PE32 GUI reflective-loader cluster compiled Sep 9 2022 (0x631A9665). Shares the identical stub template with siblings 136b5750 through 65844473d39b: PEB-walking API resolution, XOR-NOT alphabet cipher (0x10035fff), CPUID anti-VM, and LCG PRNG C2 URL generation. .text hash matches the majority group (000a9a8b...); .data and PE checksum (0x2BA22) are individualized, confirming per-sample payload customization in a builder pipeline. No blackmatter OpenCTI label on this sample — only dropped-by-phorpiex, exe, malware-bazaar. Static-only analysis (CAPE skipped — no Windows guest).
What It Is
| Field | Value |
|---|---|
| SHA-256 | 044539a2eacfd520e93aecc7f977b7ebea9d15c941a7101f5682ccb9fec68e1f |
| Size | 149,504 bytes (150 KB) |
| Type | PE32 executable (GUI) Intel 80386, 6 sections ^[file.txt] |
| Compiler | MSVC 14.12 (LinkerVersion 14.12) — Visual Studio 2017 15.5 or newer ^[pefile.txt:46] ^[exiftool.json:18] |
| Timestamp | 0x631A9665 — Fri Sep 9 01:27:01 2022 UTC ^[pefile.txt:34] |
| Debug | POGO (IMAGE_DEBUG_TYPE_POGO, size 0xF4) ^[pefile.txt:313] |
| ASLR / DEP | Enabled (DYNAMIC_BASE, NX_COMPAT) ^[pefile.txt:68] |
| Canary | Enabled (canary: true) ^[rabin2-info.txt:6] |
| Signed | Unsigned ^[rabin2-info.txt:27] |
| Overlay | None ^[rabin2-info.txt:23] |
| Static imports | Minimal facade — GDI32 (6), USER32 (11), KERNEL32 (8) ^[pefile.txt:249] |
| YARA | Generic PE only; no family-specific hits ^[yara.txt] |
| OpenCTI labels | dropped-by-phorpiex, exe, malware-bazaar ^[metadata.json] |
Build / RE
Toolchain & Stub Structure
Identical to sibling 136b5750 — see that report for full decompilation. Key confirmations for this hash via radare2:
- XOR-NOT decrypt at
0x401240:buf[i] ^= 0x10035fff; buf[i] = ~buf[i];called from alphabet builder and POST decrypt. ^[r2:fcn.00401240] - Alphabet table builds
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789via 16-DWORD decryption at0x40d4c9. ^[r2:fcn.0040d4b0] - POST verb decrypted from encrypted DWORD array at
0x40d543. ^[r2:fcn.0040cfcc] - LCG PRNG at
0x40110c:seed = (seed * 0x19660d + 0x3c6ef35f) & 0x7ffffff. ^[r2:fcn.0040110c] - Anti-VM gate at
0x4010bc: CPUID leaf 1 ECX[31], leaf 7 EBX[18], RDTSC rotate-13 differential timing. ^[r2:fcn.004010bc] - PEB-walker at
0x417034loads kernel32 via PEBInMemoryOrderModuleList, spawns file-system thread (0x407468) and C2 thread (0x40782c), with reflective mapper at0x406668. ^[r2:fcn.00417034] - Reflective loader at
0x406668:VirtualAlloc-style allocation via slot0x4254e4, section mapping,VirtualProtectvia slot0x425544. ^[r2:fcn.00406668]
Per-Sample Delta
| Attribute | 044539a2 (this) | ae02bd22 (sibling) | 136b5750 (sibling) |
|---|---|---|---|
| PE Checksum | 0x2BA22 |
0x2BE18 |
0x2BC5A |
.text MD5 |
cfbda2c44e51b3b0b00bcbbc767c62a2 |
cfbda2c44e51b3b0b00bcbbc767c62a2 |
299ed0bc52def60ad9927e69f2bba088 |
.text SHA-256 |
000a9a8b1440e44cde00fd7acc5bdda6efc34f09e404de77cff1f5298e0af369 |
000a9a8b1440e44cde00fd7acc5bdda6efc34f09e404de77cff1f5298e0af369 |
be2dc068760039090865f3696066df5249a7601a1cf9be26bcb7096af81ef121 |
.data MD5 |
6d5de858b1c04ca6f798000d3e5e6bac |
991090a0e1f6d5368522abda010b3fba |
991090a0e1f6d5368522abda010b3fba |
.data SHA-256 |
3279ce7064ab39c8eb73fc0d6db8ba0876fa2cc75c088ace35e86acc859ad7d7 |
f2e9b4366a834733f0f70dc638c2b4d41e966577b23ddea199787e52f112a45f |
f2e9b4366a834733f0f70dc638c2b4d41e966577b23ddea199787e52f112a45f |
The .text hash matches the majority group (ae02bd22, 21b12514, 7e9bbc5c, e67dbabcd, 2ac82953, 89dc341b, 8655b3b9, 91e39f6b, 65844473), confirming shared stub template. The .data hash is unique, confirming individualized encrypted payload. PE checksum is also unique. ^[pefile.txt]
Deploy / ATT&CK
TTPs are identical to sibling 136b5750; this hash-specific entry does not add new ATT&CK techniques. See the sibling report for full TTP mapping. Condensed:
| Technique | Implementation |
|---|---|
| T1055 — Process Injection | Reflective PE loader: VirtualAlloc → write → VirtualProtect → thread creation ^[r2:fcn.00406668] |
| T1071.001 — Application Layer Protocol: Web Protocols | HTTP POST C2 with encrypted body; WinInet API resolution ^[r2:fcn.0040cfcc] |
| T1027 — Obfuscated Files or Information | XOR-NOT encrypted strings, base-62 alphabet encoding, runtime C2 URL generation ^[r2:fcn.00401240] ^[r2:fcn.0040d4b0] |
| T1497.001 — Virtualization/Sandbox Evasion: System Checks | CPUID hypervisor-bit checks (leaf 1 ECX[31], leaf 7 EBX[18]) ^[r2:fcn.004010bc] |
| T1497.002 — Virtualization/Sandbox Evasion: User Activity Based | RDTSC differential timing gate ^[r2:fcn.004010bc] |
| T1083 — File and Directory Discovery | Recursive "*" enumeration via FindFirstFile / FindNextFile ^[r2:fcn.00407468] |
| T1573.001 — Encrypted Channel: Symmetric Cryptography | CryptEncrypt / CryptDecrypt for C2 payload body ^[r2:fcn.0040782c] |
| T1105 — Ingress Tool Transfer | Downloader / payload retrieval via HTTP POST response handling ^[r2:fcn.0040782c] |
IOCs
| Indicator | Value | Notes |
|---|---|---|
| SHA-256 | 044539a2eacfd520e93aecc7f977b7ebea9d15c941a7101f5682ccb9fec68e1f |
Primary |
| Compilation | Sep 9 2022 01:27:01 UTC | Timestamp 0x631A9665 (shared with siblings) |
| Linker | 14.12 | VS 2017 15.5+ |
| PE Checksum | 0x2BA22 |
Unique to this sample |
| XOR Key | 0x10035fff |
Shared with siblings |
| LCG multiplier | 0x19660d |
Shared with siblings |
| LCG increment | 0x3c6ef35f |
Shared with siblings |
| Anti-VM | CPUID leaf 1 ECX[31], leaf 7 EBX[18], RDTSC rotate-13 | Shared with siblings |
| Pseudo-import region | 0x425000–0x425fff (.data VA) |
Decrypted at runtime; content individualized |
Cluster Membership
| Hash | Role | Notes |
|---|---|---|
136b57507a3cfe1fc39cf6973869dca7e871e91d63f283c77380fc33298d6d51 |
First observed sibling | Deep structural analysis (report reference) |
3b42403b11b999e966158b0bea2080b863409f37cbae53845ecb1a2af67d8cde |
Second confirmed sibling | Individualized .data payload, same stub template |
21b12514e8d728ac9c1381540af63aa2501ed5351e21bf9a90162233f9f85b2c |
Third confirmed sibling | .text hash divergent from majority group |
9d8526b0ecc2081eab5ec68b7063fffe8dbd987681b77b2e8d96a0c8979b1f8a |
Fourth confirmed sibling | Individualized .data payload |
0b525c358266f139dc9b8311f71dc0c93fe36939a8ed8aedcc3dbe510e82269d |
Fifth confirmed sibling | Triage only |
370415c872a4ca6e1974cafb2950c3d31259ebdbba4952a81253272cd6b4f93b |
Sixth confirmed sibling | Triage only |
c527ebf0bb60a09e78bc1b4605573d93fccc7df0d3776120dffff79e4ffccf45 |
Seventh confirmed sibling | Triage only |
d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973 |
Eighth confirmed sibling | Triage only |
dc870a75269409d7ccee7984b7c2b6b03f29aabea10a314bf1a068aba23452e4 |
Ninth confirmed sibling | PE checksum 0x2A237 |
73841818... |
Tenth confirmed sibling | PE checksum 0x306CE |
0017ecc5... |
Eleventh confirmed sibling | PE checksum 0x2FF42 |
34ca794e... |
Twelfth confirmed sibling | PE checksum 0x26DC4 |
a2dca6ef... |
Thirteenth confirmed sibling | PE checksum 0x28FB1 |
cdc7d79a... |
Fourteenth confirmed sibling | PE checksum 0x326E1 |
ae02bd22... |
Fifteenth confirmed sibling | .text hash matches majority group; no blackmatter label |
7e9bbc5c... |
Sixteenth confirmed sibling | .text hash matches majority group; no blackmatter label |
877f1047... |
Seventeenth confirmed sibling | .text hash divergent from majority group; no blackmatter label |
e67dbabcd... |
Eighteenth confirmed sibling | .text hash matches majority group; no blackmatter label |
2ac8295381... |
Nineteenth confirmed sibling | .text hash matches majority group; no blackmatter label |
89dc341bbd... |
Twentieth confirmed sibling | .text hash matches majority group; no blackmatter label |
8655b3b9b2... |
Twenty-first confirmed sibling | .text hash matches majority group; no blackmatter label |
91e39f6bb60a... |
Twenty-second confirmed sibling | .text hash matches majority group; no blackmatter label |
65844473d39b... |
Twenty-third confirmed sibling (this) | .text hash matches majority group; no blackmatter label |
All twenty-three samples share the identical compilation timestamp (0x631A9665), linker version (14.12), and XOR key (0x10035fff).
References
- Deep structural analysis of cluster stub: /intel/analyses/136b57507a3cfe1fc39cf6973869dca7e871e91d63f283c77380fc33298d6d51.html
- Majority-group sibling report: /intel/analyses/ae02bd22cede04bdb3d48b0e32a9611c9352f28e2ddaf56af55112fdb8b2cc17.html
- Entity page: unattributed
- Entity page (contested label): blackmatter
- Technique pages: peb-walking-api-resolution, prng-seeded-c2-url-decoding
Provenance
Analysis produced from static triage inputs and radare2 decompilation (analysis level 3) of the binary at <sample 044539a2eacf.bin>. CAPE dynamic analysis skipped — no Windows guest available. All behavioral claims are statically inferred and marked accordingly. Sibling relationship verified via PE metadata (timestamp, linker version, size) and .text/.data section-hash comparison.