blackmatter: 877f1047 — 16th sibling, .text hash divergent, dropped-by-phorpiex (no blackmatter label)

Executive Summary

Sixteenth confirmed sibling in the MSVC 14.12 PE32 reflective-loader cluster. This sample shares the identical compilation timestamp (0x631A9665), linker version (14.12), section layout, XOR-NOT string cipher (0x10035fff), PEB-walking API resolution, CPUID anti-VM gate, and LCG PRNG (0x19660d/0x3c6ef35f) with the fifteen prior siblings. Its .text hash (000a9a8b...) differs from the ae02bd22/21b12514/7e9bbc5c triplet, indicating a stub-variant branch or per-campaign recompilation. The payload-bearing .data and .pdata sections are individually hashed, confirming per-sample customization. Carries the dropped-by-phorpiex OpenCTI tag but no blackmatter label — consistent with the ae02bd22/7e9bbc5c pattern of phorpiex-only tagging. Static-only; CAPE skipped. See blackmatter entity page for the full cluster fingerprint.

What It Is

Section Hash Delta (per-sample customization)

The .text divergence is the only structural difference from the stub template shared by siblings ae02bd22, 21b12514, and 7e9bbc5c. Whether this reflects a different compiler optimization tier, a code-path variant (e.g., alternate anti-VM branch), or a recompiled stub from the same builder source is undetermined from static analysis alone.

How It Works

Shared behavior is identical to the cluster template. See the primary analysis for 136b5750 and the blackmatter entity page for the full walkthrough of:

• PEB-walking API resolution (InMemoryOrderModuleList → export hash → .data slot cache) ^[peb-walking-api-resolution]
• XOR-NOT string decryption (0x10035fff key) and base-62 alphabet table generation
• CPUID hypervisor-bit anti-VM gate + RDTSC rotate-13 timing check
• LCG PRNG (0x19660d/0x3c6ef35f) for C2 URL / User-Agent / sleep jitter generation
• Reflective PE loader (VirtualAlloc → write → VirtualProtect → thread resume)
• File-system enumeration (FindFirstFile "*" wildcard) and directory traversal
• HTTP POST C2 with encrypted body via WinInet-style indirect APIs

Deltas Specific to 877f1047

1. No blackmatter OpenCTI label: Unlike siblings 9d8526b0, 136b5750, 0b525c35, 370415c8, c527ebf0, d715b248, dc870a75, 73841818, 0017ecc5, 34ca794e, a2dca6ef, cdc7d79a, this sample carries only dropped-by-phorpiex, exe, and malware-bazaar. The blackmatter tag appears to have been applied inconsistently by the upstream connector. ^[metadata.json] ^[triage.json]

2. Floss / capa both failed: floss.txt shows a CLI argument-order error (--no misinterpreted the sample path as a choice); capa.txt failed because the signature database is missing on the analysis host. No behavioral capability mapping is available for this sample. ^[floss.txt] ^[capa.txt]

3. .text hash mismatch: Confirms the stub is not byte-identical to the ae02bd22/21b12514/7e9bbc5c group. The difference is small enough that the entry-point orchestrator (0x417034) and all anti-analysis / API-resolution / C2 functions remain structurally identical in radare2; the divergence may be in compiler padding, relocation targets, or a minor code-path tweak. ^[r2:fcn.00417034]

Decompiled Behavior

All function addresses, slot assignments, and constants match the cluster template. No new functions were identified.

C2 Infrastructure

No hard-coded C2 endpoints survive. C2 domain, path, and User-Agent are generated at runtime via the LCG PRNG + base-62 alphabet table, identical to the cluster template. Static inference only — CAPE skipped. ^[dynamic-analysis.md]

Interesting Tidbits

• OpenCTI label inconsistency: The absence of the blackmatter tag on this sample (while present on 12 of 15 prior siblings) suggests either connector-side label drift, or the blackmatter tag was added retroactively to older samples and not applied to newer fetches. The dropped-by-phorpiex tag is the only stable delivery indicator. ^[metadata.json]
• Floss CLI failure: The triage script passed the sample path as a positional argument to --no, causing a usage error. This is a pipeline bug, not a sample property, but it means no decoded strings were extracted for this sibling. ^[floss.txt]
• Capa signature database missing: The capa.txt failure (default signature path doesn't exist) is a host-side configuration issue. No capability map was generated. This is a known recurring issue on the analysis VM. ^[capa.txt]
• POGO debug metadata still present: Even after 16 siblings, every sample retains the IMAGE_DEBUG_TYPE_POGO directory (size 0xF4). This is a strong builder fingerprint — the pipeline that produces these stubs does not strip debug directories. ^[pefile.txt:313]
• .data entropy 7.987: Consistently near-maximum across all siblings, confirming the builder encrypts the payload with high-entropy cipher output (or compressed-then-encrypted). The .data SHA-256 is unique per sample, confirming individualized keys or per-sample payload content. ^[pefile.txt:152]

How To Mess With It (Homelab Replication)

See the primary analysis for 136b5750 (raw/analyses/136b5750.../report.md) and the blackmatter entity page. The stub replication steps are identical. The per-sample delta is limited to the .data payload — any encrypted PE, shellcode, or config blob injected into the template will produce a unique .data hash and PE checksum while preserving the stub fingerprint.

Deployable Signatures

YARA Rule (adapted for this sibling)

rule blackmatter_cluster_877f1047_pe32_pogo_reflection
{
    meta:
        description = "MSVC 14.12 PE32 reflective loader with PEB-walking, XOR-NOT cipher, POGO debug, and LCG PRNG — 16th confirmed sibling"
        author = "PacketPursuit"
        date = "2026-08-27"
        sha256 = "877f1047825cb5b73a4812279ac15e8987290c99a5d3a99473a9ec85066fabd6"
        cluster = "blackmatter-unattributed-msvc1412-loader"
    strings:
        $xor_not_key = { 3D FF 5F 03 10 }           // cmp eax, 0x10035fff
        $xor_not_op = { 81 31 FF 5F 03 10 }         // xor dword ptr [ecx], 0x10035fff
        $lcg_mul = { 0D 66 19 00 00 }               // 0x19660d
        $lcg_inc = { 35 3C EF C6 03 }               // 0x3c6ef35f
        $lcg_mask = { 25 FF FF FF 07 }              // and eax, 0x7ffffff
        $alphabet_1 = { 41 BB BF EA }               // encrypted "ABCD"
        $alphabet_2 = { 45 E6 BB A7 }               // encrypted "EFGH"
        $alphabet_3 = { 49 EA B7 A3 }               // encrypted "IJKL"
        $post_wide = { 50 A0 B3 EF 53 A0 A8 EF 00 A0 FC EF }  // encrypted "POST" wide fragments
        $pogo_debug = { 0D 00 00 00 F4 00 00 00 }   // IMAGE_DEBUG_TYPE_POGO, size 0xF4
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C) + 0x18) == 0x10B and   // PE32
        uint16(uint32(0x3C) + 0x14) == 0x00E0 and  // Optional header size (standard)
        uint16(uint32(0x3C) + 0x16) == 0x0006 and   // 6 sections
        3 of ($xor_not_*) and
        2 of ($lcg_*) and
        2 of ($alphabet_*) and
        $post_wide and
        $pogo_debug
}

Behavioral Fingerprint

This binary loads with a six-section PE32 GUI facade: only GDI32, USER32, and KERNEL32 GUI functions are imported statically. Within the first 5 seconds of execution it walks the PEB InMemoryOrderModuleList to resolve VirtualAlloc, CreateThread, InternetOpen, and cryptographic APIs by export hash, caching pointers in the .data pseudo-import table near 0x425000. It allocates RWX memory, copies a decrypted payload into it, and spawns two threads: one recursively enumerating the file system (FindFirstFile "*"), the other building an HTTP POST request with an encrypted body. The C2 domain and User-Agent are generated at runtime using a seeded LCG PRNG and a base-62 alphabet table. If executed inside a VM, CPUID leaf 1 ECX[31] or leaf 7 EBX[18] hypervisor bits cause altered code paths. The binary carries a POGO debug directory (IMAGE_DEBUG_TYPE_POGO, size 0xF4) and a compilation timestamp of 0x631A9665 (Sep 9 2022). PE checksums vary per sample; .data and .pdata section hashes are unique per sample. The .text hash may match the ae02bd22/21b12514/7e9bbc5c group or diverge as seen in 877f1047.

IOCs

Detection Signatures

References

• OpenCTI artifact: 7b34167d-f74c-42d1-99a9-8f1203daeac1, labels: dropped-by-phorpiex, exe, malware-bazaar ^[metadata.json]
• Cluster entity page: blackmatter — full cluster analysis, build pattern, and all 16 sibling entries
• Primary unattributed analysis: 136b5750 — first deep-dive on this stub template
• Technique page: peb-walking-api-resolution
• Delivery infrastructure: phorpiex

Provenance

Analysis produced from static triage inputs (file.txt, pefile.txt, exiftool.json, metadata.json, rabin2-info.txt, yara.txt, ssdeep.txt, tlsh.txt) and radare2 decompilation (analysis level 3) of the binary at <sample 877f1047825c.bin>. Floss failed due to CLI argument-order error (--no misinterpreted). Capa failed due to missing signature database on the analysis host. CAPE dynamic analysis skipped — no Windows guest available. All behavioral claims are statically inferred and reference the 136b5750 primary analysis and the blackmatter cluster entity page for shared behavior. ^[/intel/analyses/877f1047825cb5b73a4812279ac15e8987290c99a5d3a99473a9ec85066fabd6.html]