blackmatter: 8796e69f — 32nd confirmed sibling in MSVC 14.12 PEB-walking reflective-loader cluster, PE checksum 0x2e93a

Executive Summary

Thirty-second confirmed sibling in the MSVC 14.12 reflective-loader cluster first documented at 136b5750. Identical encrypted .text stub (SHA-256 000a9a8b...), identical XOR-NOT cipher (0x10035fff), identical compilation timestamp (0x631A9665 — Fri Sep 9 01:27:01 2022 UTC), and identical PEB-walking API resolution template. The .data section carries an individualized encrypted payload (SHA-256 580e7e7f...), confirming per-sample customization in a builder pipeline. Tagged dropped-by-phorpiex by OpenCTI but not carrying the blackmatter label — consistent with upstream tagging inconsistency observed across 10+ prior siblings. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

How It Works

This sample is structurally identical to the cluster described in the primary analysis at 136b5750 and the cluster entity page blackmatter. No new functional deltas were observed. For full behavioral details see:

• /intel/analyses/136b57507a3cfe1fc39cf6973869dca7e871e91d63f283c77380fc33298d6d51.html — primary analysis (PEB-walking, XOR-NOT cipher, CPUID anti-VM, LCG PRNG C2 URL generation)
• blackmatter — cluster entity page with 31 prior siblings

Cluster-Fingerprint Confirmation

1. Encrypted entry point: The byte at 0x1946F (declared AddressOfEntryPoint) is 0xc4 — not a valid x86 instruction start. Actual code is decrypted in-memory at runtime. ^[r2:fcn.00419479]

2. Encrypted .text: First 32 bytes of .text at file offset 0x400 are ff 5f 03 11 55 8b ec 51 ... — decrypt to standard x86 prologue sequences after XOR-NOT cipher with key 0x10035fff. ^[pefile.txt:93]

3. XOR-NOT alphabet cipher: Same two-step transform (^ 0x10035fff then ~ / bitwise NOT) observed across all 31 prior siblings. Encrypted alphabet table at 0x40d4b0 yields the same 62-character ordered alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789. ^[r2:fcn.0040d4b0]

4. PEB-walking API resolution: No threat APIs in static import table. All ~30+ APIs (VirtualAlloc, CreateThread, InternetOpen, CryptAcquireContext, etc.) resolved at runtime by walking PEB InMemoryOrderModuleList and hashing export names. Resolved pointers cached in .data pseudo-import slots at 0x425xxx. ^[r2:fcn.00405aec]

5. Anti-VM: CPUID leaf 1 ECX bit 31 (hypervisor present) + CPUID leaf 7 EBX bit 18 + RDTSC differential timing gate with 13-bit rotate. ^[r2:fcn.004010bc]

6. LCG PRNG C2 URL generation: Same linear congruential generator constants (a = 0x19660d, c = 0x3c6ef35f) used to generate pseudo-random C2 domain names character-by-character from the alphabet table. ^[r2:fcn.0040110c]

7. HTTP POST C2: Same encrypted wide-character fragments decoding to "POST" at runtime, confirming HTTP POST as the C2 verb. ^[r2:fcn.0040cfcc]

C2 Infrastructure

No static C2 strings recoverable — host names and URLs generated at runtime via the LCG PRNG + alphabet table. The C2 is ephemeral and reconstructed on each execution. See the primary 136b5750 analysis for the reconstruction algorithm.

Interesting Tidbits

• No blackmatter OpenCTI label on this sample despite carrying the identical .text hash as 24 confirmed blackmatter-tagged siblings. This is the 11th sample in the cluster (after ae02bd22, 7e9bbc5c, 877f1047, e67dbabcd, 2ac8295381, 89dc341bbd, 8655b3b9b2, 91e39f6bb60a, 65844473d39b, 044539a2eacf, 53e31566) that carries only the dropped-by-phorpiex tag. Upstream tagging inconsistency is now a confirmed pattern. ^[metadata.json]
• Individualized .data payload: The .data section hash is unique, confirming the builder pipeline customizes the encrypted payload per sample while sharing the stub. The .text section is byte-identical across all 32 siblings — a strong builder-template fingerprint.
• POGO optimization: IMAGE_DEBUG_TYPE_POGO directory (size 0xF4) present in all siblings, suggesting the builder compiles with Profile-Guided Optimization or reuses a single PGO-optimized stub template. ^[pefile.txt:313]
• .itext entropy anomaly: Entropy 2.93 in .itext (vs 6.63 in .text) — mostly zeros with a small import descriptor table at the head, consistent with the cluster pattern of minimal static imports. ^[pefile.txt:112]
• Section layout invariant: All 32 siblings share the exact same 6-section layout (.text, .itext, .rdata, .data, .pdata, .reloc) with identical virtual addresses and nearly identical sizes. The only per-sample variance is in .data and .pdata contents.
• PE checksum mismatch: Stored checksum 0x2E93A does not match computed 0x2CC20, indicating post-build modification or builder artifact. This is a useful cluster detection heuristic when .text is encrypted and standard checksum verification fails. ^[pefile.txt:65]

How To Mess With It (Homelab Replication)

See the primary 136b5750 analysis and the peb-walking-api-resolution technique page. To replicate the stub:

1. Compile a minimal PE32 GUI in MSVC 2017 15.5+ with POGO enabled.
2. Strip all imports except GDI32/USER32/KERNEL32 GUI functions.
3. Embed a PEB-walker that resolves VirtualAlloc, CreateThread, InternetOpen, etc. by export hash.
4. Encrypt the .text section with XOR-NOT (key = 0x10035fff), storing the decryptor in .itext.
5. Embed an individualized payload in .data encrypted with the same cipher.
6. Add CPUID anti-VM and RDTSC timing gate at entry.
7. Verify: run capa on the reproducer — should hit the same TTPs as the cluster.

Deployable Signatures

YARA Rule — MSVC 14.12 Reflective Loader Cluster

rule BlackMatter_ReflectiveLoader_Cluster
{
    meta:
        description = "MSVC 14.12 PEB-walking reflective-loader cluster (blackmatter/unattributed)"
        author = "PacketPursuit"
        date = "2026-08-30"
        hash1 = "8796e69f738fceb99fd177a5536dbccf5112ffa202a8b05be10ab45e600e289b"
        hash2 = "136b57507a3cfe1fc39cf6973869dca7e871e91d63f283c77380fc33298d6d51"
        version = "3.2"
    strings:
        $s_text_hash = { 00 0a 9a 8b 14 40 e4 4c de 00 fd 7a cc 5b dd a6 }
        $s_xor_key = { ff 5f 03 11 }
        $s_alpha1 = "ABCD" ascii wide
        $s_alpha2 = "EFGH" ascii wide
        $s_alpha3 = "IJKL" ascii wide
        $s_alpha4 = "MNOP" ascii wide
        $s_alpha5 = "QRST" ascii wide
        $s_alpha6 = "UVWX" ascii wide
        $s_alpha7 = "YZab" ascii wide
        $s_alpha8 = "cdef" ascii wide
        $s_alpha9 = "ghij" ascii wide
        $s_alpha10 = "klmn" ascii wide
        $s_alpha11 = "opqr" ascii wide
        $s_alpha12 = "stuv" ascii wide
        $s_alpha13 = "wxyz" ascii wide
        $imp_gdi = "gdi32.dll" ascii wide
        $imp_user = "USER32.dll" ascii wide
        $imp_kernel = "KERNEL32.dll" ascii wide
        $poi1 = "CreateSolidBrush" ascii wide
        $poi2 = "GetDeviceCaps" ascii wide
        $poi3 = "SetPixel" ascii wide
        $poi4 = "DialogBoxParamW" ascii wide
        $poi5 = "GetKeyNameTextW" ascii wide
        $poi6 = "LoadLibraryW" ascii wide
        $poi7 = "GetTickCount" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        uint16(uint32(0x3C)+0x18) == 0x010B and
        uint16(uint32(0x3C)+0x40) == 0x0002 and
        uint16(uint32(0x3C)+0x14) == 0x00E0 and
        uint16(uint32(0x3C)+0x14+0x02) == 0x0102 and
        uint16(uint32(0x3C)+0x40+0x06) == 0x8140 and
        uint8(uint32(0x3C)+0x18+0x02) == 0x0E and
        uint8(uint32(0x3C)+0x18+0x03) == 0x0C and
        uint32(uint32(0x3C)+0x08) == 0x631A9665 and
        ($s_xor_key at 0x400 or $s_xor_key at 0x401 or $s_xor_key at 0x402 or $s_xor_key at 0x403) and
        3 of ($s_alpha*) and
        all of ($imp_*) and
        5 of ($poi*) and
        uint16(uint32(0x3C)+0x06) == 6
}

IOC List

Behavioral Fingerprint

This binary is a 150 KB PE32 GUI with MSVC 14.12 linker signature, POGO optimization, six standard sections, and a minimal import facade (25 total imports across GDI32/USER32/KERNEL32, all GUI housekeeping). The .text section is encrypted and only decrypts at runtime via an XOR-NOT cipher with key 0x10035fff. The entry point is a single encrypted byte (0xc4). At runtime, the stub walks the PEB InMemoryOrderModuleList to resolve ~30 threat APIs (VirtualAlloc, CreateThread, InternetOpen, CryptAcquireContext, etc.) by export hash, caching pointers in a pseudo-import table in .data. It performs CPUID hypervisor-bit checks and RDTSC differential timing before spawning worker threads for file-system enumeration and HTTP POST C2 communication. C2 URLs are generated on-the-fly via an LCG PRNG with constants 0x19660d/0x3c6ef35f indexing a 62-character alphabet table. No static C2 strings exist. The .data section carries a per-sample individualized encrypted payload. This is a builder-template malware, not a hand-crafted binary.

Detection Signatures

References

• Primary analysis: 136b5750 — /intel/analyses/136b57507a3cfe1fc39cf6973869dca7e871e91d63f283c77380fc33298d6d51.html
• Cluster entity: blackmatter
• Umbrella entity: unattributed
• Technique page: peb-walking-api-resolution
• Technique page: prng-seeded-c2-url-decoding
• OpenCTI artifact ID: fc9d83fd-99a8-48e0-8382-bc8bc7267af0
• MalwareBazaar: 8796e69f738fceb99fd177a5536dbccf5112ffa202a8b05be10ab45e600e289b

Provenance

• file.txt — file(1) output
• pefile.txt — pefile Python module
• rabin2-info.txt — radare2 rabin2 -I
• exiftool.json — ExifTool 12.76
• strings.txt — strings(1)
• yara.txt — YARA
• metadata.json — OpenCTI connector artifact metadata
• r2:fcn.* — radare2 5.x analysis (level 3), 519 functions found
• .text/.data section hashes computed with Python hashlib.sha256
• Cross-sibling comparison against prior 31 cluster analyses via grep on wiki/wiki/raw/analyses/*/report.md