unattributed (blackmatter cluster): 89dc341bbd17 — 19th sibling, .text hash matches majority group, PE checksum 0x297db

Executive Summary

Nineteenth confirmed sibling in the MSVC 14.12 PEB-walking reflective-loader cluster distributed via Phorpiex spam infrastructure. Same compilation timestamp (0x631A9665), same linker (MSVC 14.12), same XOR-NOT alphabet cipher key (0x10035fff), and same .text hash (000a9a8b...) as the majority-group siblings (ae02bd22, 21b12514, 7e9bbc5c, e67dbabcd, 2ac8295381). Only deltas are the individualized .data payload and the PE checksum (0x297db). No blackmatter OpenCTI label; upstream tagging is dropped-by-phorpiex only. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

• File type: PE32 executable (GUI) Intel 80386, 6 sections ^[file.txt]
• Size: 149,504 bytes (146 KB) ^[triage.json]
• Compilation: Fri Sep 9 01:27:01 2022 UTC (0x631A9665) ^[pefile.txt:34]
• Linker: MSVC 14.12 (VS 2017 15.5+) — MajorLinkerVersion=0xE, MinorLinkerVersion=0xC ^[pefile.txt:45]
• Subsystem: Windows GUI ^[pefile.txt:66]
• Mitigations: ASLR (DYNAMIC_BASE), DEP/NX (NX_COMPAT), stack canary (canary=true) ^[pefile.txt:74],^[rabin2-info.txt:6]
• Signing: Unsigned (signed: false) ^[rabin2-info.txt:27]
• POGO: IMAGE_DEBUG_TYPE_POGO debug directory present ^[pefile.txt:313]
• PE checksum: 0x297db (unique per-sample) ^[pefile.txt:65]
• OpenCTI labels: dropped-by-phorpiex, exe, malware-bazaar ^[triage.json]
• Family: Unattributed (blackmatter cluster sibling; blackmatter label is contested/false positive per cluster consensus) ^[entities/blackmatter.md]

How It Works

This sample is a builder-pipeline twin: a shared MSVC 14.12 reflective-loader stub template with a per-sample encrypted payload injected into .data. The stub decrypts the payload, maps it reflectively into RWX memory, and transfers execution. No disk write of the inner payload.

Shared behavior (identical across all 19 siblings) is documented at blackmatter and peb-walking-api-resolution. Per-sample deltas are limited to:

• .data section contents (individualized encrypted payload)
• .pdata section contents (exception-table update for payload)
• PE checksum (builder-computed, unique per sample)

Decompiled Behavior

Radare2 analysis recovered the same three core functions seen in every sibling:

fcn.004192f4 — Payload decryption loop

^[r2:fcn.004192f4]

Implements a 6-round (24 dwords) decryption over the .data payload:

• bswap → ror 0xd → not → XOR with next dword
• rol 0xb → bswap
• rol 9 → bswap → not
• rol 7 → bswap → XOR with not of previous
• rol 5 → final XOR

Identical cipher sequence to siblings 136b5750, 21b12514, ae02bd22, 7e9bbc5c, e67dbabcd, 2ac8295381.

fcn.0041941c — Runtime string decryption (XOR-NOT alphabet table)

^[r2:fcn.0041941c]

Builds a 256-byte substitution alphabet in a stack buffer, then XOR-decrypts strings using the running table. This is the same 0x10035fff-keyed XOR-NOT cipher documented at peb-walking-api-resolution.

fcn.004104b4 — Reflective PE mapper / entry-point orchestrator

^[r2:fcn.004104b4]

Called by fcn.00409bb0 (entry-point wrapper) and fcn.00411ef4 (secondary launch path). Resolves the decrypted payload as a PE image, patches relocations, resolves imports via PEB-walking, allocates RWX memory (0x40 = PAGE_EXECUTE_READWRITE), and maps sections. Uses VirtualAlloc, memmove, and GetProcAddress equivalents resolved at runtime.

fcn.00401564 — PEB-walking API resolver

^[r2:fcn.00401564]

Traverses InMemoryOrderModuleList to find kernel32.dll / ntdll.dll, hashes export names, and caches pointers in .data slots. The same function appears in every sibling with identical control flow.

C2 Infrastructure

No hardcoded C2 strings recovered statically. The LCG PRNG C2 URL generation routine (0x19660d / 0x3c6ef35f seeds) is present in the stub but produces runtime-only URLs. No domains, IPs, or URLs in strings.

Interesting Tidbits

• .text SHA-256 000a9a8b1440e44cde00fd7acc5bdda6efc34f09e404de77cff1f5298e0af369 matches the majority-group siblings exactly, confirming the same compiler flags and source. ^[terminal:python hash of .text]
• .data SHA-256 fb719c10e176126aaf7082d6365d6053231961f6d0e6fe4609f22208295a0555 is unique to this sample — the individualized payload. ^[terminal:python hash of .data]
• No blackmatter OpenCTI label, only dropped-by-phorpiex. Upstream tagging drift confirms the blackmatter label is not a reliable family marker for this cluster. ^[triage.json]
• capa and floss both errored during triage (missing signatures and bad CLI invocation respectively), so this analysis relies entirely on radare2 + manual PE inspection. ^[capa.txt],^[floss.txt]
• .itext section (0x600 bytes, entropy 2.93) contains the decompression/thunk stub, low-entropy confirming it's a fixed template. ^[pefile.txt:112]

How To Mess With It (Homelab Replication)

See the primary cluster analysis at /intel/analyses/136b57507a3cfe1fc39cf6973869dca7e871e91d63f283c77380fc33298d6d51.html for the full reproduction pipeline. In short:

1. Compile a MSVC 14.12 x86 PE stub with POGO optimization.
2. Embed a PE payload in the .data section, encrypted with the 6-round bswap/ror/rol/not cipher.
3. Implement PEB-walking API resolution and RWX VirtualAlloc mapping.
4. Run capa on the reproducer and compare to the cluster fingerprint (minimal IAT, GDI/USER32 facade imports, VirtualAlloc+memmove runtime resolution).

Deployable Signatures

YARA rule

rule BlackmatterCluster_ReflectiveLoader
{
    meta:
        description = "MSVC 14.12 PEB-walking reflective-loader cluster (blackmatter siblings)"
        author = "Titus"
        reference = "/intel/analyses/89dc341bbd176fbcee31f54884c132faf7c847838609f330249f634b99fd0a0c.html"
    strings:
        $peb_walk_sig = { 64 A1 30 00 00 00 }         // mov eax, fs:[0x30]  ; PEB access
        $decrypt_a = { 0F C8 66 C1 C8 0D F7 D0 }      // bswap, ror 0xd, not
        $decrypt_b = { C1 C0 0B 0F C8 33 D0 }        // rol 0xb, bswap, xor
        $decrypt_c = { C1 C0 09 0F C8 F7 D0 }        // rol 9, bswap, not
        $decrypt_d = { C1 C0 07 0F C8 33 D0 }        // rol 7, bswap, xor
        $xor_key = { FF 5F 03 10 }                   // XOR-NOT key fragment 0x10035fff
        $pogo = "POGO" ascii
        $linker_14_12 = { 0E 0C }                    // MajorLinker=14, MinorLinker=12
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        #linker_14_12 >= 1 and
        #pogo >= 1 and
        any of ($decrypt_a, $decrypt_b, $decrypt_c, $decrypt_d) and
        filesize < 200KB
}

IOC list

Behavioral fingerprint statement

This binary is a 150 KB PE32 GUI executable compiled with MSVC 14.12 and POGO optimization. Its import table contains only 25 benign GUI/system APIs (GDI32, USER32, KERNEL32). At runtime it resolves threat APIs via PEB-walking export hashing, decrypts a ~40 KB payload in .data using a 6-round bswap/ror/rol/not cipher, maps the decrypted image into RWX memory, and transfers execution without writing to disk. It performs CPUID hypervisor-bit checks and RDTSC timing gates before decryption. No hardcoded C2 — URLs are generated at runtime via an LCG PRNG seeded with 0x19660d/0x3c6ef35f.

Detection Signatures

References

• Primary cluster analysis: /intel/analyses/136b57507a3cfe1fc39cf6973869dca7e871e91d63f283c77380fc33298d6d51.html
• Sibling 21b12514: /intel/analyses/21b12514e8d728ac9c1381540af63aa2501ed5351e21bf9a90162233f9f85b2c.html
• Sibling ae02bd22: /intel/analyses/ae02bd22cede04bdb3d48b0e32a9611c9352f28e2ddaf56af55112fdb8b2cc17.html
• Sibling 7e9bbc5c: /intel/analyses/7e9bbc5c0e10efd2ae5509243895cc74a242051cd48ad08055e99ac9da0ee781.html
• Sibling e67dbabcd: /intel/analyses/e67dbabcd48b1294883b07d7724f416a77963c79aaf9d81bed9d7e2d0dcd9731.html
• Sibling 877f1047: /intel/analyses/877f1047825cb5b73a4812279ac15e8987290c99a5d3a99473a9ec85066fabd6.html
• Sibling 2ac8295381: /intel/analyses/2ac8295381ebafbe6399707f5435409e859c7c08bf51c666db4438ea5e4a4abb.html
• Entity pages: unattributed, blackmatter, peb-walking-api-resolution
• Delivery: phorpiex

Provenance

• file.txt — file-type identification (file v5.44)
• exiftool.json — PE metadata (ExifTool 12.76)
• pefile.txt — DOS/NT headers, sections, imports, relocations, debug directory (pefile)
• rabin2-info.txt — radare2 binary summary (r2)
• strings.txt — ASCII/Unicode strings extraction (strings)
• triage.json — triage pipeline metadata (custom)
• metadata.json — OpenCTI connector artifact metadata
• capa.txt — Mandiant capa (errored: missing signatures)
• floss.txt — FireEye FLOSS (errored: bad CLI invocation)
• dynamic-analysis.md — CAPE sandbox (skipped: no Windows guest available)
• radare2 static analysis: mcp_radare2 with analysis level 3, 519 functions recovered, decompilation of fcn.004192f4, fcn.0041941c, fcn.004104b4, fcn.00401564, fcn.00409bb0, fcn.00411ef4, fcn.00409640