LZSS/XZ Embedded Decompressor

Custom in-memory LZSS-style decompressor observed in the esmk-crypter-loader family. The engine uses a sliding-window hash table for match lookup and emits back-reference / length pairs. The magic constant 0xcf1bbcdcbb000000 (a variant of the XZ CRC-64 polynomial 0xC96C5795D7870F42) appears as a hash multiplier, making it a strong static fingerprint.

Detection / Fingerprint

• Constant 0xcf1bbcdcbb000000 used as a 64-bit hash multiplier in the match-finding loop
• Division shortcut 0x8080808080808081 (used for fast division by 127 in LZ77 implementations)
• String artifacts: "Decompression failed!", "Decompression successful", "Decompressed size should be: %d bytes"

Implementation Pattern

From decompiled fcn.140003f20:

1. Initialize a hash table indexed by (qword * 0xcf1bbcdcbb000000) >> 0x34
2. Walk the input buffer, computing hash for each 2-byte prefix
3. On hash collision, verify the match with a byte-by-byte compare
4. Emit back-reference pairs as (distance << 4) | length (lengths up to 254 encoded as 0xFF literal run)
5. Fallback literal run uses 0xF0 sentinel followed by length

The engine is SSE-optimized in places (xmmword stores for bulk literal copy at 0x140004180 and 0x140004400).

Defensive Countermeasures

• YARA: hunt for the 64-bit constant CF 1B BC DC BB 00 00 00 (little-endian 0xcf1bbcdcbb000000)
• Behavioral: the decompressor allocates a large contiguous buffer (~2× compressed size) via HeapAlloc or VirtualAlloc before writing

Pages Where Observed

• esmk-crypter-loader