Nibble-Encoded Resource Payload

A lightweight pre-decryption obfuscation layer observed in the esmk-crypter-loader family. Before the main decryption routine runs, the payload bytes extracted from the PE resource section are nibble-swapped (high and low nibbles of each byte exchanged). This strips structure from the ciphertext and defeats naive entropy-based resource scanners.

Detection / Fingerprint

• String artifact: "Nibble-decoded: %lu -> %lu bytes" in the loader binary
• Precedes a "Starting decryption..." log string
• Typically paired with a custom decryption stage and a compression stage (LZSS/XZ in the ESMK case)

Implementation Pattern

// Pseudocode from observed decompilation
for (size_t i = 0; i < len; i++) {
    buf[i] = ((buf[i] >> 4) | (buf[i] << 4)) & 0xFF;
}

This is a single-pass, in-place transform with no key material.

Defensive Countermeasures

• Scan resource sections for nibble-swapped PE headers (MZ → ZM becomes 0x5A4D → swapped → not a valid signature, but the original DOS header will appear after swap)
• Look for the string pattern Nibble-decoded in loader binaries
• Combine with entropy analysis: post-nibble-swap entropy of a PE payload will spike because the DOS/PE signatures are scrambled

Pages Where Observed

• esmk-crypter-loader