> Technique · protector-lab-overlay_

~/packetpursuit $ cat /intel/techniques/protector-lab-overlay.md

typetechniqueconfidencehighcreated2026-06-17updated2026-06-17packerobfuscationevasionpe

protector-lab-overlay

Protector Lab (plab) is a commercial Windows PE packer / protector that encrypts the real payload into a large AES-256-GCM overlay appended to the end of the PE file. The outer stub is a MinGW-w64 or MSVC C++ binary that decrypts and optionally injects the payload at runtime.

Detection / Fingerprint

  • Magic headers embedded near the end of the file:
    • PLABOV21 — overlay version marker
    • PLABPKG2 — package bundle marker
    • plab.overlay.bundle.v1 — string in .rdata
    • plab.inner.pkg.v1 — inner package string ^[sample 2b2293a0/strings.txt:146,1618,1747,1755]
  • Payload encoding string: payloadEncoding=aes-256-gcm-v2 ^[sample 2b2293a0/strings.txt:1689]
  • Imports: bcrypt.dll with AES-GCM, SHA256, and key-generation APIs ^[rabin2-info.txt]
  • Compiler strings: GNU C23 15.2.0 -march=nocona ... -fno-stack-protector (MinGW builds) ^[sample 2b2293a0/strings.txt:2585]
  • Manifest tokens: anti_debug_level, polymorphism_level, guard_plan — parsed from embedded JSON ^[sample 2b2293a0/strings.txt:4545-4548]

Implementation Patterns

The stub performs the following steps (observed via symbol names from the mangled C++ RTTI):

  1. parse_manifest_from_json — reads build-time configuration
  2. validate_anti_debug_level_token / validate_polymorphism_level_token — confirms guard settings
  3. stub_deterministic_seed — derives a per-build seed used for key generation
  4. derive_inner_aes_key / derive_overlay_aes_key — key-derivation using SHA256
  5. verify_package_and_decode_payload — AES-GCM decrypt + authenticate
  6. stub_execute_guard_plan_or_throw — transfers control to the decrypted payload

The overlay is located by reading the PE file from disk (GetModuleFileNameW) and scanning backwards for PLABOV21.

Reproduce on your own VMs

  1. Build a MinGW-w64 console executable with -O2 -fno-stack-protector.
  2. Implement a function that calls BCryptOpenAlgorithmProvider for BCRYPT_AES_ALGORITHM, sets BCRYPT_CHAIN_MODE_GCM, generates a 256-bit key with BCryptGenerateSymmetricKey, and encrypts your payload.
  3. Append the ciphertext + 16-byte GCM tag + PLABOV21 footer to the end of your compiled .exe.
  4. In the stub, locate the footer, read backwards to get the ciphertext, derive the key from a hardcoded seed, decrypt with BCryptDecrypt, and jump to the result.
  5. Add optional IsDebuggerPresent / PEB checks for anti-debug realism.

Verification: Run strings on the resulting binary and confirm plab.overlay.bundle.v1, BCryptOpenAlgorithmProvider AES, and PLABOV21.

Defensive Countermeasures

  • Look for the PLABOV21 / PLABPKG2 magic in PE overlays at file-offset tail.
  • Monitor bcrypt.dll usage combined with CreateProcessW + VirtualAllocEx in a short time window.
  • Memory forensics: dump the decrypted payload from the child process after the overlay decryption routine runs.

Pages where observed

  • remusstealer — entity page
  • /intel/analyses/2b2293a0cd9ff8648a95a9a46e6999c9e9961fc281ff5d0b698a22755974c621.html