Identity & provenance
- SHA-256 / MD5; PE header (PE32 GUI x86); version resource (CompanyName, ProductName, OriginalFilename)
- Leftover PDB build path - told us it was the DLsite build
- Authenticode signature (absent → unsigned)
Hiding places - where a payload would actually live
- Overlay: bytes appended after the last section → 0
- Embedded PE: scanned the whole file for MZ…PE\0\0 → only the file itself
- Resources: enumerated every entry with sizes + magic bytes → 2 PNGs + icons, no MZ
- Section entropy: flagged packed/encrypted regions (the 7.95 in .rsrc was just the PNGs)
- TLS callbacks: code that runs before main → none registered
- Entry point bytes: standard MSVC CRT prologue, not a packer stub
Capability - what it can do
- Enumerated all 390 imports. Absent: Winsock/WinINet/WinHTTP, any registry API (so no Run-key persistence possible), WriteProcessMemory/CreateRemoteThread/VirtualAllocEx, crypto, service/scheduled-task creation
- Counted call sites for the ones present (libcurl, ShellExecute, CreateProcessA) - all consistent with the stock Nitroplus updater
Content
- ASCII + UTF-16 strings, grepped for: URLs/IPs, CurrentVersion\Run, PowerShell/mshta/certutil/rundll32, keylog/clipboard, browser credential paths, wallets, miners, ransom text, base64 blobs, crack-group tags
- XOR brute-force - all 255 single-byte keys against http://, .php?, POST /, User-Agent: → zero hidden C2
Verdict tooling
- Local ESET scan with adware/unsafe/unwanted/suspicious/adv-heur all forced on
- VirusTotal hash lookup (no upload needed)
How I read the 25 VT hits - the key skill:
no engine named a family. Everything was Crack/PUA, generic-heuristic, ML, or hash-reputation (Artemis!<MD5>, Ti!<SHA256> literally mean "never seen this file"). And ~45 engines including Kaspersky, ESET, Bitdefender, Dr.Web stayed silent. Structural weirdness (blank section names, RWX import section, stripped relocs, ASLR/DEP off) was fully explained by
memory-dumped + IAT rebuilt, i.e. DRM removal, which is exactly what ML models are trained to flag.
The one-line rule:
a stealer must contain the code to steal. If the imports and strings can't reach the network or the registry, generic ML hits are noise.
