Hi r/asknetsec,

I’m not here as an expert or even an apiring threat researcher. I do digital forensic document examination. Basically, PDFs when the original paper document isn’t available. It’s a career path I was immediately attracted to when I found out how long it takes to become a traditional forensic document examiner. This has lead me to investigate more than a few US land registry property fraud cases. I spent most of this year investigating hidden transactions in land registry documents. Transactions found. CID map decoded, etc.

Here’s the thing…

During the investigation, my computer and phone were hacked. Nothing destructive. More of a surveillance hack. Based on the shell code found in the documents I was looking at, I guess the hidden transaction people likely had also put a hidden payload the documents as an insurance policy.

Not knowing anything about malware research, I was able to colab, python and AI myself to this point (Gemini summary below…)

FINAL THREAT INTELLIGENCE BRIEFING: VAULTTRUST/HWEIRE CAMPAIGN

File Analyzed: _1 (13).pdf Threat Status: Confirmed Advanced Multi-Stage RCE Static Analysis Status: COMPLETE. Final payload isolated.

---

I. Attack Chain Summary: Evasion Strategy

The analysis confirms a highly sophisticated, sequential attack leveraging multiple XOR keys to compartmentalize the threat components.

Sequential Stages and Keys:

Stage	Mechanism Confirmed	Key/Token Used	Role in Evasion
1. Detonation	Ghostscript RCE Exploit	HWEIRE	Trigger: Initiates the RCE and sandbox escape. Localized in small objects (3, 17).
2. Payload Decryption	Multi-Byte XOR	vaulttrust@s	Decryption Key: Decrypts the 64KB raw machine code binary at Offset 0.
3. Command Staging	High-Entropy Streams	CID Glyphs (vmz, JPS)	Configuration: Separate streams hold plaintext parameters (registry keys, cmd templates) that the decrypted binary consumes at runtime.

Visual Aid (For Reference on Reddit)

[Insert a diagram illustrating a multi-stage Ghostscript RCE attack chain: 1. Malicious PDF with vaulttrust@s XOR stream -> 2. Ghostscript RCE bypasses sandbox -> 3. HWEIRE key activates shellcode -> 4. vaulttrust@s key decrypts final binary payload -> 5. Payload executes and attempts C2 connection.]

---

II. Final Status of Extracted Payload

• Payload Name: vaulttrust_payload_64KB.bin (This is the final, raw binary.)
• Token Density: The binary contains 46 instances of the vaulttrust token, confirming its identity as the core malware signature.
• C2 Address: NOT FOUND. The C2 address is confirmed to be encrypted within the payload binary and is only decoded into memory when the code runs.

---

III. The Final Step: Dynamic Analysis

To complete the intelligence picture, you must perform the following action using the file you successfully extracted:

1. Tool: Use a specialized dynamic analysis sandbox or shellcode emulator (e.g., scdbg, Speakeasy, or a commercial EDR sandbox).
2. Input: Submit the extracted file vaulttrust_payload_64KB.bin.
3. Goal: The emulator will execute the code and capture the final, plaintext C2 Domain or IP Address when the code attempts to call a network API function (like WinHttpOpen or socket).

This final step will complete the intelligence lifecycle by revealing the threat actor's network infrastructure.

——

So…it’s like I’ve reached the big boss at the end of Nintendo game, but I’m not sure how to complete the level.

Can someone who knows how to use scdbg or another tool mentioned lend a hand? This is vaulttrust_payload_64KB.bin https://drive.google.com/file/d/1dxDGYNILLcbklFd6Q4cW_VjNspwn10p-/view?usp=drivesdk