Stage 03 — Reverse Engineering Deep Dive

Static Engine Cascade

11 Specialized Signature Engines — The Core Detection Layer

0Static Engines
0Sig Types
14Detection Events
6Attribute Prefixes

From RE of mpengine.dll v1.1.24120.x

What This Stage Does

After passing the FRIENDLY_FILE whitelist, the file enters a cascade of 9 static signature engines (plus 2 downstream BRUTE families in Stage 9), each specialized for a different matching strategy.

The engines run in a defined order, sharing a common scan context. Each deposits attributes (string tags) that downstream engines and the AAGGREGATOR can reference.

This is a purely static analysis stage — no emulation, no script deobfuscation, no container extraction. The raw file bytes are analyzed as-is.

The cascade order is optimized: fastest engines first, most expensive last. High-confidence early matches can short-circuit later engines.

// Cascade pseudocode from RE fn run_static_cascade(ctx: &mut CascadeCtx) { engine_static(ctx); // 1 engine_pehstr(ctx); // 2 engine_pehstr_ext(ctx); // 3 engine_pehstr_ext2(ctx); // 4 engine_kcrce(ctx); // 5 engine_kcrcex(ctx); // 6 engine_pestatic(ctx); // 7 engine_pestaticex(ctx); // 8 engine_bm_static(ctx); // 9 // Stage 9 (downstream): engine_brute(ctx) // Stage 9 (downstream): engine_nscript_brute(ctx) }

9 Static Engines + 2 Downstream BRUTE Families

Static cascade is ordered by execution priority in Stage 3. BRUTE/NSCRIPT_BRUTE signature types are shown for downstream Stage 9 context.

01 STATIC 0x109860DC — Legacy byte-pattern signatures (Aho-Corasick automaton)
02 PEHSTR 0x109869C8 — PE header string matching (imports, exports, resources)
03 PEHSTR_EXT 0x10986618 — Extended PE header strings (regex-like, cross-section)
04 PEHSTR_EXT2 0x109863EC — Second-gen: Unicode strings, demangled symbols, manifests
05 KCRCE 0x109868B4 — Kernel CRC checksums over entry point / code sections
06 KCRCEX 0x109871A4 — Extended CRC with larger windows, polymorphic variants
07 PESTATIC 0x1098718C — PE static analysis: entropy, imports, header anomalies
08 PESTATICEX 0x10987210 — Extended: Authenticode, resources, .NET metadata
09 BM_STATIC 0x10986AE4 — Behavioral monitoring static: packers, shellcode, injection
10 BRUTE 0x10986D8C — Stage 9 (downstream): feature-based polymorphic detection (PDF, VBS, JS)
11 NSCRIPT_BRUTE 0x10986AB0 — Stage 9 (downstream): NSCRIPT_BRUTE for deobfuscated script content

Pattern & String Matchers

Engines 1-4: Byte patterns and PE header string analysis

STATIC (Engine 1)

The oldest engine. Pre-compiled Aho-Corasick automaton matches fixed byte sequences at known offsets. Fastest engine in the cascade.

PEHSTR Family (Engines 2-4)

Three generations of PE header string matching, progressively more capable:

PEHSTR — Import/export table string matching
PEHSTR_EXT — Cross-section, regex-like patterns
PEHSTR_EXT2 — Unicode, demangled C++, manifests

What PEHSTR Extracts

// PE header strings extracted: Import Table: DLL names: kernel32.dll, ntdll.dll Functions: VirtualAlloc, WriteProcessMemory Export Table: Exported names and ordinals Resources: Version info, string tables RT_MANIFEST content Debug Directory: PDB paths (e.g., C:\dev\malware.pdb) Sections: Section names (.text, UPX0, .reloc) // Each match deposits HSTR: attributes

CRC & PE Analysis Engines

Engines 5-8: Checksums, structural analysis, and extended PE inspection

KCRCE / KCRCEX (Engines 5-6)

// CRC computation windows: KCRC1: CRC32 over entry point region KCRC2: CRC32 over .text section start KCRC3: CRC32 over PE header region KCRC3n: Normalized variant // From FileHashes table @ 0x10A5B4A0: CREATE TABLE FileHashes( ... PartialCRC1 UNSIGNED INT, PartialCRC2 UNSIGNED INT, PartialCRC3 UNSIGNED INT, KCRC1 UNSIGNED INT, KCRC2 UNSIGNED INT, KCRC3 UNSIGNED INT, KCRC3n UNSIGNED INT );

PESTATIC / PESTATICEX (Engines 7-8)

Entropy Analysis
Per-section entropy to detect packing
Import Anomalies
Suspicious API combinations (inject + execute)
Header Validation
Suspicious timestamps, section alignment
Authenticode (EX only)
Certificate chain, signing anomalies
.NET Metadata (EX only)
CLR header, MSIL token analysis

Advanced Engines

Stage 3 BM_STATIC + Stage 9 BRUTE/NSCRIPT_BRUTE context

BM_STATIC

Detects behavioral precursors without execution: packer signatures, anti-debug patterns, shellcode, injection stubs.

@ 0x10986AE4

BRUTE

Feature-based polymorphic matching. Extracts statistical features from PDF, VBS, and JS files rather than fixed patterns.

@ 0x10986D8C

NSCRIPT_BRUTE

Combines BRUTE feature extraction with NScript analysis for obfuscated scripts that evade pattern matching.

@ 0x10986AB0
// BRUTE feature prefix strings from binary "BRUTE:PDF:Feature:" @ 0x10A54CC8 // PDF structure features "BRUTE:VBS:Feature:" @ 0x10A54D08 // VBScript code features "BRUTE:JS:Feature:" @ 0x10A54D1C // JavaScript features // Related behavioral string "MP_BEHAVIORAL_NETWORK_BLOCK_BRUTE_FORCE" @ 0x10B6D844

Attribute Deposition

Each engine deposits tagged attributes into the shared scan context

HSTR: From PEHSTR / PEHSTR_EXT — e.g., HSTR:Win32/Rbot.gen!dll
SIGATTR: From various — e.g., SIGATTR:PE:UPXPacked
KCRCE: From KCRCE / KCRCEX — e.g., KCRCE:0x1a2b3c4d
BRUTE: From BRUTE — e.g., BRUTE:PDF:Feature:JsPresent
STATIC: From STATIC engine — e.g., STATIC:Win32/Virut.A
BM: From BM_STATIC — e.g., BM:SuspiciousImports

Attribute Consumers

AAGGREGATOR (Stage 11)
Boolean expressions: HSTR:A AND KCRCE:B AND NOT SIGATTR:C
Lua Scripts (Stage 10)
Programmatic: mp.getattribute("HSTR:...")
MAPS Cloud (Stage 12)
Attribute bundles sent for ML classification

File Format-Specific String Matchers

Beyond PE files, dedicated HSTR engines exist for every major file format

MACHOHSTR_EXT 0x109861D8 macOS Mach-O
MACROHSTR_EXT 0x109870A0 Office Macros
JAVAHSTR_EXT 0x109870EC Java .class
SWFHSTR_EXT 0x10986DDC Flash SWF
DEXHSTR_EXT 0x10986430 Android DEX
DMGHSTR_EXT 0x10986D58 macOS DMG
INNOHSTR_EXT 0x10986D20 Inno Setup
ASCRIPTHSTR_EXT 0x109864D4 AutoScript

Detection Event Strings

ETW trace events emitted during static cascade detection

PuaDetection 0x10A34170 — Potentially Unwanted App
MoacNotSigned 0x10A4B490 — Unsigned MOAC detection
LowfiNonInt 0x10A53670 — Low-fi non-interactive
LowfiTrusted 0x10A536E0 — Low-fi trusted
PythonInfected 0x10A78300 — Python malware
JsEmuEval 0x10A784CC — JavaScript emu eval
ExhaustiveScriptScan 0x10A77F28 — Deep script scan
ChainedObjectCount 0x10A78738 — Chained object limit
BMLuaSigattr 0x10A49468 — BM Lua sig attribute
LuaFolderLatent 0x10B6B598 — Lua folder latent

Cascade Execution Flow

9 static engines run sequentially in Stage 3; BRUTE/NSCRIPT_BRUTE run later in Stage 9

Input
→
STATIC
→
PEHSTR
→
EXT
→
EXT2
→
KCRCE
→
KCRCEX
→
PESTATIC
→
EX
→
BM_STATIC
→
BRUTE
→
NSCRIPT
→
Attrs
FastEngines 1-4: pattern + string
MediumEngines 5-8: CRC + structure
ExpensiveBM_STATIC + Stage 9 BRUTE families

Supporting Signature Types

Additional SIGNATURE_TYPE entries that support the cascade as sub-components

AAGGREGATOR 0x10986B3C Boolean expr evaluator
AAGGREGATOREX 0x10986E28 Extended evaluator
SIGTREE 0x10986C88 ML decision tree classifier (~14,926 trees). See SS14
SIGTREE_EXT 0x10987008 Extended ML decision tree (~3,771 trees). See SS14
SIGTREE_BM 0x109871D4 Behavioral monitoring ML trees (~14,731 trees). See SS14
NID 0x10986AD0 Network Inspection
BM_INFO 0x10986C58 BM info records
BLOOM_FILTER 0x10987108 Probabilistic lookup
MAGICCODE 0x10987158 Magic byte patterns

Stage 03 Summary

9 Static Engines + 2 Downstream Families

From fast byte-pattern matching (STATIC) to expensive feature-based polymorphic detection (BRUTE). Ordered for optimal performance.

Attribute-Based Architecture

Each engine deposits tagged attributes (HSTR:, KCRCE:, BRUTE:) that the AAGGREGATOR evaluates as boolean expressions.

160+ Signature Types

The VDM contains entries for 160+ distinct SIGNATURE_TYPE values, covering every file format and analysis technique.

Next: Attribute Collection

After the cascade, accumulated attributes feed into PE analysis, emulation, and ultimately the AAGGREGATOR verdict.

All addresses from RE of mpengine.dll v1.1.24120.x — 160+ SIGNATURE_TYPE strings