Vidar Virtual Machine-Based String Obfuscation

Vidar Virtual Machine-Based String Obfuscation | ThreatLabz

By Ismael Garcia Perez

Technical Analysis

The following sections examine Vidar’s string deobfuscation process, including a lightweight virtual machine and custom stream cipher.

Virtual machine deobfuscation

In order to obfuscate the malware’s strings in versions 2.x and 3.x, the Vidar developer introduced a simple virtual machine that is executed via a bytecode interpreter. The bytecode interpreter consists of a fetch–decode–execute loop with the VM code provided as a byte array. Each opcode byte indexes a sparse 256-entry dispatch table. The mat…