March 2022

ESET researchers recently described Wslink, a unique and previously undocumented malicious loader that runs as a server and that features a virtual-machine-based obfuscator. In this white paper, we describe the structure of the virtual machine used in samples of Wslink and suggest a possible approach to see through the obfuscation techniques used in the analyzed samples. We demonstrate our approach on chunks of code of the protected sample.

During our research, we were able to successfully design and implement a semiautomatic solution capable of significantly facilitating analysis of the underlying program’s code. The virtual machine introduced a diverse arsenal of obfuscation techniques, which we were able to overcome to reveal a part of the de-obfuscated malicious code that we describe in this document.

In the last sections of this analysis, we present parts of the code that we developed to facilitate our research. This white paper also provides an overview of the internal structure of virtual machines in general, and it introduces some important terms and frameworks that are used in our detailed analysis of the Wslink virtual machine.