unclassified-dotnet: 0bf2e649 — Parcheesi board game + Simple HSM Simulator masquerade

Executive Summary

A .NET Framework 4.0 PE32 bundling two unrelated WinForms projects — a Parcheesi board game (Parcheesi namespace) and a hardware-security-module simulator (SimpleHSMSimulator namespace) — repackaged with the social-engineering filename PO_20248099-1 12,300PCS.pdf.exe. No malicious payload, no network surface, no persistence, no anti-analysis. Capa T1620 / B0013.001 / C0021.003 are false positives from Debug-build compiler attributes. Fortieth confirmed sibling in the unclassified-dotnet benign-app masquerade cluster.

What It Is

The PE contains two distinct namespaces in a single assembly:

1. Parcheesi — A 4-player board game with Piece, Player, Form1 classes, dice-roll Random, 90 pictureBox controls for game-piece placement, sharedGrid / blueGrid / greenGrid / yellowGrid game boards, and embedded PNG dice / board-piece bitmaps. ^[strings.txt:6-126] ^[dnfile:TypeDefs]

2. SimpleHSMSimulator — A cryptographic HSM simulator with Crypto class implementing TripleDESCryptoServiceProvider, RijndaelManaged, AES/DES KCV (Key Check Value) calculation, HexToByte / ByteToHex converters, XOR helper, and ZMK (Zone Master Key) component combination. ^[strings.txt:128-145] ^[dnfile:TypeDefs]

Both namespaces share the same System.Windows.Forms GUI runtime, System.Drawing embedded resources, and standard .NET Framework 4.0 assembly references (mscorlib, System, System.Windows.Forms, System.Drawing). ^[dnfile:AssemblyRefs]

How It Works

The binary is a benign application that was likely a student portfolio or coursework mashup (two unrelated .NET projects compiled into one assembly). It was then repackaged by a distributor with a purchase-order filename to trick finance/procurement employees into executing it. ^[social-engineering-filename-lure]

The HSM simulator is a legitimate educational tool for learning key-management concepts: it accepts ZMK component parts, combines them, decrypts an encrypted key, and calculates the KCV using AES or DES. ^[strings.txt:266] The Parcheesi game is a standard WinForms board game with dice rolls, piece movement, turn tracking, and win detection. ^[strings.txt:29] ^[strings.txt:56]

There is no evidence of malicious behavior:

• No System.Net assembly reference ^[dnfile:AssemblyRefs]
• No P/Invoke (System.Runtime.InteropServices is referenced only for GuidAttribute) ^[dnfile:TypeRefs]
• No Process.Start, Registry APIs, schtasks, or persistence mechanisms ^[strings.txt:full grep]
• No anti-VM, anti-debug, or sandbox evasion ^[capa.txt]
• No C2 URLs, IPs, domains, or hardcoded network indicators ^[strings.txt:full grep]
• No Assembly.Load(byte[]) or reflective payload execution — the InvokeMember reference is standard WinForms event dispatch ^[dnfile:MemberRefs]

Decompiled Behavior

The entry point Parcheesi.Program.Main (RVA 0xbadf) initializes the WinForms application with EnableVisualStyles, SetCompatibleTextRenderingDefault, and Application.Run(new Form1()). ^[r2:sym.Parcheesi.Program.Main]

Form1.InitializeComponent (RVA 0x6398) creates the 90 PictureBox controls, 6 Button controls, 9 Label controls, 4 CheckBox colour selectors, and 1 Panel for the game board. ^[r2:sym.Parcheesi.Form1.InitializeComponent]

The SimpleHSMSimulator.Crypto class is never instantiated by the Parcheesi entry point; it is a standalone module accessed only if the user clicks into the HSM simulator form (not reachable from the Parcheesi main form without explicit navigation). The two namespaces are functionally isolated.

Parcheesi.Properties.Resources.get_dice (RVA 0xbb39) and get_DXgR (RVA 0xbb54) return embedded System.Drawing.Bitmap resources from the .resources stream. ^[r2:sym.Parcheesi.Properties.Resources.get_dice] ^[r2:sym.Parcheesi.Properties.Resources.get_DXgR]

SimpleHSMSimulator.Crypto.DecryptKeyUsingZmk (RVA 0x215c) uses TripleDESCryptoServiceProvider with a user-supplied ZMK to decrypt a key blob. CalculateKCVwithAES (RVA 0x2380) and CalculateKCVwithDES (RVA 0x22d0) compute the Key Check Value using the appropriate algorithm. ^[r2:sym.SimpleHSMSimulator.Crypto.DecryptKeyUsingZmk] ^[r2:sym.SimpleHSMSimulator.Crypto.CalculateKCVwithAES]

C2 Infrastructure

None. No network indicators recovered.

Interesting Tidbits

• Dual-namespace benign merger: Two unrelated .NET projects (board game + crypto lab) compiled into a single assembly with no inter-namespace communication. This pattern is shared with sibling bd60fe2a (BinaryTutorial + RemoteWget + JSCombiner). ^[/intel/analyses/bd60fe2a6da189779fb4bab503be814e0bcb503f20aee28ea4e989b156d8f08d.html]
• Embedded PNG game assets: Binwalk found 15 embedded PNG images (200×200 and 256×256 RGBA) representing Parcheesi board pieces and dice faces, plus one 715×500 RGB PNG (likely the game board). ^[binwalk.txt]
• VS_VERSIONINFO masquerade: CompanyName: KastleSoft, FileDescription: Parcheesi, ProductName: Parcheesi, InternalName: jeUn.exe — a fabricated identity for what is clearly a student mashup. ^[pefile.txt:235-242]
• Capa false positives: T1620 (Reflective Code Loading) triggered by DebuggableAttribute + GetTypeFromHandle + InvokeMember; B0013.001 (Analysis Tool Discovery) triggered by DebuggerNonUserCodeAttribute; C0021.003 (Generate Pseudo-random Sequence) triggered by System.Random used for dice rolls. ^[capa.txt] These are standard Debug-build artefacts, not malicious behaviour. See debug-build-capa-false-positives for the full mitigation guide.
• No floss.txt decode: FLOSS errored on invocation (--no flag conflict), confirming the outer binary has no obfuscated strings to decode. ^[floss.txt]

How To Mess With It (Homelab Replication)

This is a benign application; the replication value lies in understanding the social-engineering distribution chain, not the payload.

1. Build a comparable .NET WinForms app in Visual Studio 2019+ targeting .NET Framework 4.0.
2. Compile in Debug configuration to inject DebuggableAttribute and DebuggerNonUserCodeAttribute.
3. Run capa <your_app.exe> and confirm T1620 / B0013.001 / C0021.003 false-positive hits.
4. Rename the output to PO_<random>_pdf.exe and observe how Windows Explorer hides the .exe extension when "Hide extensions for known file types" is enabled.
5. Verification: capa should match the same false-positive profile as this sample.

Deployable Signatures

YARA Rule

rule UnclassifiedDotnet_Parcheesi_HSM_Masquerade
{
    meta:
        description = "Detects .NET Framework PE bundling Parcheesi board game and SimpleHSMSimulator crypto lab"
        author = "PacketPursuit"
        date = "2026-07-16"
        sha256 = "0bf2e649cea88d4c52b3554f02fa3c22228242e6946601e5284a4fadc1101fdf"
        family = "unclassified-dotnet"
        confidence = "low"
        static_only = true

    strings:
        $ns1 = "Parcheesi" ascii wide
        $ns2 = "SimpleHSMSimulator" ascii wide
        $ns3 = "Simple HSM Simulator" ascii wide
        $res1 = "Parcheesi.Form1.resources" ascii wide
        $res2 = "SimpleHSMSimulator.FrmSimulator.resources" ascii wide
        $company = "KastleSoft" ascii wide
        $internal = "jeUn.exe" ascii wide
        $crypto1 = "CalculateKCVwithAES" ascii wide
        $crypto2 = "CalculateKCVwithDES" ascii wide
        $crypto3 = "DecryptKeyUsingZmk" ascii wide
        $zmk1 = "txtZmkComp1" ascii wide
        $zmk2 = "txtZmkCombined" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        // Require at least one PE section with high entropy (typical for .NET)
        for any i in (0 .. pe.number_of_sections - 1) : (
            pe.sections[i].entropy > 7.5
        ) and
        // Must contain BOTH namespaces
        all of ($ns1, $ns2) and
        // At least one resource string and one crypto string
        any of ($res*) and
        any of ($crypto*) and
        // File size consistent with this cluster (600 KB – 1 MB)
        filesize > 500KB and filesize < 1MB
}

Behavioral Hunt Query (file-system / endpoint)

file.name:*PO_*.pdf.exe OR file.name:*Purchase_Order*.pdf.exe OR file.name:*PO#*.exe
AND 
file.pe.description:"Parcheesi" OR file.pe.company:"KastleSoft"
AND
NOT file.signature.signed:true

IOC List

Behavioral Fingerprint

This binary is a .NET Framework 4.0 WinForms GUI application presenting as a Parcheesi board game but also containing a Simple HSM Simulator crypto-lab module. It was distributed with a purchase-order filename (PO_20248099-1 12,300PCS.pdf.exe) exploiting Windows "Hide extensions" default. The binary is unsigned, compiled Sep 2024, has no System.Net reference, no P/Invoke, no persistence, and no anti-analysis. Capa produces T1620 / B0013.001 / C0021.003 false positives from Debug-build compiler attributes. On execution, it displays a colourful Parcheesi game board with 90 picture-box controls, dice rolls, and turn tracking. The HSM simulator is accessible only through a separate form not reachable from the main game UI.

Detection Signatures

References

• Artifact ID: 6836c01a-85f7-4ecb-be53-7d986292555f ^[triage.json]
• Source: MalwareBazaar / OpenCTI connector ^[metadata.json]
• Related wiki pages: unclassified-dotnet, debug-build-capa-false-positives, social-engineering-filename-lure
• Sibling analyses: bd60fe2a (dual-namespace benign merger), b4814a17 (Pacman + calculator merger), 724d94aa (AdvWinProgHW2 calculator), 92de8242 (GoldenCity game)

Provenance

• File-type and PE header: file v5.44, pefile via pefile library, rabin2 v5.9.4 ^[file.txt] ^[pefile.txt] ^[rabin2-info.txt]
• Strings: strings (GNU binutils) ^[strings.txt]
• FLOSS: FireEye flare-floss (errored on invocation) ^[floss.txt]
• Capa: Mandiant flare-capa v7.1.0 ^[capa.txt]
• Binwalk: binwalk v2.3.4 ^[binwalk.txt]
• .NET metadata: dnfile v0.18.0 ^[dnfile]
• Radare2: radare2 v5.9.4 (CIL analysis, 232 functions) ^[r2]
• Dynamic analysis: CAPE Sandbox — skipped, no Windows guest ^[dynamic-analysis.md]