0d3d6bb9131e58c4dcf833781bb944eedd4bd53f5736bb1c33af11b3031fb4cdBuild / RE
| Property | Value |
|---|---|
| Format | .NET Framework 4.0 PE32 (CIL assembly) ^[file.txt] ^[pefile.txt] |
| Toolchain | Visual Studio / MSBuild Debug configuration; IL linker output (ILC v48.0 metadata) ^[pefile.txt] ^[capa.txt] |
| Internal name | daQK.exe ^[pefile.txt] |
| PDB | daQK.pdb (no path) ^[pefile.txt] |
| Version | 1.0.0.0 / AssemblyVersion 1.0.0.0 ^[pefile.txt] |
| PE timestamp | Sat Aug 01 03:53:38 2044 UTC — future-dated, fabricated ^[pefile.txt] ^[metadata.json] |
| Signed | No ^[pefile.txt] |
| Packing / obfuscation | None ^[file.txt] ^[binwalk.txt] |
| Anti-analysis | None ^[strings.txt] ^[floss.txt] ^[capa.txt] |
The assembly is an unobfuscated CIL binary. CIL metadata exposes the full class hierarchy. Notable namespaces and classes:
Windows_User_Interaction.GameForm— main game windowWindows_User_Interaction.Board— 8×8 game-board state managerWindows_User_Interaction.Player— player model (colour, score, turn state)Windows_User_Interaction.Trif32— Caesar-shift-23 decoder (benign coursework utility)Windows_User_Interaction.MyImage,.MyRoundButton,.MyButton— custom WinForms controls
^[pefile.txt] ^[strings.txt: Windows_User_Interaction] ^[floss.txt: Trif32]
Embedded Resources
- .rsrc section: Zlib-compressed
.resourcesblob (WinForms localization and image assets), standard 24×24 UAC manifest, and a 128×128 PNG application icon. ^[binwalk.txt] - #Strings metadata: Two hardcoded 64-character hexadecimal strings resembling SHA256 hashes. Neither matches the binary's own SHA256; neither matches any known corpus sample. Purpose unknown (possibly license/integrity artefact, or leftover from a referenced NuGet package). ^[strings.txt]
Capa Assessment
Zero ATT&CK technique matches. Capa output consists solely of dnfile parser structural warnings (duplicate #Strings/#GUID/#Blob streams) with no meaningful capability detection. This differs from the first checkers sibling (4cce5506) which produced T1620/C0021.003 false positives — the delta is likely capa version or build-configuration drift, not a material change in the binary. ^[capa.txt]
Deploy / ATT&CK
Social-Engineering Masquerade
The distribution filename is Shipping_docs.exe — a logistics/shipping-document lure. VS_VERSIONINFO masquerades as a legitimate Microsoft system tool:
| Field | Value |
|---|---|
FileDescription |
Security Descriptor Editor |
CompanyName |
Microsoft Corporation. |
ProductName |
Microsoft (R) Windows (R) Operating System |
OriginalFilename |
explorer.exe |
InternalName |
daQK.exe |
FileVersion |
1.06.0630 |
^[pefile.txt] ^[exiftool.json]
This is classic false-legitimacy packaging: the inner name (daQK.exe) is auto-generated nonsense (likely by the repackager), while the VS_VERSIONINFO claims Microsoft provenance and uses the explorer.exe original-filename to further confuse manual inspection.
ATT&CK Mapping
| Technique | ID | Evidence | Verdict |
|---|---|---|---|
| Masquerading | T1036.005 | VS_VERSIONINFO claims Microsoft Corporation / explorer.exe / Security Descriptor Editor ^[pefile.txt] |
Social engineering only |
| Reflective Code Loading | T1620 | Capa flagged on sibling 4cce5506; absent here. No Assembly.Load on foreign bytes. |
False positive / not applicable |
| Generate Pseudo-Random Sequence | C0021.003 | makeComputerMove uses System.Random for AI opponent piece selection |
Benign game AI |
No persistence, no network APIs, no process injection, no credential access, no anti-analysis, no C2.
Dynamic Behaviour
Static-only analysis. CAPE skipped — no Windows guest available. The binary's surface is a standard WinForms checkers/draughts game with human-vs-computer and human-vs-human modes, move validation, king promotion, and a simple heuristic AI (makeComputerMove). There is no observable mechanism for downloading or executing secondary payloads.
Attribution
No crimeware builder signatures, no packer fingerprints, no stolen Authenticode certificate, and no infrastructure overlap with known families. The Windows_User_Interaction namespace, Trif32 decoder, and auto-generated internal name (daQK.exe) place this firmly in the benign .NET coursework / student-project repackaging cluster that populates the unclassified-dotnet entity. It is the second confirmed sibling of checkers sample 4cce5506.
Sibling Comparison
| Feature | 4cce5506 (first sibling) |
0d3d6bb9 (this sample) |
|---|---|---|
| Namespace | Windows_User_Interaction |
Windows_User_Interaction |
| Internal name | daQK.exe |
daQK.exe |
| PDB | daQK.pdb |
daQK.pdb |
| Version | 1.0.0.0 |
1.0.0.0 |
| Distribution filename | J-230512-31246_-_111553_-_31246.pif.exe |
Shipping_docs.exe |
| Double-extension | .pif.exe |
None (plain .exe) |
| VS_VERSIONINFO masquerade | Security Descriptor Editor / Microsoft Corporation. / explorer.exe |
Identical |
Trif32 decoder |
Present | Present |
| SHA256 hex strings in #Strings | Two | Two (different values) |
| Capa false positives | T1620 / C0021.003 | Zero |
| Size | 634,880 bytes | 635,904 bytes (+1,024 bytes) |
| PE timestamp | Wed Aug 01 03:54:33 2044 UTC |
Sat Aug 01 03:53:38 2044 UTC |
The only material deltas are the distribution filename and the specific hex values of the two embedded SHA256-like strings — consistent with a single payload being processed by an automated repackaging pipeline that randomizes filenames and may inject or mutate metadata markers.
Verdict
Benign application repackaged for social-engineering distribution. No malicious payload. The threat vector is the masquerade (shipping-document lure + Microsoft-themed version info) tricking the victim into executing what they believe is a legitimate Windows utility. The actual runtime behaviour is a trivial WinForms board game.
Static-only analysis. CAPE skipped — no Windows guest.