unclassified-dotnet-chess-engine: 337c323b — Second confirmed sibling, academic-document lure variant

Executive Summary

Second confirmed sibling of the unclassified-dotnet-chess-engine cluster (see unclassified-dotnet-chess-engine). A .NET Framework 4.0 PE32 with valid Authenticode, compiled as a bitboard chess engine (WinForMono.Engine), but distributed under the filename University_of_Bahrain-_Project_FMD20240942.exe — an academic-document social-engineering lure. Static analysis finds no malicious payload, no P/Invoke, no network/crypto APIs, and no persistence. The OpenCTI label formbook is a false positive. Confidence: low — static-only; no CAPE detonation.

What It Is

• File: University_of_Bahrain-_Project_FMD20240942.exe ^[metadata.json]
• Type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, 3 sections ^[file.txt]
• Size: 847,880 bytes (≈ 828 KB) ^[metadata.json]
• Compile timestamp: Fri Sep 6 02:52:22 2024 UTC ^[pefile.txt:34]
• Linker: MSVC Linker 8.0 ^[exiftool.json:18]
• Runtime: .NET Framework 4.0 (metadata version v4.0.30319) ^[rabin2-info.txt]
• Entry point token: 0x60000a4 ^[rabin2-info.txt]
• Flags: ILONLY=1, 32BITREQUIRED=1 ^[pefile.txt]
• Signed: Yes (rabin2 signed: true) ^[rabin2-info.txt]
• Certificate chain: Comodo / Sectigo Code Signing CA, overlay at RVA 0xCBA00 (13,832 bytes) ^[pefile.txt:153–154]
• VS_VERSIONINFO: FileDescription: Sachy_Obrazky, InternalName: aosN.exe, ProductName: Sachy_Obrazky, LegalCopyright: Copyright © 2020 ^[exiftool.json]
• OpenCTI labels: exe, formbook, malware-bazaar ^[metadata.json]
• SSDeep: 24576:NDFQOl4eOVbDjw4L5oDYS76OBNZ5YFKha:0OSVbD1oDV2Oxikha ^[triage.json]

How It Works

Shared build fingerprint with sibling 7d18d78c (see unclassified-dotnet-chess-engine). This section records only the deltas.

Lure filename change: The first sibling (7d18d78c) used a .pdf.exe double-extension timestamp lure (160820242003464366.pdf.exe). This sample shifts to an academic-document masquerade (University_of_Bahrain-_Project_FMD20240942.exe), trading the double-extension trick for institutional credibility — a known evolution in social-engineering tactics when .pdf.exe detection improves. ^[metadata.json]

Compile timestamp delta: 7d18d78c was compiled at 04:31:12 UTC on Sep 6 2024; this sample at 02:52:22 UTC on the same day — approximately 1 hour 39 minutes earlier. This suggests a batch build process producing multiple variants from the same source tree. ^[pefile.txt:34] vs 7d18d78c pefile timestamp.

Internal name change: First sibling used UqHB.exe; this sample uses aosN.exe — both meaningless 4-character strings, consistent with randomization or placeholder naming. ^[exiftool.json]

Assembly metadata: dnfile confirms assembly name aosN, version 1.0.0.0. The WinForMono.Engine namespace and chess method names (MoveGeneration_White, CapsGeneration_White, MoveGeneration_Black, CapsGeneration_Black, Castling_White, Castling_Black, GetPos, HammingWeight) are identical to the first sibling. ^[strings.txt:1450–1529]

Obfuscation: Georgian / Myanmar Extended-A Unicode characters (Ⴈ Ⴐ Ⴃ Ⴗ Ⴄ Ⴀ) are present in the raw binary (6 unique UTF-8 sequences, 1 occurrence each) but absent from the ASCII strings.txt output, confirming they live in .NET metadata method names rather than plain data sections. ^[raw binary scan]

No P/Invoke surface: Single import mscoree.dll._CorExeMain. No ImplMap table entries. No VirtualAlloc, CreateRemoteThread, WinHttp, Socket, CryptEncrypt, or registry API references in MemberRef or TypeRef tables. ^[pefile.txt:255] ^[dnfile metadata inspection]

No encrypted payload resources: Only RT_VERSION (796 bytes) and RT_MANIFEST (490 bytes) in .rsrc. No ManifestResource entries. ^[pefile.txt] ^[dnfile metadata inspection]

CAPE status: Skipped — no Windows guest available. ^[dynamic-analysis.md]

Decompiled Behavior

Ghidra import not performed (cluster sibling; shared behavior documented in 7d18d78c report). radare2 indexed 501 CIL methods. Key observations identical to first sibling:

• WinForMono.Engine contains bitboard chess operations: move generation, capture generation, castling, pawn promotion, position evaluation, and Hamming-weight popcount. ^[strings.txt:1450–1529]
• WinForMono.Form1, WinForMono.Form2, WinForMono.Program — standard WinForms entry points. ^[dnfile TypeDef]
• UI framework methods with Georgian-character obfuscation in the .Ⴃ / .Ⴀ / .Ⴗ namespaces. ^[dnfile TypeDef]
• No large unexplained method bodies, no encrypted sections, no suspicious control flow.

C2 Infrastructure

None observed. No hardcoded IPs, domains, URLs, mutexes, named pipes, or registry keys. The only HTTP strings are certificate-chain CRL/OCSP URLs (http://crl.comodoca.com, http://ocsp.comodoca.com, http://www.usertrust.com) embedded in the Authenticode overlay. ^[strings.txt] ^[binwalk.txt:6–16]

Interesting Tidbits

• OpenCTI false-positive labeling: The formbook tag appears to be an automated or crowdsourced misclassification. The binary bears zero resemblance to the Formbook/XLoader family (no AutoIt, no shellcode, no process injection, no credential theft APIs). The triage pipeline should not propagate this label without re-evaluation. ^[metadata.json] ^[triage.json]
• Academic lure sophistication: Using a real university name (University of Bahrain) and a plausible project code (FMD20240942) is higher-effort social engineering than generic invoice lures. The target demographic is likely students or faculty in STEM disciplines.
• Certificate reuse / shared signing: The Comodo/Sectigo certificate chain (CRL/OCSP URLs identical to 7d18d78c) suggests either the same signing cert was used across both builds or they were signed with the same CA batch. Certificate transparency logs would confirm.
• Capa false positives: Reflective Code Loading [T1620] is triggered by generic .NET JIT reflection (Assembly.Load, MethodBase.Invoke patterns in the Framework itself). This is a known false-positive pattern documented at debug-build-capa-false-positives. ^[capa.txt:15]
• FLOSS failure: flare-floss exited with argument-parsing error (--no flag collision with positional argument), producing no decoded strings. This is a tooling issue, not an anti-analysis measure. ^[floss.txt:1–6]

How To Mess With It (Homelab Replication)

See 7d18d78c report for full replication steps. Additional delta for this sibling:

1. Change the VS_VERSIONINFO InternalName and OriginalFilename to a random 4-character string (e.g., aosN.exe).
2. Set the lure filename to an academic-document pattern (<University>_<Project>_<Code>.exe).
3. Compile within ~2 hours of the first variant to simulate batch-build timing.

Verification: capa <output.exe> should produce the same generic .NET capability hits as both siblings: .NET platform, generate random numbers, access .NET resource, invoke .NET assembly method, load .NET assembly. The Reflective Code Loading [T1620] hit is expected and false-positive.

Deployable Signatures

YARA rule (extends 7d18d78c rule with sibling awareness)

rule WinForMono_ChessEngine_Lure_Family {
    meta:
        description = "WinForMono .NET chess engine social-engineering lure family (multi-sibling)"
        author = "PacketPursuit"
        date = "2026-07-11"
        sha256_1 = "7d18d78c5cd6a14d0d70d5454d54b178860dc4b74cd0212c0f9e533368ecaf01"
        sha256_2 = "337c323b0e90ccd3d20df64ef6f59a745ce14359b406359f16bf20e5053a50c6"
    strings:
        $ns1 = "WinForMono.Engine" ascii wide
        $ns2 = "WinForMono.WinformWrapper" ascii wide
        $method1 = "MoveGeneration_White" ascii wide
        $method2 = "MoveGeneration_Black" ascii wide
        $method3 = "Castling_White" ascii wide
        $method4 = "Castling_Black" ascii wide
        $georgian1 = { e1 82 a8 }           // Ⴈ
        $georgian2 = { e1 82 b0 }           // Ⴐ
        $georgian3 = { e1 82 a3 }           // Ⴃ
        $version1 = "Sachy_Obrazky" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.imports("mscoree.dll", "_CorExeMain") and
        ($ns1 or $ns2) and
        2 of ($method*) and
        any of ($georgian*)
}

Behavioral hunt query

Process creation where:

• Image is a .NET assembly (mscoree.dll import)
• AND (OriginalFileName or ProductName contains Sachy_Obrazky)
• AND (Image ends with .pdf.exe OR Image matches *University*Project*.exe OR Image matches *Project*FMD*.exe)
• AND file is Authenticode-signed by Comodo/Sectigo Code Signing CA

title: WinForMono Chess Engine Social-Engineering Lure Family
detection:
  selection:
    Imports|contains: 'mscoree.dll'
    ProductName|contains: 'Sachy_Obrazky'
  lure:
    Image|endswith: '.pdf.exe'
    Image|contains: 'University'
    Image|contains: 'Project'
  condition: selection and lure

IOC list

Behavioral fingerprint

This binary is a .NET Framework 4.0 x86 PE with a single mscoree.dll import, a valid Authenticode signature by a Comodo/Sectigo chain, and a VS_VERSIONINFO claiming a Czech chess-game identity (Sachy_Obrazky). It contains a full bitboard chess engine (WinForMono.Engine) with move generation, castling, and pawn logic, alongside a WinForms UI layer with Georgian-character obfuscated method names. No network APIs, no crypto APIs, no persistence, and no P/Invoke surface are present. The threat indicator is the social-engineering filename (academic-document masquerade or .pdf.exe double-extension) used for delivery. This is the second confirmed sibling in a cluster of at least two builds compiled within ~2 hours on 2024-09-06.

Detection Signatures

References

• Artifact ID: 6d3b84fe-8147-416f-b322-070a79326cd9
• Source: MalwareBazaar via OpenCTI connector
• Cluster sibling: 7d18d78c5cd6a14d0d70d5454d54b178860dc4b74cd0212c0f9e533368ecaf01
• Related wiki pages: unclassified-dotnet-chess-engine, social-engineering-filename-lure, double-extension-masquerade, debug-build-capa-false-positives

Provenance

Static artifacts generated by triage-fast.sh (2026-05-26): file(1), exiftool, pefile, strings, ssdeep, tlsh, yara. capa v7 run for .NET ATT&CK mapping. rabin2/radare2 level-3 analysis for CIL class/method enumeration. Manual dnfile-driven .NET metadata parse for assembly name, TypeDef, and ManifestResource enumeration. Raw-binary byte-scan for Georgian Unicode obfuscation markers. No dynamic execution (CAPE skipped — no Windows guest). Sibling comparison against 7d18d78c report and entity page.