unclassified-dotnet: 3c9f96db — WinForms chart app "OkuZ" with purchase-order masquerade and hardcoded SHA256 string

Executive Summary

A .NET Framework 4.0 WinForms student-evaluation / charting application (namespace Chart, internal name OkuZ.exe) repackaged with the social-engineering filename PO781000885.exe. No packing, no obfuscation, no network APIs, no persistence, and no malicious payload. A hardcoded 64-character SHA256 hex string (238824D56AFD56162E5F061ECB898DD852A546A6D203EE032C6C40F4B4770AE9) appears in the #Strings metadata stream — purpose unknown, not matching the file's own hash. Capa T1620 / B0013.001 flags are false positives from standard .NET resource loading and Debug-build attributes. Static-only analysis; CAPE skipped (no Windows guest). Assessed as a benign application used as a social-engineering lure.

What It Is

How It Works

Entry point is standard .NET WinForms bootstrap: EnableVisualStyles, SetCompatibleTextRenderingDefault(false), instantiate Chart.frmMain, and Application.Run. ^[r2:entry0]

The application is a simple charting / student-record viewer:

• Chart.Models.Student class with Id, Name, Age, MathPoint, PhysicalPoint, ChemistryPoint properties. ^[strings.txt:77-82]
• Chart.Chart form with Chart_Load, _getStudents, student_combobox_SelectedIndexChanged, Draw methods. ^[strings.txt:58-67]
• Chart.DataSet1 typed DataSet with DataTable1, DataColumn1-4, and L column. ^[strings.txt:109,242-252]
• Chart.frmMain main window and Chart.FrmStep secondary step form. ^[strings.txt:272,326]
• Chart.AboutBox1 standard About dialog. ^[strings.txt:24]
• Chart.Properties.Resources with get_orhi accessor that loads a .resources blob named orhi (likely a bitmap or icon). ^[strings.txt:230, r2:0x00405138]

No System.Net, System.Security, System.Management, System.Diagnostics.Process, or P/Invoke imports are present. The only import is mscoree.dll _CorExeMain. ^[r2:imports]

Decompiled Behavior

radare2 CIL analysis recovered 211 functions. The entry point (entry0 @ 0x004050a8) is a straight-line WinForms bootstrap with no anti-analysis gates. ^[r2:entry0]

Chart.Properties.Resources.get_orhi (0x00405138) calls get_ResourceManager and then GetObject("ble", 0x04000039) — standard .NET resource retrieval. The resource name orhi is loaded via the strongly-typed accessor pattern. ^[r2:0x00405138]

No encryption routines, no process injection, no registry access, no file-system writes outside standard .NET MemoryStream / ReadXml / csvPath references. ^[strings.txt:225-229]

C2 Infrastructure

None observed. No hardcoded IPs, domains, URLs, mutex names, named pipes, or registry keys. No System.Net namespace present. No network APIs in the IAT.

Interesting Tidbits

• Hardcoded SHA256 string — 238824D56AFD56162E5F061ECB898DD852A546A6D203EE032C6C40F4B4770AE9 appears at offset 40 in strings.txt (inside the #Strings metadata stream). It does not match this sample's SHA256 (3c9f96db...) and is not present elsewhere in the local corpus. Could be a companion-payload integrity hash, a license-validation key, or an artefact of the original developer's debugging. ^[strings.txt:40]
• Resource orhi — The get_orhi accessor suggests an embedded bitmap or icon resource. The PE .rsrc section contains two entries: Type 16 (icon, 828 bytes) and Type 24 (manifest, 490 bytes). No encrypted payload. ^[pefile.txt:76-101]
• capa false positives — Reflective Code Loading [T1620] triggered by Assembly.Load/Invoke patterns that are actually standard .NET WinForms initialization. Analysis Tool Discovery::Process detection [B0013.001] triggered by DebuggerBrowsableState / DebuggableAttribute in a Debug build. ^[capa.txt]
• floss failure — The pre-gathered floss.txt contains a command-line syntax error (--no misused); no decoded strings were produced. This does not indicate anti-floss obfuscation — the binary is an unobfuscated CIL assembly. ^[floss.txt]

How To Mess With It (Homelab Replication)

1. Open Visual Studio 2019/2022, create a .NET Framework 4.0 WinForms project.
2. Add a Student model class and a DataSet1 typed dataset.
3. Drop a Chart control (or PictureBox) and a ComboBox for student selection.
4. Build in Debug configuration, IL linker v48.0 will appear in the PE header.
5. Observe capa will flag T1620 and B0013.001 — verify they are false positives.
6. Repackage with a purchase-order filename and observe static triage pipelines flag it as suspicious purely due to the filename + version-info mismatch.

Deployable Signatures

YARA rule

rule UnclassifiedDotNet_OkuZ_Masquerade {
    meta:
        description = "OkuZ.exe WinForms chart app repackaged as purchase-order lure"
        author = "PacketPursuit"
        date = "2026-07-12"
        sha256 = "3c9f96db10be4b69eb71ed27ecea954f721347bee8a310fa25d9a0ee2a0c57dd"
    strings:
        $a1 = "OkuZ.exe" wide ascii
        $a2 = "SUD Control" wide ascii
        $a3 = "Chart.Properties.Resources" ascii
        $a4 = "get_orhi" ascii
        $a5 = "238824D56AFD56162E5F061ECB898DD852A546A6D203EE032C6C40F4B4770AE9" ascii
        $b1 = "System.Net" ascii
        $b2 = "System.Security" ascii
    condition:
        uint16(0) == 0x5A4D and
        3 of ($a*) and
        not any of ($b*) and
        filesize < 1MB
}

Behavioral fingerprint

This binary is a .NET Framework 4.0 WinForms GUI application with Chart namespace, Student model, and get_orhi resource accessor. It has no System.Net, System.Security, or P/Invoke surface. The version info claims "SUD Control" by "Microsoft Corporation" while the distribution filename is a purchase-order lure (PO*.exe). It is a benign application repackaged for social engineering.

IOC list

Detection Signatures

• capa: Reflective Code Loading [T1620] — false positive from .NET runtime initialization.
• capa: Analysis Tool Discovery::Process detection [B0013.001] — false positive from Debug-build DebuggerBrowsableState / DebuggableAttribute.
• capa: reference analysis tools strings — false positive from DebuggerNonUserCodeAttribute / DebuggerBrowsableAttribute.
• capa: access .NET resource, read file in .NET, invoke .NET assembly method, load .NET assembly — all benign standard-library behaviour.

References

• unclassified-dotnet — Umbrella entity for benign .NET repackaged apps.
• social-engineering-filename-lure — Purchase-order / business-document filename masquerade pattern.
• version-info-masquerade — Cloned or fabricated VS_VERSIONINFO to lend false legitimacy.
• embedded-sha256-integrity-hash — Hardcoded 64-char SHA256 hex string in #Strings metadata.

Provenance

Analysis derived from static inputs gathered by the triage pipeline:

• file.txt (ExifTool 12.76 / file(1))
• exiftool.json (ExifTool 12.76)
• pefile.txt (pefile Python library)
• rabin2-info.txt (radare2 5.x)
• strings.txt (strings -n 5)
• capa.txt (Mandiant capa v7, static mode, dotnet ruleset)
• floss.txt (FireEye floss — command-line error, no output)
• binwalk.txt (binwalk 2.3.3)
• triage.json (triage pipeline schema v1)
• radare2 CIL analysis (level 2, 211 functions recovered)