unclassified-dotnet: 4cce5506 — .NET WinForms checkers game with Security Descriptor Editor masquerade and .pif.exe double-extension lure

Executive Summary

A .NET Framework 4.0 C# WinForms checkers/draughts game repackaged with a .pif.exe double-extension filename (J-230512-31246_-_111553_-_31246.pif.exe) and a VS_VERSIONINFO masquerading as "Security Descriptor Editor" by "Microsoft Corporation." OpenCTI pre-labelled the sample remcosrat; static analysis confirms this is a false positive. No malicious payload, no network APIs, no persistence, no anti-analysis. The Trif32 trivial decoder is present (shared with the PrimeraVentana/GoldenCity/MyPaint.Editor educational-app cluster). Capa T1620 and C0021.003 flags are false positives from Debug-build compiler attributes and System.Random usage in game AI. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

The PE has three standard sections (.text, .rsrc, .reloc) with no packing, no obfuscation, and no native API imports beyond mscoree.dll._CorExeMain. ^[pefile.txt:78-137]

How It Works

The binary is a complete two-player checkers (draughts) game with a settings dialog, board rendering via System.Drawing, and computer-move AI using System.Random. ^[strings.txt:10-70]

Key namespaces and classes (from radare2 CIL metadata):

• Windows_User_Interaction.GameForm — main game board (WinForms buttons for checkers squares, event handlers BoardButton_clicked, ButtonDone_Click) ^[r2:classes]
• Windows_User_Interaction.SettingsForm — player-name input, board-size selector (6×6, 8×8, 10×10 via RadioButtonSizeSix, RadioButtonSizeEight, RadioButtonSizeTen) ^[strings.txt:144]
• Windows_User_Interaction.GameInitialize — game-state manager with initializeGame, StartGame, makeComputerMove ^[strings.txt:55-57]
• Board — board matrix (i_BoardMatrix, m_ButtonMatrix), piece tracking (m_ListOfRegularPieces, m_ListOfKingPieces), move validation (setListOfEatingValidMovesForRegularPieces, setListOfNonEatingValidMovesForKingPieces) ^[strings.txt:36-205]
• Player — player name, shape (regular/king), points scoring ^[strings.txt:58-64]
• Windows_User_Interaction.Properties.Resources — embedded .resources blobs for game icons and bitmaps ^[strings.txt:209-211]

Embedded resources (binwalk):

• PC bitmap, 118 × 118 × 32 (likely game piece or icon) ^[binwalk.txt:6]
• PNG image, 588 × 588, 8-bit RGBA (likely board background or splash) ^[binwalk.txt:7]
• Zlib compressed data (standard .NET .resources blob) ^[binwalk.txt:8]
• XML UAC manifest (asInvoker, uiAccess="false") ^[binwalk.txt:9]

Two hardcoded SHA256-like strings appear in the #Strings metadata stream: ^[strings.txt:20-21]

C3C31E459231952D7630591997BFB72245E303F5FC6B97FEC07EBBD8A7A3FDB6
A568DBD13B812A7ED5A87C5696F843BB62639BFB9D9F0659E2D0BC4F9C45B749

These are 64-character hex strings. Their purpose is unknown — possible integrity hashes for companion payloads, license validation, or obfuscation keys. They match the pattern observed in sibling e04d46ff (FSC UI cluster) and 9a40908c.

Trif32 decoder present: The string Trif32 appears at offset 14 in strings.txt, shared with the PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint educational-app cluster. In this sample it is likely used for trivial string decoding of UI labels or embedded config. ^[strings.txt:14]

No malicious APIs detected:

• No System.Net, System.Net.Sockets, System.Net.Http references
• No System.Security, System.Security.Cryptography beyond standard System.Drawing bitmap handling
• No Microsoft.Win32.Registry persistence APIs
• No System.Diagnostics.Process injection APIs
• No P/Invoke declarations

Decompiled Behavior

radare2 analysis completed with 159 functions. CIL class listing confirms the binary is purely a .NET WinForms checkers game: ^[r2:analysis]

Entry-point flow (inferred from class structure and event handlers):

1. Windows_User_Interaction.Program.Main — standard WinForms entry point
2. Instantiate SettingsForm → collect player names, board size, and human-vs-computer checkbox state
3. Instantiate GameForm → InitializeComponent builds the button matrix (m_ButtonMatrix)
4. putPiecesOnBoard → render initial piece positions
5. Event loop: BoardButton_clicked → validate move via checkEatingMove / checkNonEatingMove → makeMove → updateButtonsBoard → checkIfGameEnds
6. Computer turn: makeComputerMove → bulidCurrentMove → daQK.exe (internal name, no external payload)

No reflective loading, no process injection, no shellcode, no encrypted overlay beyond standard .NET .resources.

C2 Infrastructure

None. No hardcoded IPs, domains, URLs, mutex names, named pipes, or registry keys. No System.Net namespace references. C2 is not runtime-resolved — the binary contains no networking surface at all.

Interesting Tidbits

• .pif.exe double-extension masquerade: The distribution filename ends in .pif.exe. PIF (Program Information File) is a legacy Windows shortcut format that can carry executable content and custom icons. Explorer may hide the .exe extension, showing only .pif. This is a higher-signal social-engineering variant than the common .pdf.exe double extension. ^[triage.json:5]
• "Security Descriptor Editor" masquerade: The VS_VERSIONINFO claims this is a Microsoft system administration tool (FileDescription: Security Descriptor Editor, CompanyName: Microsoft Corporation, OriginalFilename: daQK.exe). This is a fabricated identity — the actual binary is a checkers game. ^[exiftool.json:37-45]
• daQK nonsense internal name: The PDB and internal filename (daQK.exe, daQK.pdb) follow the pattern of auto-generated or repackager-supplied nonsense strings observed in other social-engineering samples (e.g., NZiU, Zfio, hovF, DzAz in the FSC UI and PrimeraVentana clusters). ^[rabin2-info.txt:13]
• Future-dated timestamp: 2044-12-19 is 18 years in the future, indicating the timestamp was not set by a normal Visual Studio build but by a repackager or manual edit. ^[pefile.txt:34]
• Capa false positives: T1620 (Reflective Code Loading) triggers on Assembly::GetTypeFromHandle and MethodBase::Invoke — standard .NET JIT/reflection used by WinForms event dispatch. C0021.003 (Generate Pseudo-random Sequence) triggers on System.Random used for computer-move AI. B0013.001 (Analysis Tool Discovery) is a false positive from the DebuggerNonUserCodeAttribute present in Debug builds. ^[capa.txt:15-34]
• floss failure: The floss tool errored with an invalid --no argument, producing no decoded strings. The standard strings extraction is sufficient because the binary is unobfuscated CIL. ^[floss.txt:1-7]

How To Mess With It (Homelab Replication)

This sample is benign; the threat is purely the social-engineering masquerade. To replicate the detection scenario:

1. Build a simple .NET Framework 4.0 WinForms checkers game in Visual Studio 2019/2022.
2. Compile in Debug configuration (generates DebuggerNonUserCodeAttribute, DebuggableAttribute).
3. Use a resource editor (e.g., Resource Hacker, CFF Explorer) to replace VS_VERSIONINFO fields:
   • FileDescription → Security Descriptor Editor
   • CompanyName → Microsoft Corporation
   • OriginalFilename → <nonsense>.exe
4. Rename the output to Something.pif.exe or Something.pdf.exe.
5. Run capa against the binary — observe T1620 and C0021.003 false positives from Debug-build attributes and System.Random.
6. Verify the actual behavior by running in a sandbox: the binary opens a checkers game window with no network connections.

What you'll learn: How to distinguish benign .NET coursework/games from actual malware when capa flags reflection and random-number generation.

Deployable Signatures

YARA rule — .NET masquerade fingerprint

rule dotnet_checkers_security_descriptor_masquerade
{
    meta:
        description = ".NET WinForms checkers game with Security Descriptor Editor VS_VERSIONINFO masquerade"
        author = "PacketPursuit"
        date = "2026-07-07"
        hash = "4cce5506593907c3db78282849ed41729ca7cf737e1d38cb82dc10e27d92ff16"
    strings:
        $a = "Windows_User_Interaction.GameForm" ascii wide
        $b = "Security Descriptor Editor" ascii wide
        $c = "daQK.exe" ascii wide
        $d = "BoardButton_clicked" ascii wide
        $e = "makeComputerMove" ascii wide
        $f = "Trif32" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.imports("mscoree.dll", "_CorExeMain") and
        4 of ($a, $b, $c, $d, $e, $f)
}

Sigma rule — .pif.exe double-extension execution

title: Suspicious .pif.exe Double-Extension Execution
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains: '.pif.exe'
  condition: selection
falsepositives:
  - Legacy PIF maintenance tools (unlikely in modern environments)
level: medium
tags:
  - attack.initial_access
  - attack.t1566.001

IOC list

Behavioral fingerprint statement

This binary is a .NET Framework 4.0 C# WinForms checkers game. Upon execution it displays a graphical game board with configurable size (6×6, 8×8, or 10×10), accepts human vs. human or human vs. computer play, and uses System.Random for computer-move selection. It makes no network connections, writes no registry keys, spawns no child processes, and loads no reflective assemblies beyond standard .NET JIT. The threat is purely social-engineering: the file was distributed with a .pif.exe double extension and a VS_VERSIONINFO masquerading as a Microsoft system administration tool.

Detection Signatures

References

• Artifact ID: f43ba890-9063-4ea1-af71-1c39486f9af1
• Source: OpenCTI / MalwareBazaar ingestion (false-positive remcosrat label)
• Related wiki pages: unclassified-dotnet, version-info-masquerade, social-engineering-filename-lure, debug-build-capa-false-positives, trif32-caesar-shift-23-decoder

Provenance

• file.txt — file command output (PE32 .NET)
• strings.txt — strings -a -n 6 output (checkers game class names, VS_VERSIONINFO strings, SHA256-like hashes)
• pefile.txt — pypinfo / pefile output (section headers, imports, VS_VERSIONINFO structure)
• exiftool.json — ExifTool metadata extraction (version info, timestamps)
• rabin2-info.txt — radare2 binary header (cil, daQK.pdb, unsigned)
• capa.txt — Mandiant capa v9 static analysis (false-positive T1620, C0021.003, B0013.001)
• binwalk.txt — Binwalk embedded artifact scan (bitmap, PNG, Zlib, XML manifest)
• floss.txt — FireEye floss (errored, no output)
• dynamic-analysis.md — CAPE sandbox status (skipped, no Windows guest)
• radare2 CIL class listing and function analysis (159 functions, checkers game namespaces)