unclassified-dotnet: 529fa495 — Karate_Club CRM sibling, .xlsx.exe double-extension masquerade

Executive Summary

A .NET Framework 4.0 WinForms karate-dojo management application (internal name VvDt.exe, product Karate_Club) repackaged and submitted to MalwareBazaar as PO.366786-K0001388089465.xlsx.exe. Second confirmed sibling of the Karate_Club CRM cluster (first: 7a310c85 / hovF.exe). No malicious payload, no network capability, no persistence, no anti-analysis. The sole threat is social-engineering filename masquerade with a .xlsx.exe double-extension — a higher-fidelity lure than the prior sibling's plain .exe.

What It Is

• SHA-256: 529fa4957fea8e29e7f990cb261dbe876040b5c30ffb4b9d58288d146e67dfb4
• File: PO.366786-K0001388089465.xlsx.exe (737 792 bytes)
• Type: PE32+ executable (GUI) x86-64 Mono/.Net assembly, 2 sections ^[file.txt]
• Build: .NET Framework 4.0 (mscorlib 4.0.0.0), C# WinForms ^[strings.txt:2082]
• Linker: MajorLinkerVersion 0x8 (Visual Studio 2010-era .NET build) ^[pefile.txt:49]
• Timestamp: Wed Jul 10 22:34:11 2024 UTC ^[pefile.txt:40]
• PDB: None — DEBUG directory RVA is 0x0, unlike sibling 7a310c85 which carried hovF.pdb. ^[pefile.txt:144]
• Assembly version: 1.0.0.0 ^[exiftool.json]
• Signed: No ^[rabin2-info.txt]
• YARA: Only PE_File_Generic ^[yara.txt]

Build / RE

Toolchain

• .NET Framework 4.0, C# WinForms application, identical build stack to sibling 7a310c85. ^[strings.txt:2077]
• Standard RT_VERSION and RT_MANIFEST resources. ^[pefile.txt:232-301]
• Assembly manifest requests asInvoker execution level. ^[strings.txt:2091]

No Obfuscation

• No ConfuserEx, SmartAssembly, Xenocode, or other commercial obfuscator signatures.
• Type names, method names, and namespace structure are fully readable and match sibling 7a310c85 exactly:
  • Karate_Club.frmMain, Karate_Club.frmAddMember, Karate_Club.frmListMembers
  • Karate_Club_Business.clsBeltRank, clsMember, clsPayment, clsPerson, clsSubscription
  • Karate_Club.People.ctrPersonCard, Karate_Club.Members.Controls.ctrMemberCard
  • Karate_Club.Global_Classes.clsUtilities
  • Karate_Club.Properties.Resources ^[strings.txt:1140-2077]

Anti-Analysis

• None observed. No debugger checks, no VM detection, no timing loops, no sandbox gates.
• Capa T1620 fires on System.Reflection.Assembly + InvokeMember — standard .NET event-dispatch and form-initialization infrastructure, not malicious reflective loading. ^[capa.txt]
• Capa T1083 fires on System.IO.Directory.Exists and FileInfo — benign file-system operations in a CRM that manages member photos and document paths. ^[capa.txt]

Embedded Resources

• VS_VERSIONINFO: FileDescription = Karate_Club, InternalName = VvDt.exe, ProductName = Karate_Club, LegalCopyright = Copyright © 2024. ^[exiftool.json]
• Manifest XML: Standard UAC manifest. ^[strings.txt:2085-2095]
• No embedded PNG icon extracted by binwalk (unlike 7a310c85 which held a 468×468 RGBA icon). ^[binwalk.txt]

How It Works

The binary is the same karate-dojo management CRM observed in 7a310c85. Confirmed modules via string extraction:

Database layer: SqlConnection, SqlCommand, DbConnection, ConfigurationManager.AppSettings. No hardcoded connection string in strings. ^[strings.txt:463-464,1675]

Deltas from sibling 7a310c85

The shared namespace, class hierarchy, and method names confirm these are builds of the same Visual Studio project — likely the same solution compiled twice with different assembly names, or two deployments from the same developer.

Decompiled Behavior

radare2 analysis (level 2, 1032 functions) confirms a standard .NET CIL assembly with no native code, no P/Invoke, and no obfuscated control flow. ^[r2:analysis]

Notable exported methods (all standard WinForms boilerplate):

• Karate_Club.Program.Main — entry point, Application.EnableVisualStyles + SetCompatibleTextRenderingDefault. ^[r2:sym.Karate_Club.Program.Main]
• Karate_Club.frmMain..ctor — main form constructor with dashboard navigation buttons. ^[r2:sym.Karate_Club.frmMain..ctor]
• Karate_Club.Global_Classes.clsUtilities.CopyImageToProjectImagesFolder — benign file-copy utility for member photos. ^[r2:sym.Karate_Club.Global_Classes.clsUtilities.CopyImageToProjectImagesFolder]

No imports of System.Net, System.Net.Sockets, System.Security, Microsoft.Win32 (registry), or any native API. IAT is empty — standard for pure CIL assemblies. ^[pefile.txt:129-130]

C2 Infrastructure

None. No network APIs, no hardcoded IPs, domains, URLs, or social-media webhooks. Zero C2 footprint.

Interesting Tidbits

• Plausible timestamp: Unlike sibling 7a310c85 (future-dated 2044), this sample carries a 2024-07-10 timestamp — consistent with a real build date. ^[pefile.txt:40]
• No PDB: The DEBUG directory is absent. Either compiled without debug symbols, or the PDB was stripped before distribution. ^[pefile.txt:144]
• Higher-fidelity lure: The .xlsx.exe double-extension exploits Windows "Hide extensions for known file types" more aggressively than a plain .exe — the victim sees what looks like an Excel spreadsheet. ^[exiftool.json]
• Same DeflateStream reference: Both siblings reference System.IO.Compression.DeflateStream (likely for .resources decompression, not payload hiding). ^[strings.txt:1592]

How To Mess With It (Homelab Replication)

This is a benign application. To replicate the social-engineering vector:

1. Build any legitimate .NET WinForms application in Visual Studio (target .NET Framework 4.0).
2. Rename the output .exe to Invoice.xlsx.exe or Purchase_Order.xlsx.exe.
3. Distribute via email with a plausible procurement-context lure.
4. The victim runs it, sees the application UI, and may not realize they've been socially engineered.

Verification: Run capa PO.366786-K0001388089465.xlsx.exe — expect false positives on T1620 from System.Reflection and T1083 from System.IO.Directory.Exists. Same noise as sibling 7a310c85.

Deployable Signatures

YARA — Karate_Club CRM Repackaging Cluster

rule unclassified_dotnet_karateclub_crm_masquerade
{
    meta:
        description = "Detects Karate_Club WinForms CRM repackaged with social-engineering filenames"
        author = "SOC Analyst"
        date = "2026-07-09"
        hash1 = "529fa4957fea8e29e7f990cb261dbe876040b5c30ffb4b9d58288d146e67dfb4"
        hash2 = "7a310c85d3a3334c4e715402d09355dda340e0e32f784eab626e4ab1a7aff321"
        confidence = "medium"
    strings:
        $ns1 = "Karate_Club" wide
        $ns2 = "Karate_Club_Business" wide
        $ns3 = "Karate_Club.People" wide
        $ns4 = "Karate_Club.Members" wide
        $ns5 = "Karate_Club.Global_Classes" wide
        $cls1 = "clsBeltRank" wide
        $cls2 = "clsMember" wide
        $cls3 = "clsSubscription" wide
        $cls4 = "clsPayment" wide
        $frm1 = "frmAddMember" wide
        $frm2 = "frmListMembers" wide
        $util = "clsUtilities" wide
    condition:
        uint16(0) == 0x5A4D and
        4 of ($ns*) and
        2 of ($cls*) and
        1 of ($frm*) and
        $util
}

Sigma — Double-Extension .NET Execution in User-Writable Paths

title: .NET PE Execution with Double-Extension Masquerade in User-Writable Path
status: experimental
description: Alerts on execution of .NET Framework PE files with suspicious double extensions (.xlsx.exe, .pdf.exe, .doc.exe) from user-writable directories
logsource:
    category: process_creation
    product: windows
detection:
    selection_extension:
        CommandLine|re:
            - '\.[a-z]{3,4}\.exe$'
    selection_path:
        Image|contains:
            - '\\Users\\'
            - '\\Temp\\'
            - '\\Downloads\\'
            - '\\Desktop\\'
    selection_dotnet:
        - Image|endswith: '.exe'
    condition: selection_extension and selection_path and selection_dotnet
falsepositives:
    - Legitimate installers with double extensions
    - Developer testing scenarios
level: medium

IOC List

Behavioral Fingerprint

This binary is a .NET Framework 4.0 WinForms GUI application with no network imports, no persistence mechanisms, and no anti-analysis. It presents a karate-dojo management interface with SQL Server database connectivity. The sole threat indicator is the PO.366786-K0001388089465.xlsx.exe filename used for social engineering. If executed, it will display a WinForms CRM interface and attempt to connect to a local SQL Server instance — no malicious behavior is expected.

Detection Signatures

Capa false positives (NOT malicious):

• T1620 — System.Reflection.Assembly/InvokeMember is standard .NET infrastructure
• T1083 — System.IO.Directory.Exists/FileInfo in a file-managing CRM is expected

References

• unclassified-dotnet — Umbrella entity for unattributed .NET Framework PE32/PE32+ binaries
• social-engineering-purchase-order-masquerade — Cross-family concept: purchase-order filename lure
• social-engineering-filename-lure — Generic social-engineering filename masquerade concept
• double-extension-masquerade — Windows-specific filename deception technique
• MalwareBazaar: https://bazaar.abuse.ch/sample/529fa4957fea8e29e7f990cb261dbe876040b5c30ffb4b9d58288d146e67dfb4/

Provenance

Analysis based on static-only examination (CAPE skipped — no Windows guest available):

• file.txt, exiftool.json, pefile.txt, strings.txt, rabin2-info.txt, binwalk.txt, capa.txt, yara.txt, ssdeep.txt, tlsh.txt, triage.json, metadata.json
• floss.txt is a CLI error artifact (invalid --no argument), not decoded strings
• radare2 analysis level 2, 1032 functions — standard CIL assembly, no native code