unclassified-dotnet: 72c4217f — Croatian AES/RSA coursework tool, SSLOS2024070909.exe

Executive Summary

A .NET Framework 4.0 WinForms GUI application written in Croatian (ProjektOS namespace) that implements symmetric (AES) and asymmetric (RSA) encryption, digital signatures, and SHA256 hashing. No malicious payload, no network APIs, no persistence, and no anti-analysis. The threat is purely social-engineering masquerade: distributed as SSLOS2024070909.exe with a fabricated Microsoft-themed version block. Assessed as a benign student cryptography coursework project repackaged for malware distribution. ^[file.txt] ^[exiftool.json]

What It Is

How It Works

The binary is a straightforward .NET Framework 4.0 CIL assembly with a single namespace ProjektOS and a ProjektOS.Klase (Classes) sub-namespace. The GUI is built with standard System.Windows.Forms controls (Button, RadioButton, TextBox, OpenFileDialog, SaveFileDialog).

Cryptographic functionality observed statically:

• AES symmetric encryption/decryption via AesCryptoServiceProvider / SymmetricAlgorithm with CryptoStream and MemoryStream ^[capa.txt] ^[strings.txt:128] ^[strings.txt:244]
• RSA asymmetric encryption/decryption and digital signatures via RSACryptoServiceProvider, RSAPKCS1SignatureFormatter, RSAPKCS1SignatureDeformatter ^[capa.txt] ^[strings.txt:169] ^[strings.txt:179] ^[strings.txt:181]
• SHA256 hashing via ComputeHash / ComputeSha256Hash ^[capa.txt] ^[strings.txt:107] ^[strings.txt:11]
• Base64 encoding/decoding via FromBase64String / ToBase64String ^[capa.txt] ^[strings.txt:94] ^[strings.txt:95]

UI event handlers (Croatian names):

• enkriptirajButton_Click — encrypt button click ^[strings.txt:120]
• dekriptirajButton_Click — decrypt button click ^[strings.txt:119]
• digitalniPotpisButton_Click — digital signature button click ^[strings.txt:121]
• otvoriDatotekuButton_Click — open file button click ^[strings.txt:122]
• stvoriNovuDatotekuButton_Click — create new file button click ^[strings.txt:123]
• ocistiButton_Click — clear button click ^[strings.txt:117]
• ponistiButton_Click — undo button click ^[strings.txt:118]
• provjeraButton_Click — verify button click ^[strings.txt:115]

Other Croatian UI strings: NovaDatoteka (New File), IzracunSazetka (Calculate Hash), DigitalniPotpis (Digital Signature), VerificirajPotpis (Verify Signature), GenerirajPotpis (Generate Signature), sadrzaj (content), obicanTekstSadrzaj (plaintext content), enkriptiraniSadrzaj (encrypted content), sazetakTextBox (hash text box), digitalniPotpisTextBox (digital signature text box). ^[strings.txt:20] ^[strings.txt:21] ^[strings.txt:109] ^[strings.txt:110] ^[strings.txt:111] ^[strings.txt:112] ^[strings.txt:113] ^[strings.txt:203] ^[strings.txt:204] ^[strings.txt:205]

The asimetricnoRadio (asymmetric radio button) and simetricnoRadio controls toggle between AES and RSA modes. ^[strings.txt:164] ^[strings.txt:131]

No malicious behavior. There are no references to System.Net, System.Net.Sockets, WebClient, HttpWebRequest, TcpClient, SmtpClient, Process.Start, RegistryKey, TaskScheduler, VirtualProtect, or any other network, injection, or persistence APIs. The Microsoft.VisualBasic reference is for Interaction.CallByName and Interaction.MsgBox (used in GUI event handlers), not for malicious late-binding. ^[strings.txt:23] ^[strings.txt:47] ^[strings.txt:147]

Decompiled Behavior

Ghidra / radare2 analysis was not performed because the binary is an unobfuscated .NET CIL assembly where the full type and method structure is already recoverable from CLR metadata via strings. The capa static analysis confirms the observed behavior is limited to:

• reference analysis tools strings (anti-analysis namespace — false positive from get_FileName and ShowDialog in GUI code) ^[capa.txt]
• decode data using Base64 in .NET (3 matches)
• encode data using Base64 (4 matches)
• decrypt data using AES via .NET
• decrypt data using RSA via WinAPI
• encrypt data using RSA via WinAPI
• hash data using SHA256
• access .NET resource (embedded .resources blobs for UI localization)
• get common file path (6 matches — OpenFileDialog / SaveFileDialog)
• delete file (4 matches — likely temporary file cleanup)
• check if file exists (6 matches)
• read file in .NET (6 matches)
• write file in .NET (10 matches)
• invoke .NET assembly method
• compiled to the .NET platform ^[capa.txt]

C2 Infrastructure

None. No network APIs, no hardcoded IPs, domains, URLs, emails, or cryptocurrency wallets. No C2 obfuscation or runtime resolution is present. The binary is a purely local GUI application.

Interesting Tidbits

• Croatian-language coursework origin. The consistent use of Croatian UI strings (Dekriptiraj, Enkriptiraj, DigitalniPotpis, NovaDatoteka) across the namespace, class names, and control names strongly suggests this is a student cryptography project from a Croatian academic institution (likely "Projekt OS" = Operacijski Sustav / Operating System Project, or "Osnove Sigurnosti" / Security Basics). ^[strings.txt:16] ^[strings.txt:109] ^[strings.txt:110] ^[strings.txt:203]
• Future-dated PE timestamp. Sat Oct 24 01:14:26 2048 UTC is clearly fabricated; the VS_VERSIONINFO copyright year is 2021, and the SettingsSingleFileGenerator version (16.10.0.0) places the actual build in the VS 2019/2022 era. ^[pefile.txt] ^[exiftool.json]
• Random internal name. tFQK.exe and tFQK.pdb are auto-generated gibberish strings, a common pattern when Visual Studio creates a new project with a default/random name. ^[exiftool.json] ^[rabin2-info.txt]
• Distribution filename mismatch. SSLOS2024070909.exe carries no semantic connection to "Projekt OS" or the internal functionality. The SSLOS prefix may be an arbitrary social-engineering prefix, or it may reference a specific campaign or delivery context (e.g., "SSLO" = some organization acronym + datestamp). ^[metadata.json]
• Capa false positives. The reference analysis tools strings hit in capa is a false positive from benign GUI method names (get_FileName, ShowDialog). The Reflective Code Loading [T1620] and Obfuscated Files or Information [T1027] flags are false positives from standard .NET Assembly reflection and CryptoStream usage in the cryptography coursework. ^[capa.txt]

How To Mess With It (Homelab Replication)

Build a functionally equivalent Croatian cryptography GUI in C#/.NET Framework 4.0:

1. Open Visual Studio 2019/2022 → New Project → Windows Forms App (.NET Framework) → Target .NET Framework 4.0.
2. Add references: System.Security, System.Windows.Forms, System.Drawing.
3. Implement AES encryption/decryption using AesCryptoServiceProvider + CryptoStream + MemoryStream.
4. Implement RSA signing/verification using RSACryptoServiceProvider + RSAPKCS1SignatureFormatter / RSAPKCS1SignatureDeformatter.
5. Implement SHA256 hashing using SHA256CryptoServiceProvider.ComputeHash.
6. Add OpenFileDialog and SaveFileDialog for file I/O.
7. Build in Debug configuration.
8. Run capa <output.exe> and compare — you should see nearly identical capability matches (AES, RSA, SHA256, Base64, file read/write, .NET resource access).

What you'll learn: how a benign student cryptography project produces a capa fingerprint that looks superficially like malware (crypto + file I/O + reflection) until you read the strings and recognize the UI language.

Deployable Signatures

YARA Rule

rule ProjektOS_Croatian_Crypto_GUI
{
    meta:
        description = "Croatian-language .NET cryptography coursework GUI (ProjektOS namespace)"
        author = "PacketPursuit"
        date = "2026-07-05"
        hash = "72c4217f1a8af0b6fbaaaefb60783c78600019aab33c1f1ecae022fa995cff7e"
        confidence = "high"
    strings:
        $ns1 = "ProjektOS" ascii wide
        $ns2 = "ProjektOS.Klase" ascii wide
        $ui1 = "NovaDatoteka" ascii wide
        $ui2 = "IzracunSazetka" ascii wide
        $ui3 = "Dekriptiraj" ascii wide
        $ui4 = "Enkriptiraj" ascii wide
        $ui5 = "DigitalniPotpis" ascii wide
        $ui6 = "VerificirajPotpis" ascii wide
        $ui7 = "GenerirajPotpis" ascii wide
        $ui8 = "SimetricniAlgoritam" ascii wide
        $ui9 = "AsimetricniAlgoritam" ascii wide
        $ui10 = "asimetricnoRadio" ascii wide
        $aes = "AesCryptoServiceProvider" ascii wide
        $rsa = "RSACryptoServiceProvider" ascii wide
        $sha = "ComputeSha256Hash" ascii wide
        $base64 = "FromBase64String" ascii wide
        $dotnet = ".NETFramework,Version=v4.0" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $dotnet and
        $ns1 and
        4 of ($ui*) and
        any of ($aes, $rsa, $sha)
}

Behavioral Hunt Query (Sigma — .NET AES+RSA+SHA256 GUI with Croatian strings)

title: .NET Croatian Cryptography GUI Execution
status: experimental
description: Detects execution of a .NET Framework GUI application with Croatian cryptography UI strings and AES/RSA/SHA256 API usage. Likely benign student coursework, but may be repackaged with social-engineering filenames.
logsource:
  category: process_creation
  product: windows
detection:
  selection_strings:
    CommandLine|contains:
      - 'ProjektOS'
      - 'Dekriptiraj'
      - 'Enkriptiraj'
      - 'DigitalniPotpis'
      - 'NovaDatoteka'
  selection_api:
    - ImageLoaded|contains:
        - 'System.Security.dll'
    - CommandLine|contains:
        - 'AesCryptoServiceProvider'
        - 'RSACryptoServiceProvider'
        - 'ComputeSha256Hash'
  condition: selection_strings and selection_api
falsepositives:
  - Benign student cryptography coursework projects
  - Croatian-language security education tools
level: low
tags:
  - attack.defense_evasion
  - attack.t1027

IOC List

Behavioral Fingerprint Statement

This binary is a .NET Framework 4.0 CIL assembly with no packing, no obfuscation, and no anti-analysis. It loads mscorlib, System.Windows.Forms, System.Drawing, System.Security.Cryptography, and Microsoft.VisualBasic. It creates a WinForms GUI with AES symmetric encryption, RSA asymmetric encryption/digital signatures, and SHA256 hashing, driven by Croatian-language UI strings (Dekriptiraj, Enkriptiraj, DigitalniPotpis). It uses standard OpenFileDialog and SaveFileDialog for file I/O. No network APIs, no process injection, no registry persistence, and no anti-VM checks are present. The threat is purely the social-engineering filename (SSLOS2024070909.exe) and fabricated Microsoft-themed version information.

Detection Signatures

capa → ATT&CK Mapping

References

• MalwareBazaar / OpenCTI artifact: b53d9414-e913-4c79-b6bc-7142eaa45d41 ^[metadata.json]
• Related wiki page: unclassified-dotnet — umbrella entity for unattributed .NET Framework binaries
• Related concept: social-engineering-filename-lure — professional-context filenames used to lower suspicion
• Related concept: version-info-masquerade — falsified VS_VERSIONINFO metadata

Provenance

Analysis based on static artifacts produced by the triage pipeline:

• file.txt — file(1) output
• exiftool.json — ExifTool PE metadata
• pefile.txt — pefile DOS/NT headers, sections, imports, resources, version info, debug dirs
• strings.txt — strings(1) output
• capa.txt — Mandiant capa v8.0.0 static capability detection
• floss.txt — FireEye flare-floss (errored on invocation; no decoded strings)
• binwalk.txt — binwalk embedded artefact scan
• rabin2-info.txt — radare2 binary header summary
• dynamic-analysis.md — CAPE status: skipped (no Windows guest available)

No dynamic execution data is available. All behavioral claims are inferred from static metadata and should be treated as static-only.