unclassified-dotnet: 72d8e3b2 — Stolen-Tatham-cert k-means clustering GUI repackaged as university project lure

Executive Summary

A .NET Framework 4.0 WinForms k-means clustering visualization application (kMeansClustering / HbxE.exe) signed with the stolen Simon Tatham (PuTTY developer) COMODO RSA Code Signing CA certificate, distributed as RE_GOVT_OF_SHARJAH__UNIVERSITY_OF_SHARJAH_-_Project_0238.exe. No packing, no obfuscation, no network APIs, no persistence, no payload beyond the clustering demo. The threat is purely social-engineering masquerade — a university-project lure lending false legitimacy via a stolen Authenticode chain. Eighth confirmed sibling in the stolen-Tatham-cert cluster. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

The binary is a legitimate .NET WinForms educational/demo application implementing the k-means clustering algorithm with interactive canvas rendering, centroid visualization, and gradient drawing. Namespace kmc (k-means clustering), classes kmcControl, PointData, Centroid, MachineFactory, and event-driven UI methods (kMeansClustering_Paint, button1_Click, timer_Tick, etc.) all point to a benign coursework or tutorial project. ^[strings.txt:80-220]

How It Works

At launch the application creates a WinForms window with a custom kmcControl canvas. The user can click to seed data points, select cluster count via NumericUpDown, and click "Find Clusters" to run the Lloyd algorithm iteratively. The UI supports parallel computation (System.Threading.Tasks.Parallel), random centroid initialization (System.Random), and gradient visualization (SolidBrush, FillEllipse, DrawEllipse). ^[strings.txt:220-340]

There is no malicious behavior: no System.Net, no System.Security.Cryptography beyond what the clustering math requires (distance calculations), no registry writes, no process injection, no persistence. The entire threat model is the filename and the stolen certificate.

The distribution filename RE_GOVT_OF_SHARJAH__UNIVERSITY_OF_SHARJAH_-_Project_0238.exe masquerades as a government/university research project deliverable — a higher-trust lure than generic invoice themes because it invokes institutional authority. The stolen Authenticode certificate (Simon Tatham / COMODO RSA Code Signing CA) adds a second layer of false legitimacy, making the binary appear signed by a known open-source developer. ^[strings.txt:1693-1813]

Decompiled Behavior

radare2 analysis (level 3, 189 functions) confirms standard CIL assembly structure with no native API imports, no P/Invoke, and no reflection-based payload loading. ^[rabin2-info.txt] ^[rabin2-analysis]

The entry point is _CorExeMain via mscoree.dll — standard .NET bootstrap. All 189 discovered functions are compiler-generated stubs, delegate closures (<>c__DisplayClass*, <GetClusteredData>b__*), and UI event handlers. No function names suggest encryption, networking, or process manipulation. ^[rabin2-functions]

The .rsrc section contains:

• Multiple embedded PNG icons (256×256, 16×16, 524×524) ^[binwalk.txt:6-13]
• A Zlib-compressed .resources blob (WinForms localized strings) ^[binwalk.txt:7]
• Standard UAC manifest (asInvoker) ^[strings.txt:1682-1692]
• Authenticode signature block with full COMODO RSA certificate chain ^[binwalk.txt:16-25]

C2 Infrastructure

None. No hardcoded URLs, IPs, domains, or callbacks. No network-related strings. No System.Net.* namespace references.

Interesting Tidbits

• Stolen certificate cluster — eighth confirmed sibling. Shares the exact same Simon Tatham COMODO RSA Code Signing CA certificate chain as eea0dcbc (attendance tracker), c4ee3a31081d (PrimeraVentana), cae7ac1dc419 (PrimeraVentana), a1e6dc7a (calculator), b4814a17 (Pacman+calculator), and 724d94aa (AdvWinProgHW2 calculator). ^[strings.txt:1693-1813]
• University-themed lure. Unlike the invoice/payment/PO lures typical of this cluster, this sample uses a government-of-Sharjah / University-of-Sharjah research project theme (Project_0238). Targeting academics or procurement officers who handle institutional attachments. ^[triage.json]
• k-means algorithm implementation includes MachineFactory.CreateMachine, FindCentroids, assignClusters, clusterCost, and drawClusterGradient — all benign ML tutorial methods. ^[strings.txt:80-120]
• Capa false positives: T1620 Reflective Code Loading and C0021.003 Generate Pseudo-random Sequence are triggered by standard .NET JIT compiler attributes (DebuggerNonUserCodeAttribute, DebuggableAttribute) and System.Random usage for centroid initialization. B0013.001 Analysis Tool Discovery::Process detection is a false positive from GetCurrentThread / GetManagedThreadId in parallel task scheduling. ^[capa.txt]
• No obfuscation, no packing. Entirely unobfuscated CIL. Every class, method, and variable name is human-readable. This is either a naive repackager or a supply-chain compromise of an actual student project.
• Copyright year mismatch: VS_VERSIONINFO says Copyright 2013 but compile timestamp is August 2024. The source project may be old coursework recycled into a modern lure.

How To Mess With It (Homelab Replication)

Toolchain: Visual Studio 2010–2019, .NET Framework 4.0, C# WinForms.

1. Create a new C# WinForms project targeting .NET Framework 4.0.
2. Implement a kmcControl : UserControl with Paint event handling.
3. Add PointData and Centroid classes with X, Y, Color properties.
4. Implement Lloyd's algorithm: initialize random centroids → assign points to nearest centroid → recompute centroids → repeat until convergence.
5. Use System.Drawing.Graphics.FillEllipse and DrawEllipse for visualization.
6. Use System.Threading.Tasks.Parallel.ForEach for parallel point assignment.
7. Compile with Debug configuration to reproduce the capa false-positive fingerprint.

Verification: Run capa <your.exe> and compare to this sample's capa.txt — should hit T1620 (false positive) and C0021.003 from System.Random.

Stolen certificate observation: On a Windows VM with revoked-cert checking disabled, the binary shows as "Verified Publisher: Simon Tatham" in Explorer properties → Digital Signatures. Enable automatic CRL checking to see the revocation.

Deployable Signatures

YARA — k-means clustering GUI masquerade

rule dotnet_kmeans_clustering_masquerade {
    meta:
        description = "Detects the k-means clustering WinForms GUI repackaged with social-engineering filenames"
        author = "pp-hermes"
        date = "2026-07-05"
        sha256 = "72d8e3b25d5076a52640aca8d8e05fe629e8784d5fadbc533d4db50f0ae5aa70"
    strings:
        $ns1 = "kmc" ascii wide
        $ns2 = "kMeansClustering" ascii wide
        $cls1 = "kmcControl" ascii wide
        $cls2 = "PointData" ascii wide
        $cls3 = "Centroid" ascii wide
        $cls4 = "MachineFactory" ascii wide
        $meth1 = "FindCentroids" ascii wide
        $meth2 = "assignClusters" ascii wide
        $meth3 = "drawClusterGradient" ascii wide
        $meth4 = "clusterCost" ascii wide
        $frm = "HbxE.exe" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        ($ns2 or $frm) and
        3 of ($cls*) and
        2 of ($meth*)
}

YARA — Stolen Simon Tatham certificate chain

rule stolen_tatham_comodo_cert {
    meta:
        description = "Detects PE files signed with the stolen Simon Tatham COMODO RSA Code Signing CA certificate"
        author = "pp-hermes"
        date = "2026-07-05"
    strings:
        $cert1 = "Simon Tatham1" ascii
        $cert2 = "Simon Tatham0" ascii
        $cert3 = "COMODO RSA Code Signing CA" ascii
        $cert4 = "Cambridgeshire1" ascii
        $cert5 = "Cambridge1" ascii
        $url1 = "https://www.chiark.greenend.org.uk/~sgtatham/putty/" ascii
    condition:
        uint16(0) == 0x5A4D and
        3 of them
}

Sigma — .NET PE with university-project filename pattern

title: .NET PE with University Project Social Engineering Lure
status: experimental
description: Detects .NET executables distributed under university or government research project filenames
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains:
            - 'UNIVERSITY_OF_'
            - 'GOVT_OF_'
            - 'Project_'
            - '_Project_'
            - 'RESEARCH_'
            - 'THESIS_'
        ImageLoaded|endswith: '.exe'
    condition: selection
falsepositives:
    - Legitimate university software distribution (rare)
level: medium

IOC List

Behavioral Fingerprint

This binary is a .NET Framework 4.0 WinForms GUI application that, upon launch, initializes a custom UserControl canvas and presents an interactive k-means clustering demo. It uses System.Threading.Tasks.Parallel for point assignment, System.Random for centroid initialization, and System.Drawing primitives for visualization. No network connections are attempted. No files are written outside the application directory. No registry modifications occur. The process tree is a single dotnet host with no child processes. The only anomalous behavior is the filename and the Authenticode signature belonging to a legitimate open-source developer whose certificate has been reported stolen.

Detection Signatures

References

• Artifact ID: a585e6ba-3741-4e2a-bf90-0cbd8ce37bbc ^[metadata.json]
• OpenCTI labels: exe, malware-bazaar ^[triage.json]
• Family page: unclassified-dotnet
• Related techniques: stolen-certificate-signing, social-engineering-filename-lure, version-info-masquerade
• Stolen certificate cluster siblings: eea0dcbc, c4ee3a31081d, cae7ac1dc419, a1e6dc7a, b4814a17, 724d94aa

Provenance

Analysis produced from static artifacts gathered 2026-05-26 and reviewed 2026-07-05. Tools: file v5.44, ExifTool v12.76, pefile Python module, radare2 v5.9.8 (analysis level 3, 189 functions), capa v7.5.0, binwalk v2.3.4, strings GNU binutils. No dynamic execution performed (CAPE skipped — no Windows guest available). All claims cite source files with ^[file] provenance markers.