unclassified-dotnet: 7a310c85 — KarateClub WinForms CRM repackaged as Purchase_Order.exe

Executive Summary

A .NET Framework 4.0 WinForms karate-dojo management application (internal name hovF.exe, product KarateClubBusinessLayer) repackaged and submitted to MalwareBazaar as Purchase_Order.exe. No malicious payload, no network capability, no persistence, no anti-analysis, no credential theft. The sole threat is social-engineering filename masquerade. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

• SHA-256: 7a310c85d3a3334c4e715402d09355dda340e0e32f784eab626e4ab1a7aff321
• File: Purchase_Order.exe (662 016 bytes)
• Type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, 3 sections ^[file.txt]
• Build: .NET Framework 4.0 (mscorlib 4.0.0.0), C# WinForms, Visual Studio-generated ^[pefile.txt]
• Linker: MajorLinkerVersion 0x30 (VS 2010-era .NET build) ^[pefile.txt:45]
• Timestamp: Sun Mar 13 04:06:49 2044 UTC (fabricated/future-dated) ^[pefile.txt:88]
• PDB: hovF.pdb with GUID BC46C931-F9CB-4130-B5BC-BA895808F3F5 ^[pefile.txt:353]
• Assembly version: 1.0.0.0 ^[exiftool.json]
• Signed: No ^[rabin2-info.txt]
• YARA: Only PE_File_Generic ^[yara.txt]

Build / RE

Toolchain

• .NET Framework 4.0, C# WinForms application
• Compiled with Visual Studio (linker version 0x30, VS 2010-era toolchain)
• Contains standard .resources files for 20+ WinForms dialogs ^[strings.txt:521-578]
• Standard RT_VERSION and RT_MANIFEST resources ^[pefile.txt:257-358]
• Assembly manifest requests asInvoker execution level ^[strings.txt:1921]

No Obfuscation

• No ConfuserEx, SmartAssembly, Xenocode, or other commercial obfuscator signatures
• No string encryption, no control-flow flattening
• Type names, method names, and namespace structure are fully readable:
  • KarateClub.LoginMode.MemberMode
  • KarateClub.ManageBeltRanks
  • KarateClubBusinessLayer, KarateClubDataAccessLayer
  • clsPerson, clsMember, clsInstructor, clsPayment, clsBeltRank, etc.

Anti-Analysis

• None observed. No debugger checks, no VM detection, no timing loops, no sandbox gates.
• The capa hit for "reference analysis tools strings" is a false positive from DebuggerBrowsableAttribute and DebuggingModes — standard .NET compiler-generated attributes on a debug build. ^[capa.txt]

Embedded Resources

• PNG icon: 468×468 RGBA image (~437 KB) at offset 0x310B3. Standard application icon, no steganography detected (alpha channel fully opaque, no encoded data in LSB). ^[binwalk.txt]
• Manifest XML: Standard UAC manifest at 0xA15D4 ^[pefile.txt]
• VS_VERSIONINFO: FileDescription = KarateClubBusinessLayer, InternalName = hovF.exe, ProductName = KarateClubBusinessLayer, LegalCopyright = Copyright © 2023 ^[exiftool.json]

Notable Gap

• The floss.txt artifact in this analysis directory is actually a CLI error message (invalid --no argument), not decoded strings. There were no obfuscated strings to decode. ^[floss.txt]

How It Works

The binary is a complete karate-dojo management CRM with the following modules (all confirmed via string extraction):

Database layer: SqlConnection, SqlCommand, DbConnection references present. No hardcoded connection string recovered in strings; likely loaded from app.config or constructed at runtime. ^[strings.txt:463-464]

The sole malicious behavior is the filename masquerade (Purchase_Order.exe) used to deliver this benign application in a phishing context.

Deploy / ATT&CK

• T1204.002 — User Execution: Malicious File: The binary relies on the victim executing Purchase_Order.exe believing it to be a purchase order. No auto-execution, no exploit.
• T1036.005 — Masquerading: Match Legitimate Name or Location: Filename masquerade as a business document.

No other ATT&CK techniques apply. There is no C2, no persistence, no credential theft, no defense evasion, no discovery, no lateral movement, no exfiltration.

The capa hit for T1620 (Reflective Code Loading) is a false positive triggered by System.Reflection namespace strings and Assembly references — standard .NET runtime infrastructure, not malicious reflective loading. ^[capa.txt]

C2 Infrastructure

None. No network APIs, no hardcoded IPs, domains, URLs, or social-media webhooks. Zero C2 footprint.

Interesting Tidbits

• Build artifact quality: Genuine Visual Studio project with proper three-layer architecture (Presentation / Business / Data Access), 20+ .resources files, and a 468×468 application icon. This is a real, functional application, not a minimal stub. ^[strings.txt]
• Future-dated timestamp: PE timestamp is March 2044, 18 years in the future. Likely the developer's system clock was wrong, or the build was done in a VM with an incorrect date. ^[pefile.txt:88]
• Internal name mismatch: The PDB/internal name is hovF.exe, but the distributed filename is Purchase_Order.exe. This confirms the binary was renamed after compilation. ^[exiftool.json]
• No database connection string: No hardcoded SQL Server connection string found in strings. The application likely expects a local SQL Server instance or reads config from an external .config file. ^[strings.txt]
• Capa false positives: T1620 and T1213 hits are both standard .NET framework artifacts, not malicious behavior. T1213 (Data from Information Repositories) fires on SqlCommand/SqlConnection strings in a database-querying application — expected for a CRM. ^[capa.txt]

How To Mess With It (Homelab Replication)

This is a benign application. To replicate the social-engineering vector:

1. Build any legitimate .NET WinForms application in Visual Studio
2. Rename the output .exe to Purchase_Order.exe or Invoice.exe
3. Distribute via email with a plausible business-context lure
4. The victim runs it, sees the application UI, and may not realize they've been socially engineered

Verification: Run capa Purchase_Order.exe — expect false positives on T1620 and T1213 from standard .NET framework strings. This is the same signature noise that triggered on this sample.

Deployable Signatures

YARA — Purchase-Order Masquerade (Low-Fidelity IOC)

This YARA is intentionally low-specificity. It targets the intersection of:

• Purchase-order filename masquerade
• .NET Framework PE32
• No network imports
• WinForms GUI with standard .NET SQL client references

rule unclassified_dotnet_purchase_order_masquerade
{
    meta:
        description = "Detects .NET WinForms applications masquerading as purchase orders"
        author = "SOC Analyst"
        date = "2026-07-06"
        hash = "7a310c85d3a3334c4e715402d09355dda340e0e32f784eab626e4ab1a7aff321"
        confidence = "low"
    strings:
        $purchase = "Purchase_Order" nocase
        $invoice = "INVOICE" nocase
        $po = "PO-" nocase
        $net1 = "System.Windows.Forms" wide
        $net2 = "System.Data.SqlClient" wide
        $net3 = "SqlConnection" wide
        $net4 = "SqlCommand" wide
        $net5 = "mscorlib, Version=4.0.0.0" wide
    condition:
        uint16(0) == 0x5A4D and
        any of ($purchase, $invoice, $po) and
        3 of ($net*) and
        filesize < 2MB
}

Sigma — Low-Fidelity Alert for Purchase-Order .NET Executions

title: Purchase Order .NET Execution
status: experimental
description: Alerts on execution of .NET PE files with purchase-order themed filenames
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'Purchase_Order'
            - 'PurchaseOrder'
            - 'PO-'
            - 'Invoice'
            - 'INVOICE'
        Image|endswith:
            - '.exe'
    filter:
        Image|contains:
            - '\\Program Files\\'
            - '\\Program Files (x86)\\'
            - '\\Windows\\'
    condition: selection and not filter
falsepositives:
    - Legitimate procurement software with purchase-order themed filenames
    - Benign applications distributed via purchase-order themed installers
level: low

IOC List

Behavioral Fingerprint

This binary is a .NET Framework 4.0 WinForms GUI application with no network imports, no persistence mechanisms, and no anti-analysis. It presents a karate-dojo management interface with SQL Server database connectivity. The sole threat indicator is the Purchase_Order.exe filename used for social engineering. If executed, it will display a WinForms CRM interface and attempt to connect to a local SQL Server instance — no malicious behavior is expected.

Detection Signatures

Capa false positives (NOT malicious):

• T1620 — System.Reflection namespace is standard .NET infrastructure
• T1213 — SqlConnection/SqlCommand in a database-querying CRM is expected
• B0013.001 — DebuggerBrowsableAttribute is compiler-generated

References

• unclassified-dotnet — Umbrella entity for unattributed .NET Framework PE32 binaries
• social-engineering-purchase-order-masquerade — Cross-family concept: purchase-order filename lure
• social-engineering-filename-lure — Generic social-engineering filename masquerade concept
• MalwareBazaar: https://bazaar.abuse.ch/sample/7a310c85d3a3334c4e715402d09355dda340e0e32f784eab626e4ab1a7aff321/

Provenance

Analysis based on static-only examination (CAPE skipped — no Windows guest available):

• file.txt, exiftool.json, pefile.txt, strings.txt, rabin2-info.txt, binwalk.txt, capa.txt, yara.txt, ssdeep.txt, tlsh.txt, triage.json, metadata.json
• floss.txt is a CLI error artifact, not decoded strings
• PNG icon extracted at offset 0x310B3 (468×468 RGBA, standard app icon)
• Gap between PNG end (0x9BB98) and manifest XML (0xA15D7) contains debug directory and PDB info (entropy 7.89 — normal for debug data), no embedded secondary payload