unclassified-dotnet-chess-engine: 7d18d78c — Signed WinForMono bitboard chess engine with .pdf.exe double-extension lure

Executive Summary

A .NET Framework 4.0 PE32 with a valid Authenticode signature, compiled as a bitboard chess engine under the WinForMono namespace. Submitted to MalwareBazaar with the filename 160820242003464366.pdf.exe — a classic double-extension social-engineering lure. Static analysis finds no malicious payload resources, no P/Invoke surface, no network/crypto APIs, and no persistence mechanisms. The threat is entirely in the delivery filename; the binary itself appears to be a benign game engine obfuscated with Georgian-character name mangling. Confidence: low — static-only; IL-level decompilation would confirm the absence of hidden payload logic.

What It Is

• File: 160820242003464366.pdf.exe ^[file.txt]
• Type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, 3 sections ^[file.txt]
• Size: 848,904 bytes (≈ 829 KB) ^[metadata.json]
• Compile timestamp: Fri Sep 6 04:31:12 2024 UTC ^[pefile.txt:34]
• Linker: MSVC Linker 8.0 ^[exiftool.json:18]
• Runtime: .NET Framework 4.0 (metadata version v4.0.30319) ^[rabin2-info.txt]
• Entry point token: 0x60000a4 ^[rabin2-info.txt]
• Flags: ILONLY=1, 32BITREQUIRED=1, STRONGNAMESIGNED=0 ^[rabin2-info.txt]
• Signed: Yes (rabin2 signed: true) ^[rabin2-info.txt]
• Certificate chain: Comodo / Sectigo Code Signing CA, with CRL/OCSP URLs for comodoca.com and usertrust.com visible in the overlay ^[strings.txt]
• VS_VERSIONINFO: FileDescription: Sachy_Obrazky, InternalName: UqHB.exe, ProductName: Sachy_Obrazky, LegalCopyright: Copyright © 2020 ^[exiftool.json]

The internal name Sachy_Obrazky is Czech for "Chess Pictures", consistent with a chess game or image viewer.

How It Works

The binary is a self-contained .NET application with no external dependencies beyond the Framework itself (single import: mscoree.dll._CorExeMain) ^[pefile.txt:255]. The .NET metadata contains ~917 classes and ~1445 CIL methods. The largest namespace is WinForMono.Engine, which implements a full bitboard chess engine with move generation, capture generation, castling, and pawn promotion routines ^[rabin2 classes output].

Secondary namespaces include:

• WinForMono.WinformWrapper — WinForms UI wrapper
• WinForMono.Graphics.Vector2 — 2D graphics primitives
• WinForMono.Properties.Resources / .Settings — standard .NET property scaffolding
• OnKeyDown, OnTransformInvalidated, GenericForm, WrapperNull — UI event handlers

A subset of methods (particularly in the UI layer) use Georgian Unicode characters (Ⴈ, Ⴐ, Ⴃ, Ⴗ, Ⴄ) as names — a known Obfuscar / ConfuserEx name-mangling pattern ^[rabin2 class output]. These sit alongside clean English names (spawn, set_x, set_y, set_text, set_size, set_position, set_parent), suggesting the UI framework was obfuscated but the game engine logic was not.

Resources: Only two resources exist in the PE:

• RT_VERSION (796 bytes, entropy 3.324) ^[pefile.txt]
• RT_MANIFEST (490 bytes, entropy 5.001) ^[pefile.txt]

No ManifestResource entries in .NET metadata (Resources RVA=0, Size=0) ^[rabin2-info.txt]. No encrypted payload blobs, no bitmap stego carriers.

P/Invoke surface: None. The ImplMap table is absent and no MethodDef carries the PinvokeImpl flag ^[manual .NET metadata inspection via pefile].

Network / crypto / injection APIs: No suspicious MemberRef or TypeRef names found for VirtualAlloc, CreateRemoteThread, InternetOpen, WinHttp, Socket, RegCreateKey, CryptEncrypt, or similar ^[strings.txt scan].

Decompiled Behavior

Ghidra import queued but analysis incomplete at time of writing; radare2 indexed 1445 CIL functions. Key observations from radare2 class listing:

• WinForMono.Engine occupies ~55 KB of IL (methods 0–77 in the class table), containing bitboard operations (GetPos, HammingWeight, Land_Moves, Ray_Moves, King_Moves, Knight_Moves, Rook_Moves, Bishop_Moves, Queen_Moves, Pawn_Moves, Castling_White, Castling_Black, Attacked, GenMoves, GenCaptures, BuildMoveWhite/Black, CapsGeneration_White/Black, PassedPawnCheck, DecodeMove, IncodeMove) ^[rabin2 class output].
• WinForMono.WinformWrapper is 1.6 KB and contains a cctor (class constructor) and ctor.
• UI event classes (OnKeyDown, OnTransformInvalidated, GenericForm, WrapperNull) are all very small (12–16 bytes of IL), suggesting thin delegate wrappers.
• The obfuscated Georgian-letter methods appear in the UI property layer; none exceed a few hundred bytes.

No suspicious control flow, no heavy encrypted sections, no large unexplained method bodies that would indicate hidden payload logic.

C2 Infrastructure

None observed. No hardcoded IPs, domains, URLs, mutexes, named pipes, or registry keys. The only HTTP strings are certificate-chain CRL/OCSP URLs (http://crl.comodoca.com, http://ocsp.comodoca.com, http://crt.comodoca.com, http://www.usertrust.com, https://secure.comodo.net/CPS) ^[strings.txt].

Interesting Tidbits

• Double-extension masquerade: 160820242003464366.pdf.exe is a timestamped document lure. The .pdf.exe pattern exploits Windows hiding known extensions by default ^[triage.json].
• Valid Authenticode, suspicious context: The certificate chain (Comodo / Sectigo / UserTrust) is legitimate, but the signed binary is being distributed under a fraudulent filename. This is a known crimeware tactic — steal or buy a code-signing cert, sign a benign-looking binary, then social-engineer the victim. Without CAPE detonation we cannot confirm whether the binary drops a second-stage payload at runtime.
• Georgian-character obfuscation: Methods named Ⴈ, Ⴐ, Ⴃ, Ⴗ, Ⴄ break naive string-based clustering. They appear only in the UI layer, not the engine core. If this is a repackaged open-source chess engine, the obfuscator was likely applied to the whole project before compilation.
• Czech version info, no Czech UI strings: The VS_VERSIONINFO is Czech, but no Czech-language UI strings were recovered in the static string dump. The game may use resource files not stored in the PE.
• No .NET Native AOT: This is a standard Framework 4.0 IL assembly, not Native AOT. dnSpy/ILSpy would decompile it cleanly once the obfuscated names are accepted.
• CAPE skipped: No Windows guest available in the sandbox at time of triage ^[dynamic-analysis.md]. Runtime behavior (file drops, registry writes, network connections) remains unverified.

How To Mess With It (Homelab Replication)

Toolchain: Visual Studio 2019/2022, .NET Framework 4.0 target, C# WinForms.

Reproduction steps:

1. Clone any open-source C# bitboard chess engine (e.g., ChessBot or ChessEngine on GitHub).
2. Wrap it in a WinForms shell with a PictureBox chessboard and OnClick/OnKeyDown handlers.
3. Build with Platform target: x86, Prefer 32-bit: true.
4. Run Obfuscar or ConfuserEx over the assembly, selecting "Unicode renaming" for method names.
5. Set VS_VERSIONINFO to a benign foreign-language product name (e.g., Sachy_Obrazky).
6. Optionally purchase or use a valid code-signing certificate (Comodo, Sectigo) to sign the output.

Verification: capa <output.exe> should hit .NET platform, generate random numbers, access .NET resource, manipulate console buffer, invoke .NET assembly method, load .NET assembly — all generic .NET runtime capabilities, not malicious behaviors. The Reflective Code Loading [T1620] hit is a false positive from the .NET JIT/Reflection runtime.

Deployable Signatures

YARA rule

rule WinForMono_ChessEngine_DoubleExt_Lure {
    meta:
        description = "WinForMono .NET chess engine with .pdf.exe double-extension lure"
        author = "PacketPursuit"
        date = "2026-07-07"
        sha256 = "7d18d78c5cd6a14d0d70d5454d54b178860dc4b74cd0212c0f9e533368ecaf01"
    strings:
        $ns1 = "WinForMono.Engine" ascii wide
        $ns2 = "WinForMono.WinformWrapper" ascii wide
        $ns3 = "WinForMono.Graphics.Vector2" ascii wide
        $method1 = "MoveGeneration_White" ascii wide
        $method2 = "MoveGeneration_Black" ascii wide
        $method3 = "Castling_White" ascii wide
        $method4 = "Castling_Black" ascii wide
        $georgian1 = { E1 82 A8 }           // Ⴈ
        $georgian2 = { E1 82 B0 }           // Ⴐ
        $georgian3 = { E1 82 A3 }           // Ⴃ
    condition:
        uint16(0) == 0x5A4D and
        pe.imports("mscoree.dll", "_CorExeMain") and
        2 of ($ns*) and
        2 of ($method*) and
        any of ($georgian*)
}

Behavioral hunt query (Sigma-like pseudocode)

Process creation where:

• Image ends with .pdf.exe (double-extension masquerade)
• AND Image is a .NET assembly (mscoree.dll import)
• AND OriginalFileName or ProductName contains Sachy_Obrazky or UqHB.exe
• AND file is Authenticode-signed by Comodo/Sectigo Code Signing CA

title: WinForMono Chess Engine Double-Extension Lure
detection:
  selection:
    Image|endswith: '.pdf.exe'
    Imports|contains: 'mscoree.dll'
    ProductName|contains: 'Sachy_Obrazky'
  condition: selection

IOC list

Behavioral fingerprint

This binary is a .NET Framework 4.0 x86 PE with a single mscoree.dll import, a valid Authenticode signature by a Comodo/Sectigo chain, and a VS_VERSIONINFO claiming a Czech chess-game identity (Sachy_Obrazky). It contains a full bitboard chess engine (WinForMono.Engine) with move generation, castling, and pawn logic, alongside a WinForms UI layer with Georgian-character obfuscated method names. No network APIs, no crypto APIs, no persistence, and no P/Invoke surface are present. The threat indicator is the .pdf.exe double-extension filename used for social-engineering delivery.

Detection Signatures

References

• Artifact ID: be43bd19-d59c-4c3d-b0e2-e11062c9e2e1
• Source: MalwareBazaar via OpenCTI connector
• Related wiki pages: unclassified-dotnet-chess-engine, social-engineering-filename-lure, double-extension-masquerade

Provenance

Static artifacts generated by triage-fast.sh (2026-05-26): file(1), exiftool, pefile, strings, ssdeep, tlsh, yara. capa v7 run for .NET ATT&CK mapping. rabin2/radare2 level-3 analysis for CIL class/method enumeration. Manual pefile-driven .NET metadata parse for COR20 header, metadata streams, and resource enumeration. No dynamic execution (CAPE skipped — no Windows guest). No dnfile/ILSpy decompilation available on host at time of analysis.