unclassified-dotnet: 9a40908c — FSC UI WinForms library second sibling (Zfio build), CV.pdf.exe lure

Executive Summary

Second confirmed sibling of the .NET Framework 4.0 WinForms UI library FSC UI by Fabian Schlüter. Distributed as CV.pdf.exe (curriculum-vitae / resume lure via double-extension masquerade). Compared to the first sibling (e04d46ff / NZiU.exe), this build uses the internal name Zfio.exe, is 76 KB larger (671 KB vs 595 KB), carries more embedded PNG icons, and shares the same hardcoded SHA256 integrity hash. No packing, no obfuscation, no network APIs, no persistence. Threat is purely social-engineering masquerade. See the unclassified-dotnet entity page and the sibling report e04d46ff for full cluster analysis. ^[/intel/analyses/e04d46ff3726afd45a2181347c64b088f9500d242eda127959a1462daa4db84e.html]

What It Is

Family ascription: unclassified-dotnet — benign developer library repackaged with social-engineering filename. Second confirmed FSC UI sibling.

How It Works

This binary is functionally identical to the first FSC UI sibling (e04d46ff). It is a .NET Framework 4.0 WinForms GUI application built around the custom themable control library (FSC_UI namespace). For a complete component list (custom controls, theming engine, MDI shell, resource files), see the sibling report. ^[/intel/analyses/e04d46ff3726afd45a2181347c64b088f9500d242eda127959a1462daa4db84e.html]

Per-sample deltas:

• Internal name changed: Zfio.exe / Zfio.pdb vs NZiU.exe / NZiU.pdb. Both are nonsense strings — likely auto-generated by a build script or obfuscator during repackaging. ^[pefile.txt:238] ^[rabin2-info.txt:13]
• File size increased: 671 232 bytes vs 595 456 bytes (+76 KB). The delta is in the .text section (0xA3400 raw vs ~0x91800 in the first sibling) and the .rsrc section, which carries more embedded PNG icons. ^[pefile.txt:84] ^[triage.json:12]
• More embedded PNGs: Binwalk recovered 18 small 16×16 PNG icons and one large 508×508 PNG, compared to ~18 small icons and one 481×481 PNG in the first sibling. These are UI glyphs for the themed control set. No steganography indicated. ^[binwalk.txt]
• Same hardcoded SHA256: The 64-character uppercase hex string 7D037A876D9C65AD35B2C7802BEE3402CE7A4D85F98B8B63413AA8E184010DC3 is present at the same relative offset in #Strings. It does not match the sample's own SHA256. Purpose remains unconfirmed. ^[strings.txt:15]
• Social-engineering lure changed: CV.pdf.exe (curriculum vitae / resume lure, double-extension masquerade) vs QUOTE-2K240726-A-CCC.exe (business-quote lure). Both prey on HR/procurement employees. ^[triage.json:5]
• Timestamp fabrication: 2097 vs 2101. Both are impossible future dates confirming post-build tampering or linker override during repackaging. ^[pefile.txt:34]

Capa false-positive explanation: Identical to the first sibling — T1620 from Activator / Assembly.Load (standard .NET reflection) and T1497.001 from DebuggerBrowsableState / DebuggableAttribute (Debug-build compiler decorations). See sibling report for full mapping. ^[capa.txt]

Decompiled Behavior

Ghidra import succeeded but analysis remained incomplete at time of report generation (analysis_complete: false, code_indexed: false). Radare2 CIL analysis (level 3) found 417 functions, all standard .NET method stubs. Entry point is _CorExeMain via mscoree.dll. No native-code functions, P/Invoke, or unmanaged call sites recovered. ^[rabin2-info.txt]

Because the binary is pure unobfuscated CIL, dnSpy or ILSpy would provide the most readable decompilation. Neither tool is installed on this station.

C2 Infrastructure

None observable statically. No network-related imports, strings, or resource artifacts.

Interesting Tidbits

• Double-extension masquerade: .pdf.exe is the classic Windows "Hide extensions" bypass. The icon will render as the default PDF icon if the attacker sets it, while the true .exe extension executes. ^[triage.json:5]
• CV-themed lure: Resume/CV filenames are a known attack vector targeting HR departments and hiring managers who expect unsolicited attachments. This shifts the target from finance/procurement (QUOTE lure) to HR/recruitment. ^[triage.json:5]
• GitHub repository confirmed: The FSC UI library is published by user Fabian2000 on GitHub as FSC-UI — a "Custom modern UI Library for Windows Forms Applications". The original source is likely legitimate and was simply repackaged by a threat actor. ^[github search result]
• Debug build: Presence of DebuggableAttribute and DebuggerBrowsableState confirms Debug configuration. A Release build would strip these and reduce binary size. ^[strings.txt:137,150,152]
• Resource entropy: .rsrc section entropy is 4.15 — well below the 7.0+ threshold for encrypted payload hiding. The content is legitimate UI bitmaps and the UAC manifest. ^[pefile.txt:112]

How To Mess With It (Homelab Replication)

See the sibling report e04d46ff for full replication notes. The additional value of this sample is in recognizing that the same benign library is being repackaged with multiple lure themes (QUOTE and CV) and multiple internal names (NZiU and Zfio), suggesting a distributor with a script-driven repackaging pipeline rather than manual one-off edits.

Deployable Signatures

YARA Rule (Updated — catches both NZiU and Zfio variants)

rule FSC_UI_Repackaged_Family {
    meta:
        description = "Detects FSC UI .NET WinForms library repackaged with social-engineering filenames (NZiU and Zfio variants)"
        author = "PacketPursuit"
        date = "2026-07-01"
        sha256_1 = "e04d46ff3726afd45a2181347c64b088f9500d242eda127959a1462daa4db84e"
        sha256_2 = "9a40908c3212dd34fd907ff66893537537adce8f136379baf98269158948a2e9"
    strings:
        $fsc_ui = "FSC UI" wide ascii
        $fsc_ns = "FSC_UI" wide ascii
        $nziu = "NZiU.exe" wide ascii
        $nziu_pdb = "NZiU.pdb" ascii
        $zfio = "Zfio.exe" wide ascii
        $zfio_pdb = "Zfio.pdb" ascii
        $theme1 = "LoadDefaultDarkTheme" wide ascii
        $theme2 = "LoadDefaultLightTheme" wide ascii
        $theme3 = "ThemeLoader" wide ascii
        $theme4 = "ThemeBuilder" wide ascii
        $hash = "7D037A876D9C65AD35B2C7802BEE3402CE7A4D85F98B8B63413AA8E184010DC3" ascii
        $dotnet = ".NETFramework,Version=v4.0" wide ascii
    condition:
        uint16(0) == 0x5A4D and
        $dotnet and
        $fsc_ui and
        ($nziu or $nziu_pdb or $zfio or $zfio_pdb) and
        2 of ($theme1, $theme2, $theme3, $theme4) and
        filesize < 1MB
}

IOC List

Behavioral Fingerprint Statement

This binary is a .NET Framework 4.0 WinForms GUI application with no network, persistence, injection, or crypto APIs. It loads mscoree.dll via standard .NET PE bootstrap, initializes custom-themed UI controls (FSCButton, FSCToggle, FSCPanel, FSCMessageBox), and presents an MDI parent shell with menu-strip and tool-strip surfaces. Capa may flag T1620 (reflective code loading) and T1497.001 (VM detection) due to compiler-generated DebuggerBrowsableState and Activator references — these are false positives. The only anomalous static artifact is a hardcoded 64-character SHA256 hex string in the #Strings metadata stream, shared with at least one confirmed sibling. The threat is social-engineering masquerade: the binary is benign but distributed under a deceptive filename (CV.pdf.exe) to trick HR/recruitment staff into executing it.

Detection Signatures

References

• unclassified-dotnet — Umbrella entity for unattributed .NET Framework PE32/PE32+ binaries; contains first FSC UI sibling analysis
• social-engineering-filename-lure — Concept: professional-context filename themes to exploit urgency
• version-info-masquerade — Concept: falsified VS_VERSIONINFO for benign appearance
• Sibling report: /intel/analyses/e04d46ff3726afd45a2181347c64b088f9500d242eda127959a1462daa4db84e.html
• Artifact ID: b0766f20-ca5b-441e-8d99-2d9ba4549de2
• Source: MalwareBazaar (abuse.ch) via OpenCTI urlhaus-recent-payloads connector

Provenance

Static analysis performed 2026-07-01 on pp-hermes (Lab1BU). Tools: file (5.45), exiftool (12.76), pefile (Python module), radare2 (cil backend, analysis level 3), capa (static analysis mode), strings (GNU binutils), binwalk (2.3.4), floss (failed — CLI argument parsing error). Ghidra import queued but analysis incomplete at report time. No dynamic execution available (CAPE skipped: no Windows guest). Report authored by Demetrian Titus.