unclassified-dotnet: bd60fe2a — RFQ-themed .NET assembly bundling binary-tutorial game + SSH remote-wget tool + JS combiner

Executive Summary

A .NET Framework 4.0 PE32 x86 assembly distributed as RFQ_PETROFAC_PM-C-24-4400.exe (industrial RFQ social-engineering lure). Static analysis reveals no packing, no obfuscation, and no malicious payload. The assembly is a benign multi-project bundle containing a binary-tutorial educational game, an SSH-based remote file-transfer utility (RemoteWget), and a JavaScript file-combiner engine. Capa ATT&CK hits (T1620, T1059.001, T1083) are false positives from standard .NET runtime behaviour and legitimate application functionality. Threat is purely social-engineering masquerade. Static-only analysis — CAPE skipped due to no Windows guest.

What It Is

How It Works

Assembly Structure

The binary is an unobfuscated CIL assembly containing at least three distinct project namespaces merged into one PE:

1. BinaryTutorial — A WinForms educational binary-counting game with practiceModeToolStripMenuItem, getNewRandomNumber, submitAnswer, and instructional text boxes. Embedded PNG resources (256×256, 584×584, 64×64 icons) are game UI elements. ^[strings.txt:16-35] ^[binwalk.txt:6-9]

2. RemoteWget — An SSH-based remote file-transfer utility built on the open-source Renci.SshNet library. Exposes WinForms controls: textBoxServer, textBoxUserName, textBoxPassword, textBoxLocation (misspelled textBoxCoomand in metadata), and textBoxDisplay. References SshClient, SshCommand, PasswordAuthenticationMethod, RunCommand, and ConnectionInfo. ^[strings.txt:69-77] ^[strings.txt:420-436] ^[strings.txt:348-350]

3. JSCombiner.Engine / CombinerEngine — A JavaScript file-combiner / minifier with ReferenceGraph, IncludePath, FilePattern, CrawlDirectory, CheckAndConvertDirectoryToFiles, and GrabAllReferenced methods. ^[strings.txt:132] ^[strings.txt:196-222] ^[strings.txt:372-373]

Data-set classes

Typed DataSet / DataTable scaffolding (DataTable1, DataTable2) with auto-generated designer code (get_DataColumn1, ShouldSerializeDataTable1, etc.) suggests the binary was built from a Visual Studio WinForms project with dataset binding, typical of student coursework or rapid prototyping. ^[strings.txt:9-15]

Embedded Resources

• .rsrc section contains VS_VERSIONINFO (RT_VERSION, 0x350 bytes) and a standard UAC manifest (RT_MANIFEST, 0x1EA bytes, asInvoker). ^[pefile.txt:266-328]
• Binwalk identifies four PNG images in the .text overlay: 256×256 RGBA, 584×584 RGBA, and two 64×64 RGB icons — all consistent with WinForms toolbar / application icons. ^[binwalk.txt]
• No encrypted payload overlay, no manifest resource blob, no Base64 or XOR-encoded blocks detected.

Capa False-Positive Analysis

^[capa.txt]

Decompiled Behavior

No Ghidra decompilation was attempted — the binary is pure CIL; native x86 disassembly via radare2 yields only the _CorExeMain → mscoree trampoline. All threat logic would live in CIL bytecode inside the .text section. dnSpy or ILSpy would be the correct tools for method-level review; neither is installed on this host.

Radare2 analysis (level 2) discovered 295 functions and 165 symbols, but the CIL backend emits warnings (No SN reg alias for 'cil') and produces no actionable native-code decompilation. ^[rabin2-info.txt] ^[rabin2-analyze-log]

C2 Infrastructure

None recovered. No hardcoded IP addresses, domains, URLs, SMTP credentials, Telegram bot tokens, or cryptocurrency wallet addresses present in strings, #US metadata, or blob resources. The RemoteWget SSH client would require runtime-supplied server/user/password credentials; no defaults are embedded.

Interesting Tidbits

• Industrial RFQ lure specificity — The filename RFQ_PETROFAC_PM-C-24-4400.exe targets Petrofac, an oilfield services contractor, with a project-code format (PM-C-24-4400) that would pass casual triage in an energy-sector SOC. ^[metadata.json]
• Toshiba masquerade — VS_VERSIONINFO claims CompanyName: Toshiba, LegalCopyright: Toshiba 133 2025, LegalTrademarks: Toshiba. The "133" is likely a garbled year or placeholder. ^[exiftool.json]
• Internal-name typo — OdOg.exe (capital O, lowercase d, capital O, lowercase g) may be an obfuscation attempt or simply a developer's test build name. ^[exiftool.json:40]
• Misspelled controls — textBoxCoomand (instead of "Command") appears in both #Strings and #US metadata, confirming this is the developer's actual spelling, not a post-build mutation. ^[strings.txt:71]
• Spanish/Portuguese hints — get_fabrica44, get_manivela2b, manivela2b (manivela = Portuguese/Spanish for "crank" or "lever") suggest Iberian/Latin-American developer origin. fabrica = factory. These are resource accessor names, not C2 identifiers. ^[strings.txt:28,45]
• No anti-analysis — No IsDebuggerPresent, CheckRemoteDebuggerPresent, WMI queries, CPUID checks, or sleep loops. No VM detection. No packed or encrypted sections.

How To Mess With It (Homelab Replication)

Toolchain: Visual Studio 2019/2022, .NET Framework 4.0 Target, C# WinForms App.

1. Create a new WinForms project targeting .NETFramework,Version=v4.0.
2. Add NuGet package SSH.NET (Renci.SshNet) for the remote-wget utility.
3. Add a second WinForms project for the binary-tutorial game (buttons for 1/2/4/8/16/32/64/128, a submitAnswer handler, and Random number generation).
4. Add a class-library project for JSCombiner.Engine with Directory.GetFiles, Path.Combine, and StreamReader/StreamWriter.
5. Merge all three into a single assembly via ILMerge or by referencing them from a shell EXE.
6. Set VS_VERSIONINFO to CompanyName: Toshiba, ProductName: Remote Binary.
7. Compile in Debug configuration to reproduce the DebuggableAttribute / DebuggerNonUserCodeAttribute capa hits.

Verification: Run capa against the output. Expect T1620 (reflective loading) and T1059.001 (PowerShell) false positives, plus T1083 (directory discovery) from the JS combiner. Compare capa fingerprint to this sample — the match confirms these are benign artefacts.

Deployable Signatures

YARA Rule

rule UnclassifiedDotNet_RFQ_BinaryTutorial_RemoteWget
{
    meta:
        description = ".NET Framework PE32 bundling BinaryTutorial + RemoteWget + JSCombiner; RFQ social-engineering lure"
        author = "pp-hermes"
        date = "2026-06-30"
        sha256 = "bd60fe2a6da189779fb4bab503be814e0bcb503f20aee28ea4e989b156d8f08d"
        family = "unclassified-dotnet"

    strings:
        $dotnet = ".NETFramework,Version=v4.0" ascii wide
        $a1 = "BinaryTutorial" ascii wide
        $a2 = "RemoteWget" ascii wide
        $a3 = "JSCombiner.Engine" ascii wide
        $a4 = "Renci.SshNet" ascii wide
        $a5 = "binaryTutorialButton1_Click" ascii wide
        $a6 = "textBoxCoomand" ascii wide
        $a7 = "get_fabrica44" ascii wide
        $a8 = "get_manivela2b" ascii wide
        $toshiba = "Toshiba 133 2025" ascii wide
        $odog = "OdOg.exe" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        $dotnet and
        4 of ($a*) and
        filesize < 1MB
}

Behavioral Fingerprint Statement

This .NET Framework 4.0 PE32 x86 executable loads via mscoree._CorExeMain, contains unobfuscated CIL bytecode with high .text section entropy (≈ 7.97), and embeds multiple WinForms PNG icon resources. At runtime it instantiates a BinaryTutorial game form, a RemoteWget SSH client form (using Renci.SshNet), and a JSCombiner.Engine directory crawler. No network connections are initiated without user-supplied SSH credentials. No persistence, no anti-analysis, no payload decryption. The threat is entirely in the social-engineering filename.

IOC List

Detection Signatures (capa → ATT&CK)

References

• Sample source: OpenCTI / MalwareBazaar
• SHA-256: bd60fe2a6da189779fb4bab503be814e0bcb503f20aee28ea4e989b156d8f08d
• Related wiki page: unclassified-dotnet

Provenance

Analysis conducted on 2026-06-30 using:

• file v5.45, exiftool v12.76, pefile (Python), radare2 v5.x CIL backend, capa v7.x, binwalk v2.3.4, strings (GNU binutils), manual .NET metadata parsing via pefile + struct.
• No CAPE dynamic analysis available (no Windows guest). All behaviour inferred from static metadata, strings, and capa output.