unclassified-dotnet: c9db49c9 — datalock phone-locker courseware masquerade

Executive Summary: A .NET Framework 4.0 WinForms educational application (datalock.exe) implementing a phone/locker management simulation, repackaged with the invoice-themed filename DETAILED_INVOICES.exe. No malicious payload, no network APIs, no persistence. Capa T1620 and B0013.001 are false positives from Debug-build compiler attributes — the forty-fifth confirmed sibling in the unclassified-dotnet benign-masquerade cluster.

What It Is

• Format: PE32 .NET Framework 4.0 GUI, 365 KB, 3 sections ^[file.txt]
• Internal name: datalock.exe ^[exiftool.json:38-40]
• PDB path: C:\Users\Nova\source\repos\datalock\datalock\obj\Debug\datalock.pdb ^[rabin2-info.txt:13] ^[pefile.txt:354]
• VS_VERSIONINFO: FileDescription: datalock, ProductName: datalock, Copyright 2024, version 1.0.0.0 ^[exiftool.json:37-45] ^[pefile.txt:237-243]
• Distribution filename: DETAILED_INVOICES.exe (invoice social-engineering lure) ^[triage.json:5]
• PE timestamp: future-dated 2060-11-26 15:13:40 UTC ^[pefile.txt:34] ^[exiftool.json:15]
• Signature: unsigned ^[rabin2-info.txt:29]
• Linker: IL linker v48.0 (.NET Native/ILC indicator per pefile) ^[pefile.txt:46-47]

How It Works

The binary is a benign .NET Framework educational application — a phone/locker management simulation with coursework-grade classes: PhoneUI, LockerSystem, LockerManager, ContactManager, CallLogger, ShoppingCart, Calculator, School, Student, Circle, Animal, Pennington, Rueben, Morrow. ^[strings.txt:1-500] No System.Net namespace, no P/Invoke imports, no registry persistence APIs, no process injection surface. The sole native import is mscoree.dll._CorExeMain, standard .NET bootstrap. ^[pefile.txt:255]

The threat is purely social-engineering masquerade: a benign coursework app distributed with an invoice-themed filename to exploit Windows "Hide extensions" default. ^[social-engineering-filename-lure]

Decompiled Behavior

radare2 CIL analysis recovered 240 method stubs. ^[r2:analysis] Entry point is _CorExeMain → standard CLR initialization. No native code sections. The .text section entropy is 7.94 (high for CIL bytecode, normal for a compiled .NET assembly). ^[pefile.txt:92] No encrypted overlay, no manifest resource payload, no reflective Assembly.Load on foreign bytes. The AesCryptoServiceProvider and SHA256CryptoServiceProvider references belong to a student cryptography exercise, not a malware decryption layer. ^[strings.txt:187-209]

C2 Infrastructure

None. No hardcoded URLs, IPs, domains, mutexes, named pipes, or registry persistence keys. No System.Net or P/Invoke network surface recovered.

Interesting Tidbits

• The datalock namespace includes Authentication, LockerValidation, LockerAccess — names that sound security-relevant but implement trivial coursework logic (password properties, locker occupancy booleans). ^[strings.txt:100-200]
• DebuggerNonUserCodeAttribute, DebuggableAttribute, and DebuggerBrowsableAttribute are present in CIL metadata — the root cause of capa's false-positive T1620 / B0013.001 hits. ^[strings.txt:107-109]
• FLOSS invocation failed during triage due to a CLI argument error (--no flag mishandling). ^[floss.txt:1-6]
• Binwalk finds only the standard PE header, a CopyrightAttribute string, and the UAC XML manifest (<requestedExecutionLevel level="asInvoker" uiAccess="false"/>). ^[binwalk.txt] ^[strings.txt:817-827]
• The .rsrc section contains only RT_VERSION and RT_MANIFEST entries — no bitmap stego, no encrypted payload blob. ^[pefile.txt:259-329]

How To Mess With It (Homelab Replication)

To reproduce the capa false-positive fingerprint:

1. Create a .NET Framework 4.0 WinForms app in Visual Studio, Debug configuration.
2. Add classes with names like Authentication, LockerManager, EncryptionHelper.
3. Reference System.Security.Cryptography and call SHA256CryptoServiceProvider.ComputeHash on a test string.
4. Add a Console.WriteLine or Console.ReadLine for I/O.
5. Compile and run capa <reproducer.exe> — expect T1620 (Reflective Code Loading) and B0013.001 (Analysis Tool Discovery) from DebuggableAttribute and standard CIL reflection.

Verification: Compare capa output to this sample's capa.txt. The false-positive mapping should match. This demonstrates why capa on .NET Debug builds requires manual validation before ATT&CK technique attribution.

Deployable Signatures

YARA

rule DATALOCK_COURSEWARE_MASQUERADE {
    meta:
        description = "Detects datalock .NET courseware repackaged with social-engineering filenames"
        author = "PacketPursuit SOC"
        date = "2026-07-18"
        sha256 = "c9db49c9cc19516d4a95548d1ce4ce1f36df8c40e690c14bcb547ddb1e789bb1"
    strings:
        $datalock = "datalock" ascii wide
        $pdb = "datalock.pdb" ascii wide
        $phoneui = "PhoneUI" ascii wide
        $lockersys = "LockerSystem" ascii wide
        $lockermgr = "LockerManager" ascii wide
        $calllogger = "CallLogger" ascii wide
        $cor = "mscorlib" ascii wide
        $dotnet = ".NETFramework,Version=v4.0" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $cor and $dotnet and
        3 of ($datalock, $pdb, $phoneui, $lockersys, $lockermgr, $calllogger)
}

Behavioral Fingerprint

This binary is a .NET Framework 4.0 CIL assembly with a single mscoree.dll import, .text section entropy ~7.94 from compiled bytecode, debug-build compiler attributes that trigger capa T1620/B0013.001 false positives, and zero network or persistence APIs. The threat is exclusively social-engineering via a deceptive invoice-themed filename.

IOC List

Detection Signatures (capa → ATT&CK)

No other ATT&CK techniques are applicable. The binary has no malicious behavior.

References

• Artifact ID: 05ce6b2d-0d69-4bc9-ab3f-813eab34e95e
• OpenCTI labels: exe, malware-bazaar
• Related wiki pages: unclassified-dotnet, debug-build-capa-false-positives, social-engineering-filename-lure

Provenance

Static analysis performed 2026-07-18 using file(1), pefile, exiftool, radare2 (CIL analysis, 240 functions recovered), binwalk, capa v7, and strings. CAPE detonation skipped — no Windows guest available. floss invocation failed due to triage script CLI argument error (--no flag mishandled). All observations are static-only. ^[file.txt] ^[pefile.txt] ^[rabin2-info.txt] ^[capa.txt] ^[strings.txt] ^[binwalk.txt] ^[exiftool.json] ^[triage.json] ^[floss.txt]