unclassified-dotnet-bitmap-stego-loader: d4d106f8 — .text-section bitmap embedding, event-registration GUI masquerade

Executive Summary

Sixth confirmed sibling in the .NET Bitmap-Stego Loader cluster. Unique among siblings for embedding all bitmap carriers in the .text section rather than .rsrc, using larger 136×136×24 dimensions, and adopting an event-registration / attendee-management GUI masquerade (Order.exe). Static-only analysis (CAPE skipped — no Windows guest). No hardcoded C2 IOCs recovered; payload decryption key remains unknown.

What It Is

Internal name Order.exe, version 1.1.1.1, with fabricated VS_VERSIONINFO company/product strings (@7JJG2B8;:5G:7:, HG9?A2IE98?I9D9;FG5CJC). ^[exiftool.json:36-43]

How It Works

This sample follows the cluster's established pattern — a .NET Framework PE32 GUI binary with encrypted payload hidden inside embedded bitmap images — but deviates in three ways:

1. Bitmap placement: All 8 bitmaps live in the .text section (offsets 0x4207, 0x11BA0, 0x1F539, 0x2CED2, 0x3A86B, 0x48204, 0x55B9D, 0x63536), not .rsrc. ^[binwalk.txt] Prior siblings stored them as named BITMAP resources in .rsrc. ^[sample 4bf14434/binwalk.txt]
2. Bitmap dimensions: 136×136×24 (8-bit RGB), larger than the 76×76×24 (earlier siblings) or 88×88×24 (f230118d). ^[binwalk.txt]
3. GUI theme: Event-registration / attendee-management masquerade — strings include RegisteredAttendees, TransferOffered, AttendeeRegistered, _DateReported, InjuryReported, _RegistrationFee, registrationFee. ^[strings.txt:85-99]

The .rsrc section is stripped down to three RT_ICON entries and one RT_VERSION block — no bitmap resources at all. ^[pefile.txt:256-399] This suggests the builder intentionally moved bitmap storage out of the resource directory to evade resource-scanner signatures tuned to the cluster's earlier .rsrc-based pattern.

.NET framework references include System.Net.Http, System.Data, System.Linq, System.Core, System.Drawing, System.Resources, System.Threading, and Microsoft.VisualBasic.CompilerServices. ^[strings.txt] A single .resources file is named 2bc25062e981ac.Resources.resources. ^[strings.txt:100]

Decompiled Behavior

radare2 analysis (level 3) recovered 600 CIL functions; naming is heavily mangled (random alphanumeric), consistent with the cluster's obfuscation style. ^[r2:analysis-log] No plaintext API names in floss output — the tool errored on argument parsing, but manual string inspection confirms the same mangled-name surface seen in prior siblings. ^[floss.txt]

Entry-point flow (inferred from cluster pattern + static evidence):

1. CLR bootstrap via _CorExeMain.
2. Resource / bitmap stream extraction (exact method unknown — likely System.Resources.ResourceReader or Bitmap constructor with a raw stream offset).
3. Decryption of bitmap pixel data into a byte array.
4. Reflective loading or in-memory execution of the decrypted payload.

No Ghidra decompilation was attempted — the CIL surface is sufficiently characterized by capa and string analysis, and the payload logic is ciphertext.

C2 Infrastructure

No hardcoded IPs, domains, URLs, mutexes, or named pipes recovered statically. The presence of System.Net.Http and HttpResponseMessage suggests HTTP C2 or payload fetch capability, but the actual endpoint is runtime-resolved (likely inside the encrypted bitmap payload). ^[capa.txt] ^[strings.txt]

Interesting Tidbits

• Fewest bitmaps in cluster: Only 8 (vs. ~20 in 4bf14434, 24 in db0d6bc0/f74d8a51, 16 in f230118d). ^[binwalk.txt]
• Oldest fabricated timestamp: 1990-01-09, predating even the 2020 build of f6b5bdd5. ^[pefile.txt:34]
• No SoapHttpClientProtocol: Earlier siblings f74d8a51 and f6b5bdd5 carried SOAP client strings; this sample drops them in favor of System.Net.Http. ^[strings.txt]
• No DeflateStream / System.IO.Compression: The AES+Deflate chain hinted in f230118d is absent here. ^[strings.txt]
• .text entropy: 6.12 — high enough to hide encrypted data, low enough to avoid UPX-like 7.5+ signatures. ^[pefile.txt:92]

How To Mess With It (Homelab Replication)

Build a comparable .NET Framework PE32 binary with embedded bitmap carriers:

1. Create a C# WinForms project targeting .NET Framework 4.x.
2. Add 8 BMP images (136×136×24) as Embedded Resource or raw byte arrays in a .resx file.
3. Obfuscate with a .NET obfuscator that supports name mangling and control-flow flattening (e.g., ConfuserEx, Dotfuscator CE).
4. Strip .rsrc of RT_BITMAP entries; embed pixel data directly in .text as a byte array.
5. At runtime, reconstruct Bitmap objects from the byte arrays using new Bitmap(new MemoryStream(rawBytes)).
6. Extract pixel data via Bitmap.LockBits, decrypt with a simple XOR or AES, and Assembly.Load the result.

Verification: Run capa <repro.exe> and compare to this sample's capa.txt — should hit compiled to the .NET platform, access .NET resource, and generate random numbers in .NET.

Deployable Signatures

YARA Rule

rule UnclassifiedDotNetBitmapStegoLoader_TextSectionBitmaps
{
    meta:
        description = ".NET Bitmap-Stego Loader with bitmaps in .text section (d4d106f8 variant)"
        author      = "PacketPursuit"
        date        = "2026-06-25"
        sha256      = "d4d106f84bafa58d7b26128c6c32f80ebdaa7c333fc341ed119405434dde2751"
        family      = "unclassified-dotnet-bitmap-stego-loader"
    strings:
        $dotnet1 = "System.Resources.ResourceReader" ascii wide
        $dotnet2 = "System.Drawing.Bitmap" ascii wide
        $dotnet3 = "System.Net.Http" ascii wide
        $res_name = "Resources.resources" ascii wide
        $gui1 = "RegisteredAttendees" ascii wide
        $gui2 = "TransferOffered" ascii wide
        $gui3 = "AttendeeRegistered" ascii wide
        $gui4 = "InjuryReported" ascii wide
        $gui5 = "registrationFee" ascii wide
        $bmphdr1 = { 42 4D }              // BMP magic anywhere
        $bmphdr2 = { 42 4D 66 00 }         // small BMP header variant
    condition:
        uint16(0) == 0x5A4D and
        pe.imports("mscoree.dll", "_CorExeMain") and
        3 of ($dotnet*) and
        2 of ($gui*) and
        #bmphdr1 >= 8 and
        filesize < 600KB
}

Behavioral Hunt Query (Sigma)

title: .NET Bitmap-Stego Loader Process Spawn
description: Detects child processes spawned by a .NET GUI binary with event-registration masquerade strings
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        - Image|endswith: 'Order.exe'
        - CommandLine|contains:
            - 'RegisteredAttendees'
            - 'TransferOffered'
    selection_network:
        Initiated: 'true'
        CommandLine|contains:
            - 'powershell'
            - 'cmd.exe'
            - 'mshta'
    condition: selection_parent or selection_network
falsepositives:
    - Unknown
level: medium

IOC List

Behavioral Fingerprint

This binary is a .NET Framework PE32 GUI executable with a single mscoree.dll import, fabricated 1990 PE timestamp, and VS_VERSIONINFO masquerading as an event-registration application. It contains eight 136×136×24 BMP structures embedded in the .text section rather than the .rsrc directory, and references System.Net.Http, System.Resources.ResourceReader, and System.Drawing.Bitmap. No reflective-loading APIs are visible in plaintext strings, but cluster behavior suggests the bitmaps carry an encrypted second-stage payload. No CAPE detonation is available; dynamic behavior (registry, network, dropped files) is unobserved.

Detection Signatures

References

• Artifact ID: 4396f41a-2c78-4e94-98a8-98cd693f3265
• Source: OpenCTI / MalwareBazaar
• Cluster entity: unclassified-dotnet-bitmap-stego-loader
• Sibling analyses: 4bf14434, db0d6bc0, f74d8a51, f6b5bdd5, f230118d

Provenance

• file.txt — file v5.41
• pefile.txt — pefile 2023.2.7
• rabin2-info.txt — radare2 5.9.8
• exiftool.json — ExifTool 12.76
• strings.txt — strings from binutils
• floss.txt — flare-floss (argument error, no decoded output)
• capa.txt — flare-capa v7.4.0
• binwalk.txt — binwalk v2.4.2
• radare2 level-3 analysis — 600 CIL functions recovered, no named symbols