unclassified-dotnet: db8c072b — DHL-lure dynamic-form generator with embedded RC4-style cipher demo

Executive Summary

.NET Framework 4.0 WinForms educational application (DynamicFormLoading / eKys.exe) repackaged with a DHL shipping-document filename. Contains a dynamic form generator that uses System.Reflection to instantiate UI elements at runtime, plus a small Mirror class implementing an RC4-like stream cipher (KSA + ProcessState + Swap) as a programming exercise. No malicious payload, no network APIs, no persistence, no anti-analysis, no packing. The threat is purely social-engineering masquerade. Static-only analysis (CAPE skipped — no Windows guest). ^[file.txt] ^[pefile.txt] ^[rabin2-info.txt]

What It Is

How It Works

Entry point — Program.Main (RVA 0x35d9) calls Application.EnableVisualStyles, SetCompatibleTextRenderingDefault, then Application.Run(new MainForm()) ^[r2:method.DynamicFormLoading.Program.Main].

MainForm — A standard WinForms TableLayoutPanel with a ComboBox (cmbObjects), a button1, and a DynamicallyLoadedForm child. On load (MainForm_Load, RVA 0x2f74) it populates the combo box from reflected assembly types. On button1_Click (RVA 0x2f30) it instantiates the selected type via Mirror.GetReflectedAssembly → Activator.CreateInstance and passes it to DynamicallyLoadedForm via set_PassedFormObject ^[r2:method.DynamicFormLoading.MainForm.button1_Click] ^[r2:method.DynamicFormLoading.MainForm.MainForm_Load].

DynamicallyLoadedForm — Receives a ReflectedObject payload and dynamically generates labels, text boxes, check boxes, date pickers, and buttons by walking the object's properties via System.Reflection.PropertyInfo ^[r2:method.DynamicFormLoading.DynamicallyLoadedForm.CreateFormElements].

Mirror class — Contains two reflection helpers (GetReflectedAssembly, GetReflectedObject) and four methods (KSA, ProcessState, InitializeStateArray, Swap) that together implement a standard RC4 key-scheduling algorithm and swap routine ^[r2:method.DynamicFormLoading.Mirror.KSA] ^[r2:method.DynamicFormLoading.Mirror.ProcessState] ^[r2:method.DynamicFormLoading.Mirror.InitializeStateArray] ^[r2:method.DynamicFormLoading.Mirror.Swap]. The KSA method body (RVA 0x301c) is only 5 bytes — it delegates to ProcessState in a loop. ProcessState (RVA 0x3048) performs XOR (0x7b), OR (0x4b), and AND (0xff) operations on byte indices. InitializeStateArray allocates a 256-byte array. Swap exchanges two bytes. This is classic RC4 scaffolding, not an obfuscation layer.

AAox1 class — A simple assembly-attribute helper that exposes AssemblyTitle, AssemblyVersion, AssemblyDescription, AssemblyProduct, AssemblyCopyright, and AssemblyCompany via reflection on GetExecutingAssembly ^[strings.txt:75-87] ^[r2:method.DynamicFormLoading.AAox1.get_AssemblyTitle].

Decompiled Behavior

Radare2 decompilation of the CIL methods confirms benign educational intent:

• GetReflectedAssembly (RVA 0x3537): calls GetExecutingAssembly, filters types by Namespace, then returns Activator.CreateInstance result ^[r2:method.DynamicFormLoading.Mirror.GetReflectedAssembly].
• GetReflectedObject (RVA 0x34c8): builds a ReflectedObject wrapper by enumerating PropertyInfo names and types ^[r2:method.DynamicFormLoading.Mirror.GetReflectedObject].
• get_dnNX (RVA 0x36f9): a Properties.Resources accessor returning a System.Drawing.Bitmap from the embedded .resources file ^[r2:method.DynamicFormLoading.Properties.Resources.get_dnNX].

No calls to System.Net, System.IO.FileStream for payload staging, Process.Start, Registry, or any native API.

C2 Infrastructure

None. No hardcoded URLs, IPs, domains, SMTP credentials, or socket APIs. No C2 infrastructure of any kind. The only "network" strings are standard .NET framework assembly references (System.Drawing, System.Resources, etc.) ^[strings.txt:14-19] ^[dnfile:MemberRefs].

Interesting Tidbits

• DHL filename masquerade — DHLXKULI570796821_PO200000035_SCAN.exe mimics a DHL airway-bill / purchase-order scan document, a common logistics-social-engineering lure. ^[metadata.json:4]
• Company name "DCC" appears in Comments, CompanyName, and LegalCopyright fields — possibly a student initials or a small developer tag. Not a known threat actor. ^[pefile.txt:233-243]
• Four embedded PNG resources in .rsrc: three 256×256 icons and one 335×359 bitmap (likely a splash or logo). ^[binwalk.txt:6-10]
• IL linker v48.0 compiler path — same toolchain as many other unclassified-dotnet siblings (e.g., c9db49c9, 8d4d4300, b760c6f2), confirming this is a Visual Studio 2019/2022 educational build. ^[pefile.txt:45]
• RC4 cipher in a form app — The Mirror class implements textbook RC4 KSA + PRGA but the IV/key arrays are never populated with actual key material in the observed static view; the methods may be stubs from an incomplete tutorial.

How To Mess With It (Homelab Replication)

1. Open Visual Studio 2019/2022, create a new Windows Forms App (.NET Framework) targeting v4.0.
2. Add a MainForm with a ComboBox, a Button, and a TableLayoutPanel.
3. Create domain classes (Customer, Vendor, Product, Location) with auto-properties.
4. In MainForm_Load, reflect over Assembly.GetExecutingAssembly().GetTypes() and populate the combo box.
5. In button1_Click, call Activator.CreateInstance(selectedType) and pass the result to a DynamicallyLoadedForm that walks PropertyInfo to generate labels and text boxes.
6. Add a Mirror class with byte-array KSA and swap methods — any C# RC4 tutorial will match.
7. Build. The resulting PE should have the same capa fingerprint (reference analysis tools strings, access .NET resource, compiled to the .NET platform).

Deployable Signatures

YARA Rule

rule UnclassifiedDotNet_DynamicFormLoading_DHL {
    meta:
        description = "Detects DynamicFormLoading eKys .NET educational app repackaged with DHL lure"
        author = "PacketPursuit"
        date = "2026-07-19"
        sha256 = "db8c072bd16c6b45cfbc9964f8cbac16a589c26ecdedccfbada06f57d19b3f05"
    strings:
        $a = "DynamicFormLoading" wide ascii
        $b = "eKys.exe" wide ascii
        $c = "DynamicallyLoadedForm_Load" wide ascii
        $d = "GetReflectedAssembly" wide ascii
        $e = "Mirror" wide ascii
        $f = "KSA" wide ascii
        $g = "ProcessState" wide ascii
        $h = "InitializeStateArray" wide ascii
        $i = "AAox1" wide ascii
        $j = "2024 DCC" wide ascii
    condition:
        uint16(0) == 0x5A4D and
        (pe.exports("_CorExeMain") or pe.imports("mscoree.dll", "_CorExeMain")) and
        5 of ($a, $b, $c, $d, $e, $f, $g, $h, $i, $j)
}

Behavioral Fingerprint

.NET Framework 4.0 WinForms executable presenting a single-window form with a combo box and a button. On launch it reflects over its own assembly to populate the combo box with domain-object types (Customer, Vendor, Product, Location). Selecting a type and clicking the button spawns a secondary dialog with dynamically generated labels and input fields. Contains an embedded Mirror class with four-byte RC4 KSA/PRGA stub methods (KSA, ProcessState, InitializeStateArray, Swap). No network activity, no registry writes, no process spawning, no file drops. Threat is purely social-engineering filename masquerade.

IOC List

Detection Signatures

No MITRE ATT&CK mappings are justified — the binary performs no malicious behavior.

References

• Artifact ID: 7e5b311e-0cad-4f3e-8508-33337b7accb3 ^[metadata.json:2]
• Source: MalwareBazaar / OpenCTI (malware-bazaar connector) ^[metadata.json:10]
• Related wiki pages: unclassified-dotnet

Provenance

• file.txt — file(1) output ^[file.txt]
• pefile.txt — pefile parser (PE headers, sections, imports, resources, version info) ^[pefile.txt]
• exiftool.json — ExifTool metadata extraction ^[exiftool.json]
• rabin2-info.txt — radare2 binary header summary ^[rabin2-info.txt]
• strings.txt — Strings extraction ^[strings.txt]
• capa.txt — Mandiant capa static capability detection ^[capa.txt]
• binwalk.txt — Binwalk embedded-artefact scan ^[binwalk.txt]
• dnfile — Python dnfile .NET metadata parser (assembly identity, types, methods, MemberRefs, resources) ^[dnfile]
• r2 — radare2 CIL decompilation (method-level control flow, cross-references) ^[r2]

Report compiled 2026-07-19 by Demetrian Titus (pp-hermes). Static-only; no CAPE detonation available.