unclassified-dotnet: e04d46ff — FSC UI WinForms library with embedded SHA256 integrity hash, social-engineering filename

Executive Summary

A .NET Framework 4.0 PE32 GUI executable presenting as the custom WinForms UI library FSC UI by Fabian Schlüter. Distributed under the filename QUOTE-2K240726-A-CCC.exe (business-document / quote lure). No packing, no obfuscation, no native API imports, no network APIs, and no persistence mechanisms are present. The only anomalous static artifact is a hardcoded 64-character SHA256 hash string embedded in the #Strings metadata stream. Threat is purely social-engineering masquerade; payload is benign. Capa T1620 and T1497.001 hits are false positives from standard .NET reflection and System.Diagnostics debugger-browsable attributes.

What It Is

Family ascription: unclassified-dotnet — benign developer library repackaged with social-engineering filename. Not a malware family.

How It Works

The binary is a .NET Framework 4.0 WinForms GUI application built around a custom themable control library (FSC_UI namespace). Observed components:

• Custom controls: FSCButton, FSCToggle, FSCPanel, FSCTextBox, FSCMessageBox, FSCTitleBarPanel, FSCPictureBox, ControlsGraphic ^[strings.txt:30-33,305,337,515-518]
• Theming engine: ThemeLoader, ThemeBuilder, LoadTheme, LoadDefaultDarkTheme, LoadDefaultLightTheme, SetTheme, GetColorFromARGBString, GetARGBString ^[strings.txt:115-119,189-190]
• MDI shell: MDIParent1 with standard menu-strip items (fileMenu, editMenu, viewMenu, toolsMenu, windowsMenu, helpMenu) and tool-strip buttons (saveToolStripButton, openToolStripButton, etc.) ^[strings.txt:10,506-512,307-312]
• Resource files: FSC_UI.MDIParent1.resources, FSC_UI.FSC.resources, FSC_UI.FSCToggle.resources, FSC_UI.Properties.Resources.resources, FSC_UI.FSCMessageBox.resources ^[strings.txt:420-424]

Embedded SHA256 hash string: A single 64-character uppercase hex string sits in the #Strings metadata stream:

7D037A876D9C65AD35B2C7802BEE3402CE7A4D85F98B8B63413AA8E184010DC3

^[strings.txt:15]

This hash does not match the sample's own SHA256 (e04d46ff…). Its purpose is unknown — candidate explanations include:

1. Integrity check against a companion theme/config file expected at runtime.
2. License-validation hash.
3. Hardcoded payload hash for a companion dropper (not present in this binary).

No runtime-resolution logic, decryption routine, or downloader code is visible statically. Without dynamic execution the hash's purpose cannot be confirmed.

Capa false-positive explanation:

• T1620 Reflective Code Loading — triggered by System.Reflection.Assembly::Load and Activator references, which are standard .NET patterns for internal type resolution and theming plugin loading. No actual reflective payload injection is present. ^[capa.txt]
• T1497.001 Virtualization/Sandbox Evasion::System Checks — triggered by DebuggerBrowsableState, DebuggerNonUserCodeAttribute, and DebuggableAttribute compiler-generated decorations, which are present in every Debug-build .NET assembly. ^[capa.txt] ^[strings.txt:137,150,152]

Decompiled Behavior

Radare2 analysis (level 2) identified 417 CIL functions, 173 with named symbols. The entry point resolves to _CorExeMain via mscoree.dll (standard .NET bootstrap). ^[rabin2-info.txt]

No native-code functions, P/Invoke declarations, or unmanaged call sites were recovered. The unmanaged call capa hit is a generic .NET runtime flag and does not indicate native API bridging.

Because the binary is pure CIL without obfuscation, dnSpy or ILSpy would provide the most readable decompilation. Neither tool is installed on this station; static analysis relied on strings, capa, and pefile output.

C2 Infrastructure

None observable statically. No network-related imports, strings, or resource artifacts.

Interesting Tidbits

• Social-engineering filename pattern: QUOTE-2K240726-A-CCC.exe follows the business-document lure convention (QUOTE, invoice, payment, shipping, HAWB, RFQ) observed across the unclassified-dotnet cluster and other families. ^[triage.json:5]
• Developer attribution: The VS_VERSIONINFO carries the real name "Fabian Schlüter" and product "FSC UI" with copyright year 2021. A web search for "Fabian Schlüter FSC UI" or "FSC UI .NET WinForms" may locate the original open-source or commercial component. ^[pefile.txt:235-242]
• card_no string: Present in the string table at line 325. Possibly part of a demo form that includes credit-card number fields, making the binary attractive for financial-themed social-engineering repackaging. ^[strings.txt:325]
• gXHq method name: An auto-generated backing-field getter (get_gXHq) with a meaningless identifier, suggesting Visual Studio designer-generated code rather than manual obfuscation. ^[strings.txt:337]
• PNG icon suite: Binwalk recovered ~18 small 16×16 PNG icons and one large 481×481 PNG, all standard RGBA. These are UI glyph / toolbar images for the themed control set. No steganography or payload-hiding is indicated. ^[binwalk.txt]
• Debug build signatures: Presence of DebuggableAttribute and DebuggerBrowsableState confirms a Debug-configuration build. Release builds strip these.
• Timestamp in 2101: The PE timestamp (0xF6F73A54) is impossible — either fabricated by the packager or a linker bug. It does not correlate to any known campaign timeframe.

How To Mess With It (Homelab Replication)

This is a benign UI library; the replication value is in recognizing social-engineering repackaging patterns.

1. Toolchain: Visual Studio 2019/2022, .NET Framework 4.0, C# WinForms.
2. Build a comparable binary: Create a new WinForms project, add custom user controls with OnPaint overrides and theme dictionaries. Build in Debug configuration to preserve DebuggableAttribute.
3. Verification: Run capa <your.exe> and observe T1620 / T1497.001 false positives. Compare to this sample's capa.txt — the same generic .NET reflection attributes will trigger.
4. What you'll learn: How easily unobfuscated .NET apps are flagged by static capability tools, and why analyst judgement is required before treating capa ATT&CK mappings as ground truth.

Deployable Signatures

YARA Rule

rule FSC_UI_Repackaged_Quote_Lure {
    meta:
        description = "Detects FSC UI .NET WinForms library repackaged with social-engineering filenames"
        author = "PacketPursuit"
        date = "2026-06-26"
        sha256 = "e04d46ff3726afd45a2181347c64b088f9500d242eda127959a1462daa4db84e"
    strings:
        $fsc_ui = "FSC UI" wide ascii
        $fsc_ns = "FSC_UI" wide ascii
        $nziu = "NZiU.exe" wide ascii
        $pdb = "NZiU.pdb" ascii
        $theme1 = "LoadDefaultDarkTheme" wide ascii
        $theme2 = "LoadDefaultLightTheme" wide ascii
        $theme3 = "ThemeLoader" wide ascii
        $theme4 = "ThemeBuilder" wide ascii
        $hash = "7D037A876D9C65AD35B2C7802BEE3402CE7A4D85F98B8B63413AA8E184010DC3" ascii
        $dotnet = ".NETFramework,Version=v4.0" wide ascii
    condition:
        uint16(0) == 0x5A4D and
        $dotnet and
        3 of ($fsc_ui, $fsc_ns, $nziu, $pdb, $theme1, $theme2, $theme3, $theme4) and
        filesize < 1MB
}

IOC List

Behavioral Fingerprint Statement

This binary is a .NET Framework 4.0 WinForms GUI application with no network, persistence, injection, or crypto APIs. It loads mscoree.dll via standard .NET PE bootstrap, initializes custom-themed UI controls (FSCButton, FSCToggle, FSCPanel, FSCMessageBox), and presents an MDI parent shell with menu-strip and tool-strip surfaces. Capa may flag T1620 (reflective code loading) and T1497.001 (VM detection) due to compiler-generated DebuggerBrowsableState and Activator references — these are false positives. The only anomalous static artifact is a hardcoded 64-character SHA256 hex string in the #Strings metadata stream, whose purpose is unconfirmed without dynamic execution.

Detection Signatures

References

• unclassified-dotnet — Umbrella entity for unattributed .NET Framework PE32/PE32+ binaries
• social-engineering-filename-lure — Concept: professional-context filename themes to exploit urgency
• version-info-masquerade — Concept: falsified VS_VERSIONINFO for benign appearance
• Artifact ID: 17ab805a-92d5-46c5-8df5-adc53ff3b963
• Source: MalwareBazaar (abuse.ch) via OpenCTI urlhaus-recent-payloads connector

Provenance

Static analysis performed 2026-06-26 on pp-hermes (Lab1BU). Tools: file (5.45), exiftool (12.76), pefile (Python module), radare2 (cil backend, analysis level 2), capa (static analysis mode), strings (GNU binutils), binwalk (2.3.4), floss (failed — CLI argument parsing error on this .NET binary). No dynamic execution available (CAPE skipped: no Windows guest). Report authored by Demetrian Titus.