unclassified-dotnet: e7aaacbb — .NET Framework educational crypto lab repackaged as DHL shipping lure

Executive Summary

A .NET Framework 4.0 PE32 compiled Sep 2024, distributed in the wild as DHL_Shipping_Documents_&_BL.exe. Metadata strings reveal Vietnamese academic coursework identifiers (Lab06_Bai01, Bai03_Client, GIẢI MÃ, MÃ HÓA CAESAR, Vigenère). The binary is a benign student cryptography/networking lab — Caesar/Vigenère/RSA cipher demo, TCP chat client/server, WinForms GUI — repackaged with a logistics-themed social-engineering filename. No packing, no obfuscation, no persistence, no C2 beaconing, and no anti-analysis. Static-only (CAPE skipped, no Windows guest). Threat is purely social engineering; the payload itself is a low-sophistication educational tool.

What It Is

The PE has three standard sections (.text, .rsrc, .reloc), a tiny IAT pointing only to mscoree.dll!_CorExeMain, and no overlay ^[pefile.txt:76-137] ^[binwalk.txt]. Two Win32 resources exist: RT_VERSION (828 bytes) and RT_MANIFEST (490 bytes); no RT_RCDATA, RT_BITMAP, or encrypted payload blobs ^[pefile.txt:257-329].

How It Works

The binary is a .NET WinForms application containing at least three lab modules inferred from type names in the #Strings metadata stream ^[dotnet-metadata-strings.txt]:

• Lab 06 / Bai 01 — Caesar cipher (CaesarEncrypt, shift, plaintext)
• Lab 06 / Bai 02 — Vigenère cipher (Vigenère, NormalizeKey, key)
• Lab 03 / Bai 03 — TCP client/server chat with RSA encryption (Bai03_Client, Bai03_Server, EncryptData, DecryptData, SendData, ReceiveData, TcpClient, TcpListener)

All cryptographic operations use standard .NET libraries (System.Security.Cryptography.RSACryptoServiceProvider, System.Text.Encoding.UTF8, Convert.ToBase64String / FromBase64String) ^[capa.txt] ^[dotnet-metadata-strings.txt]. The get_LocalIPAddress method enumerates network adapters via System.Net.NetworkInformation.NetworkInterface.GetAllNetworkInterfaces to discover the host's IPv4 address for the chat server ^[capa.txt] ^[dotnet-metadata-strings.txt].

User-interface strings recovered from the #US stream are in Vietnamese:

• Vui lòng nhập đầy đủ thông tin — "Please enter complete information"
• GIẢI MÃ / MÃ HÓA — Decrypt / Encrypt
• Dữ liệu (Input) / Dịch (shift) — Data / Shift
• Server started, waiting for clients... / Client connected.

These are consistent with a university programming assignment, not a crimeware builder. The threat actor's entire contribution is the social-engineering filename (DHL_Shipping_Documents_&_BL.exe).

Decompiled Behavior

Because the binary is pure CIL with no native obfuscation, radare2 analysis at level 2 recovers 375 CIL functions ^[r2:analysis-log]. The entry point is _CorExeMain via mscoree.dll; all behavior lives in the CLR metadata. Key type references from the #~ metadata stream:

• Bai03_Client — WinForms chat client with RSACryptoServiceProvider, TcpClient, NetworkStream, Thread
• Bai03_Server — WinForms chat server with TcpListener, IPAddress.Parse, ParameterizedThreadStart
• Lab06_Bai01 / Lab06_Bai02 / Lab06_Bai03 — Cryptography labs
• CustomDecode — A simple string-decode helper (Trif32, EIK methods)
• Form1 / Control_Viewer — Main GUI shell

No Process.Start with suspicious arguments, no WebClient/HttpWebRequest, no Registry set-value calls, no ScheduledTask or ServiceInstaller references. The File.WriteAllText and SaveFileDialog / OpenFileDialog imports are used for saving/loading key files (key.txt) and encrypted messages ^[dotnet-metadata-strings.txt] ^[capa.txt].

C2 Infrastructure

None. The TcpClient and TcpListener classes are used for a local peer-to-peer chat demo; no hardcoded IP addresses, domains, or URLs exist in the metadata or strings ^[strings.txt] ^[dotnet-metadata-strings.txt]. CAPE was skipped (no Windows guest), so no runtime network behavior was observed ^[dynamic-analysis.md].

Interesting Tidbits

• Academic provenance. The Lab06_Bai01 naming convention (Bai = Vietnamese for "exercise/lesson") and the Caesar/Vigenère/RSA curriculum strongly suggest a Vietnamese university IT or cybersecurity fundamentals course. The build date (Sep 2024) fits a fall semester.
• Zero opsec. No ConfuserEx, no SmartAssembly, no string encryption, no anti-debug, no VM checks. The binary is as unobfuscated as a default Visual Studio Release build.
• Masquerade mismatch. The version info claims "Object Control Viewer" / hzXG.exe; the filename claims DHL shipping documents; the internals reveal a school lab. Three different identities in one file.
• Bitmap resource pjgz. The assembly embeds a Properties.Resources.pjgz Bitmap (likely a project logo or school flag) via the .NET ResourceManager; it is not a steganographic payload carrier like the unclassified-dotnet-bitmap-stego-loader family ^[dotnet-metadata-strings.txt].
• No persistence or staging. No registry Run keys, no scheduled tasks, no startup folder references, no WMI event subscriptions, no AutoRun or Shell modifications.

How To Mess With It (Homelab Replication)

1. Toolchain: Visual Studio 2022 Community, .NET Framework 4.8, C# WinForms App.
2. Build: Create a new Windows Forms App (.NET Framework), add TabControl with three tabs — Caesar, Vigenère, and RSA Chat.
3. Caesar: char shifted = (char)(((c - base + shift) % 26) + base);
4. Vigenère: Repeat-key normalization with key[i % key.Length].
5. RSA Chat: RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(2048); Export public key to XML, share via TCP NetworkStream.
6. Compile: Release | Any CPU. Observe the resulting PE is ~650 KB with near-identical capa hits (TCP client/server, RSA, Base64, thread create).
7. Verification: Run capa repro.exe — should hit communication/tcp/client, data-manipulation/encryption/rsa, data-manipulation/encoding/base64, host-interaction/thread/create. Compare to this sample's capa.txt.

Deployable Signatures

YARA rule

rule UnclassifiedDotNet_EducationalCryptoLab_LowConfidence
{
    meta:
        description = "Detects unobfuscated .NET PE32 with Vietnamese academic crypto-lab metadata"
        author = "PacketPursuit SOC"
        date = "2026-06-18"
        sha256 = "e7aaacbb08fd0702c552169ce55065e51e1cfb55404509851592c3019fb15927"
    strings:
        $lab01 = "Lab06_Bai01" ascii wide
        $lab02 = "Lab06_Bai02" ascii wide
        $lab03 = "Lab06_Bai03" ascii wide
        $bai_client = "Bai03_Client" ascii wide
        $bai_server = "Bai03_Server" ascii wide
        $caesar = "CaesarEncrypt" ascii wide
        $vigenere = "Vigenere" ascii wide
        $rsa_encrypt = "EncryptData" ascii wide
        $rsa_decrypt = "DecryptData" ascii wide
        $tcp_client = "TcpClient" ascii wide
        $tcp_listener = "TcpListener" ascii wide
        $viet_hint1 = "Vui l" wide
        $viet_hint2 = "GIẢI MÃ" wide
        $viet_hint3 = "MÃ HÓA" wide
        $mscoree = "mscoree.dll" ascii
    condition:
        uint16(0) == 0x5A4D and
        pe.imports("mscoree.dll", "_CorExeMain") and
        (
            4 of ($lab*) or
            3 of ($bai*) or
            (1 of ($caesar,$vigenere) and 1 of ($rsa_encrypt,$rsa_decrypt) and 1 of ($tcp_client,$tcp_listener))
        ) and
        filesize < 2MB
}

Behavioral fingerprint statement

This binary is a .NET Framework WinForms PE32 with unobfuscated CIL metadata containing academic cryptography and TCP networking class names (CaesarEncrypt, Vigenère, EncryptData, DecryptData, TcpClient, TcpListener). It launches as a GUI application, does not beacon externally, does not write to registry Run keys, and does not spawn child processes. Any network traffic is limited to local-loopback or manually-entered peer IP addresses within a WinForms chat tab.

IOC list

Detection Signatures

capa → ATT&CK mapping

All ATT&CK mappings are low-confidence because the capabilities serve a benign educational purpose. The only malicious dimension is social engineering (T1566.001 Phishing: Spearphishing Attachment).

References

• Artifact ID: b3dfdb02-fe5f-4777-a3e2-77e6477de244 ^[metadata.json]
• Source: OpenCTI / MalwareBazaar (labels: exe, malware-bazaar) ^[triage.json]
• Related wiki pages: unclassified-dotnet-game (comparative .NET masquerade, not the same family)

Provenance

• file.txt — file(1) output
• pefile.txt — pefile Python library header/resource/section dump
• rabin2-info.txt — radare2 rabin2 -I summary
• exiftool.json — ExifTool PE metadata
• capa.txt — Mandiant flare-capa v7 (static analysis)
• strings.txt — strings(1) ASCII/Unicode extraction
• dotnet-metadata-strings.txt — Custom pefile + struct parser for .NET CLR #Strings and #US streams
• floss.txt — flare-floss (errored out due to CLI argument misparse; not used)
• dynamic-analysis.md — CAPE sandbox status (skipped, no Windows guest)
• binwalk.txt — binwalk surface scan (no embedded archives)