avalancherunner: f7352bc1 — Third confirmed sibling, bomb-defusal skin, PDF-masquerade version info

Executive Summary

A .NET Framework 4.5 PE32 binary masquerading as a "PDF FILE PREVIEWER" but delivered with the filename z1EDG0012026051400140040_1669_pdf.bat. It is the third confirmed sibling of the avalancherunner cluster, sharing the anomalous Survey_Cadastral_Transect method name, identical compiler toolchain, and unobfuscated C# WinForms build quality with prior siblings 1a38a948 (May 2020) and 2d9f8c6e (Dec 2022). Notable delta: this sample uses a BombaZarasizlantiruvchi (Uzbek "Bomb Defuser") game namespace instead of AvalancheRunner, carries a "PDF FILE PREVIEWER" VS_VERSIONINFO masquerade, and lacks both the Shifrlash/Deshifrlash encryption routines and the ~952 KB encrypted CLR resource blob observed in the earlier siblings. Capa still flags reflective code loading (T1620). No CAPE detonation possible (no Windows guest). Low-confidence family attribution — treated as AvalancheRunner sibling due to shared build pipeline and anomalous method.

What It Is

Version-info masquerade

The VS_VERSIONINFO block claims ^[exiftool.json:36-45] ^[pefile.txt:233-243]:

• ProductName / FileDescription / Comments / CompanyName: PDF FILE PREVIEWER Google Translation DESKTOP OPENNER
• InternalName / OriginalFilename: rFks.exe
• LegalCopyright / LegalTrademarks: PDF FILE PREVIEWER Google Translation DESKTOP OPENNER COPYRIGHT 2011 FOR xIMUsOFT.
• GUID: b81fc497-bdca-4c62-b716-8668f0e98a54

The filename z1EDG0012026051400140040_1669_pdf.bat directly contradicts the version-info identity — a classic social-engineering lure. See version-info-masquerade.

How It Works

Outer shell — decoy game UI

The binary is a standard C# WinForms application with three forms (FormKiris, FormOyin, FormNatija) and a Program entry point. Class and method names are in Uzbek:

• BombaZarasizlantiruvchi — Bomb Defuser (namespace)
• BombaMantiqi — Bomb Logic
• KashfEtish — Discover / Reveal
• Portlash — Explode
• Galaba — Victory
• JarimaBering — Give Penalty
• SimniKes — Cut the Wire
• KodniKirit — Enter the Code
• MatematikaniYech — Solve the Math
• OyinTarixiKhizmati — Game History Service

These names are unobfuscated and visible in plain IL metadata. ^[strings.txt:44, 196-215, 231-250, 262-280]

Embedded resources

Four standard CLR .resources files are referenced:

• BombaZarasizlantiruvchi.FormNatija.resources
• BombaZarasizlantiruvchi.FormOyin.resources
• BombaZarasizlantiruvchi.Properties.Resources.resources
• BombaZarasizlantiruvchi.FormKiris.resources ^[strings.txt:394-397]

Binwalk identifies a 596×644 PNG image and zlib-compressed data inside the binary. ^[binwalk.txt:7-8] There is no large encrypted CLR resource blob (~952 KB) like the CKT resource in siblings 1a38a948 and 2d9f8c6e. The .rsrc section is only 0x880 bytes (2,176 bytes) with low entropy (3.73). ^[pefile.txt:99-116]

Absence of encryption routines

Unlike prior AvalancheRunner siblings, this sample contains no Shifrlash (Encrypt), Deshifrlash (Decrypt), ShifrlashSatr, DeshifrlashSatr, or ObfKalit (Obfuscation Key) method names. ^[strings.txt] This is a significant family delta — the custom managed cipher present in the first two siblings has been removed or never existed in this build branch.

Reflective loading indicator

Capa flags remain consistent with the family:

• invoke .NET assembly method (2 matches)
• load .NET assembly
• access .NET resource ^[capa.txt:38-40]
• compiled to the .NET platform
• reference analysis tools strings (anti-analysis) ^[capa.txt:31]

These suggest the binary may still load managed assemblies dynamically, but without the encrypted blob, the mechanism is unclear — possibly from the smaller embedded resources or from runtime-generated IL.

Suspicious method name

Survey_Cadastral_Transect appears inside FormKiris at RVA 0x00402a58 ^[strings.txt:440] ^[r2:method.BombaZarasizlantiruvchi.FormKiris.Survey_Cadastral_Transect]. In a game binary, a method referencing land-survey terminology is anomalous and may be a hidden trigger or the actual payload execution routine masked behind an innocuous-looking compiler-generated name. This is the third sibling to carry this exact method name.

Decompiled Behavior

Radare2 analysis (level 2) recovered 206 managed methods. ^[rabin2-info.txt] The entry point is entry0 at 0x00407704. Notable method RVAs include:

• FormKiris.Survey_Cadastral_Transect @ 0x00402a58
• FormKiris.StatistikaniYangilash @ 0x00402a64
• FormKiris.btnBoshlash_Click @ 0x00402bf0
• FormOyin.FormOyin_Load @ 0x004037bc
• FormOyin.OnSekundOtdi @ 0x00403930
• FormOyin.OnNotogriHarakat @ 0x00403a10
• FormOyin.OnBombaPortladi @ 0x00403c54
• FormOyin.btnSimKes_Click @ 0x00403db0
• FormOyin.btnKodKirit_Click @ 0x00403f1c
• FormNatija.pnlVisualNatija_Paint @ 0x00406d2c

All bodies are managed IL; radare2's x86 disassembly produces noise for CIL opcodes. The control flow is standard WinForms event-driven architecture with timer ticks, button clicks, and paint handlers.

C2 Infrastructure

No network indicators recovered. Zero System.Net, WebClient, HttpWebRequest, Socket, Mail, or Process.Start with URL arguments present. ^[strings.txt] Static-only inference; a dynamic trace would be required to confirm absence of runtime-resolved C2.

Interesting Tidbits

• Third sibling with identical anomalous method: Survey_Cadastral_Transect now appears in three samples spanning 2020–2026. This is not compiler noise — it is a deliberate, recurring identifier. ^[strings.txt:440]
• Version-info quality decline: The first sibling claimed "Antigravity" (a plausible game studio); this sample claims "PDF FILE PREVIEWER Google Translation DESKTOP OPENNER COPYRIGHT 2011 FOR xIMUsOFT" — nonsensical, poorly translated, and clearly fabricated. ^[exiftool.json:36-45]
• Smallest sibling: 842 KB vs 993 KB (1a38a948) and 1.04 MB (2d9f8c6e). The ~150–200 KB delta is the missing encrypted CLR resource blob. ^[metadata.json]
• No anti-analysis: No debugger checks, no VM detection, no sandbox evasion, no TLS callbacks. The binary is fully analyst-friendly. ^[capa.txt]
• FLOSS failure: The floss run failed due to incorrect CLI arguments (--no flag misuse), yielding no decoded strings. ^[floss.txt:1-6] This is a pipeline bug, not a sample property.

How To Mess With It (Homelab Replication)

Toolchain

• Visual Studio 2019 or 2022, C# WinForms project targeting .NET Framework 4.5
• No obfuscator, no packer

Build recipe

1. Create a new C# Windows Forms App (.NET Framework 4.5)
2. Add three forms: FormKiris (login/start), FormOyin (game), FormNatija (results)
3. Add a BombaMantiqi class with event-driven game logic (SekundOtdi, BombaPortladi, GalabaQozonildi, NotogriHarakat)
4. Add a Survey_Cadastral_Transect method inside FormKiris (any content — the name is the fingerprint)
5. Set VS_VERSIONINFO to nonsensical strings like "PDF FILE PREVIEWER Google Translation DESKTOP OPENNER"
6. Build Release x86

Verification step

Run capa <reproducer.exe> and compare to this sample's capa.txt — should hit:

• compiled to the .NET platform
• invoke .NET assembly method
• access .NET resource
• check if file exists

What you'll learn

How a benign .NET WinForms game compiles to a PE with the same static fingerprint as a suspected loader — and why capa's .NET reflective-loading heuristics produce false positives on any assembly with Assembly.Load-like patterns.

Deployable Signatures

YARA rule

rule AvalancheRunner_BombaZarasizlantiruvchi_Sibling
{
    meta:
        description = "AvalancheRunner third sibling — Bomb Defuser skin with Survey_Cadastral_Transect"
        author = "Demetrian Titus"
        date = "2026-06-16"
        hash = "f7352bc1213a3464d7abb529acfdfb8a6e272e77a8e8f88236ca70192635d02d"
        family = "avalancherunner"

    strings:
        $s1 = "BombaZarasizlantiruvchi" ascii wide
        $s2 = "Survey_Cadastral_Transect" ascii wide
        $s3 = "PDF FILE PREVIEWER Google Translation DESKTOP OPENNER" ascii wide
        $s4 = "rFks.exe" ascii wide
        $s5 = "xIMUsOFT" ascii wide
        $s6 = "BombaMantiqi" ascii wide
        $s7 = "MatematikaniYech" ascii wide
        $s8 = "SimniKes" ascii wide
        $s9 = "OyinTarixiKhizmati" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections == 3 and
        pe.imports("mscoree.dll", "_CorExeMain") and
        4 of ($s*)
}

Behavioral fingerprint statement

This binary is a .NET Framework 4.5 PE32 GUI executable with three sections, a single import (mscoree.dll._CorExeMain), no packing, and no obfuscation. It presents a C# WinForms game UI with Uzbek-language strings (bomb-defusal theme) and contains the anomalous method name Survey_Cadastral_Transect. The version-info block claims a nonsensical "PDF FILE PREVIEWER" identity that contradicts the banking-themed filename. No encrypted CLR resource blob is present (unlike prior siblings), and no Shifrlash/Deshifrlash encryption routines are observable. Capa flags reflective .NET assembly loading and file-existence checks. No network, persistence, or process-injection indicators are recovered statically.

IOC list

Detection Signatures

References

• Artifact ID: dd1692b2-5688-4181-9966-c6dc57894deb
• Source: MalwareBazaar via OpenCTI connector
• Sibling analyses: /intel/analyses/1a38a9488cb0c8b1cd817fa2c8bc854eb1a77ebc3adf94a75dbf5d8a4c5bb045.html, /intel/analyses/2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.html
• Entity page: avalancherunner
• Concept: version-info-masquerade

Provenance

Report drafted from static analysis inputs: file.txt, pefile.txt, strings.txt, capa.txt, floss.txt (failed run), binwalk.txt, rabin2-info.txt, exiftool.json, metadata.json, triage.json. Radare2 analysis level 2 performed live on f7352bc1213a3464d7abb529acfdfb8a6e272e77a8e8f88236ca70192635d02d.bin. No CAPE detonation available (no Windows guest). All TTPs inferred from static evidence.