> Analysis · f9a1fc01119e_

~/packetpursuit $ cat /intel/analyses/f9a1fc01119e.../report.md

typeanalysisfamilyunclassified-dotnetconfidencehigh
SHA-256: f9a1fc01119ed1cc7a5464cc4df2d3f0dea09f8227c6ba101c77c73f6c379214

Analysis Report: f9a1fc01119ed1cc7a5464cc4df2d3f0dea09f8227c6ba101c77c73f6c379214

Sample: Investec_-_Proof_of_payment_from_Phluid.bat.exe
SHA-256: f9a1fc01119ed1cc7a5464cc4df2d3f0dea09f8227c6ba101c77c73f6c379214
Size: 733,184 bytes (717 KB)
Platform: Windows GUI .NET Framework 4.0

1. Build / RE

Toolchain & Metadata

  • Language / Runtime: .NET Framework v4.0.30319, CIL (MSIL) assembly. Compiled Mon Sep 2 07:48:54 2024 UTC. ^[file.txt] ^[rabin2-info.txt]
  • Linker: Microsoft Linker v48.0. ^[exiftool.json]
  • Assembly Name: ComboBoxBind (namespace ComboBoxBind). Internal / original filename: mSmo.exe. ^[strings.txt:40] ^[strings.txt:84] ^[exiftool.json]
  • Version: 1.0.9011.19466. Copyright string: "Copyright 2019". ^[exiftool.json]
  • PDB: mSmo.pdb — benign developer artifact, no path leakage. ^[rabin2-info.txt]

Packing & Obfuscation

  • None detected. No ConfuserEx, SmartAssembly, Dotfuscator, or custom packer signatures. Strings are fully readable. ^[strings.txt] ^[capa.txt]
  • No native packing: PE sections .text (entropy 7.80 — normal for managed CIL), .rsrc, .reloc. ^[pefile.txt]
  • No CAPE detonation: skipped because no Windows guest available. Dynamic behavior is unobserved; static inference only. ^[dynamic-analysis.md]

Code Structure

  • Entry classes: ComboBoxBind.Program (STAThread), ComboBoxBind.MainForm, ComboBoxBind.PanelForm, ComboBoxBind.SettingsForm, ComboBoxBind.UsersForm. ^[strings.txt:108-112]
  • UI controls: Standard WinForms — radioButton, button, numericUpDown, progressBar, pictureBox, checkBox, comboBox, groupBox, checkedListBox, textBox. ^[strings.txt:9-18]
  • Notable methods:
    • MainFormLoad — form initialization. ^[strings.txt:34]
    • MainFormPaint — custom Paint event handler. ^[strings.txt:179]
    • button1_Click — click handler. ^[strings.txt:100]
    • RadioButton1CheckedChanged — radio-button state change. ^[strings.txt:35]
    • Trif32 / AddBufferToData — present in strings but Ghidra decompilation yields garbage (CIL thunk / unreachable block artifacts). Not actionable. ^[ghidra:AddBufferToData-00402cf8]

Anti-Analysis

  • Absent. No debug checks, VM detection, or anti-disassembly tricks. ^[strings.txt]
  • Capa flags: T1620 (reflective code loading) and B0013.001 (analysis tool discovery) — both false positives from standard .NET JIT / compile-time infrastructure. ^[capa.txt]

Signing

  • Unsigned. signed: false per radare2; checksum 0x00000000. ^[rabin2-info.txt]

Embedded Resources

  • Standard .NET manifest resources for each form (ComboBoxBind.MainForm.resources, etc.) and Properties.Resources. ^[strings.txt:150-154]
  • No encrypted blob, no shellcode overlay, no steganographic carrier. ^[binwalk.txt] confirms only PE + version resource + manifest.

2. Deploy / ATT&CK

TTP Mapping

Technique ID Evidence Confidence
Masquerading T1036 Filename Investec_-_Proof_of_payment_from_Phluid.bat.exe impersonates a bank payment proof. high
Double Extension T1036.007 .bat.exe — user sees .bat, Windows executes PE. high
Ingress Tool Transfer T1105 Distribution vector (banking-themed email / Web portal). Inferred from filename only. low

Persistence

  • None observed. No registry Run keys, scheduled tasks, services, or startup folder references in strings. Static-only; cannot rule out runtime behavior, but absence of any persistence API strings makes it unlikely. ^[strings.txt]

C2 / Comms

  • None observed. No HttpClient, WebClient, TcpClient, sockets, DNS resolution, SMTP, or any network API strings. ^[strings.txt]
  • No hardcoded URLs, IPs, or domains. ^[strings.txt]

Payload / Effect

  • Benign .NET WinForms application. The binary implements a color-picker / combo-box binding demo (ComboBoxBind, ShowPropertiesOfSlateBlue, DisplayKnownColors, KnownColorClass). ^[strings.txt:83,168,169,198]
  • No process injection, no credential harvesting, no file encryption, no data exfiltration. The threat is purely social engineering — a legitimate-ish program wrapped in a banking lure filename.

Attribution

  • None. No language markers, no builder watermark, no code-family overlap with known malware. Generic .NET WinForms demo code. Compiler timestamp (Sep 2024) is the only temporal anchor.
  • Filename pattern: "Investec" (South African bank) + "Proof_of_payment" + .bat.exe double extension. Consistent with commodity phishing / social-engineering distribution, not a targeted APT.

3. Verdict

Unattributed .NET Framework social-engineering dropper — empty payload.

The binary itself is a benign WinForms UI demo (ComboBoxBind / mSmo.exe). The only malicious attribute is its distribution filename: a bank-themed double-extension lure designed to trick victims into executing a PE while believing they are opening a batch file or document. No C2, no persistence, no payload. The actor’s intent was likely to deliver this as a stage-1 dropper; however, the sample we hold appears to be the decoy shell without the stage-2 attached, or the stage-2 was intended to be fetched / dropped by a separate component.

Confidence: High for the static characterization. Low for any dynamic behavior — CAPE did not execute. If a Windows guest becomes available, recommend re-queuing for behavioral confirmation.

References