> Family · unclassified-dotnet-chess-engine_

~/packetpursuit $ cat /intel/families/unclassified-dotnet-chess-engine.md

typeentityconfidencelowcreated2026-07-07updated2026-07-11dotnetsigningobfuscationsocial-engineering-filename-luredouble-extension-masqueraderesearch-target

unclassified-dotnet-chess-engine

Umbrella entity for signed .NET Framework PE32 binaries that present as legitimate games or utilities (chess engines, arcade games, inventory apps) but are distributed under fraudulent filenames designed to exploit professional context (payment documents, purchase orders, PDF lures). The binaries themselves are often benign or minimally functional applications whose threat is entirely social-engineering delivery.

Build Stack

  • Runtime: .NET Framework 4.0 (metadata version v4.0.30319) ^[rabin2-info.txt]
  • Platform target: x86, ILONLY=1, 32BITREQUIRED=1 ^[rabin2-info.txt]
  • Linker: MSVC Linker 8.0 ^[exiftool.json]
  • Obfuscation: Georgian Unicode character name mangling (Ⴈ, Ⴐ, Ⴃ, Ⴗ, Ⴄ) on UI wrapper methods; likely Obfuscar or ConfuserEx ^[rabin2 class output]
  • Signing: Valid Authenticode (Comodo / Sectigo / UserTrust chain) ^[rabin2-info.txt]
  • P/Invoke surface: None (single import mscoree.dll._CorExeMain) ^[pefile.txt]

Observed Variants

SHA-256 (prefix) Lure filename Game / App identity Notes
7d18d78c 160820242003464366.pdf.exe Sachy_Obrazky (Czech "Chess Pictures") WinForMono bitboard engine; Georgian obfuscation on UI layer; signed.
337c323b University_of_Bahrain-_Project_FMD20240942.exe Sachy_Obrazky (same as above) Second confirmed sibling; academic-document lure; compiled ~1h 39m earlier same day. OpenCTI false-positive formbook label.

Capabilities

  • social-engineering-filename-lure
  • double-extension-masquerade
  • valid-authenticode-signing
  • dotnet-ilonly-32bit
  • georgian-unicode-name-obfuscation
  • winforms-ui-wrapper

TTPs

ATT&CK Technique Evidence Confidence
T1036.007 — Double Extension .pdf.exe filename High
T1589.001 — Social Engineering Professional-context lure High
T1620 — Reflective Code Loading capa false positive (.NET JIT / reflection) Low

Detection

YARA — See deployable signature in 7d18d78c analysis report. Rule keys on WinForMono.Engine namespace, chess method names (MoveGeneration_White, Castling_White), and Georgian Unicode method names.

Behavioral fingerprint: .NET Framework 4.0 x86 PE, single mscoree.dll import, valid Comodo/Sectigo Authenticode, VS_VERSIONINFO claiming a benign foreign-language product name, and no P/Invoke / network / crypto API surface. The .pdf.exe double-extension is the primary threat indicator.

Related