unclassified-dotnet: 000d931f — Third confirmed Pizzaria POS sibling (PO#86637_copy.exe)

Executive Summary .NET Framework 4.0 WinForms point-of-sale / CRM application for a Brazilian pizza restaurant (Pizzaria_Management_VIEW), identical payload to siblings 7b3ef687 and 5ea6b79d. Distributed as PO#86637_copy.exe (purchase-order social-engineering lure). No network APIs, no persistence, no anti-analysis, no payload. capa T1213 / T1620 / B0013.001 flags are false positives from benign System.Data.SqlClient and Debug-build compiler-generated attributes. Third confirmed sibling in the Pizzaria cluster. Unsigned. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

How It Works

Standard .NET Framework 4.0 Windows Forms GUI application implementing a pizza-restaurant management system. Namespace Pizzaria_Management_VIEW contains forms for customer registration (CadCliente, GerenciamentoCadastro), order management (CadPedido, GerenciamentoPedido), product/stock control (CadProduto, GerenciamentoEstoque), and employee management (CadFuncionario). ^[strings.txt:53-125]

Database layer: ClienteDAL (Data Access Layer) under DAL.Model namespace exposes BuscarClientePorID, ListarClientes, InserirCliente, AtualizarCliente, ExcluirCliente using System.Data.SqlClient (SqlConnection, SqlCommand, SqlDataReader, SqlParameter). ^[strings.txt:54-56] ^[strings.txt:78-80] ^[strings.txt:221] ^[strings.txt:251-253] ^[strings.txt:288-290]

UI layer: Full WinForms MDI application with TabControl, MenuStrip, DataGridView, PictureBox, DateTimePicker, MaskedTextBox, and ComboBox controls. ^[strings.txt:12-50] Portuguese-language menu items (pedido, produto, estoque, login, funcionário, cadastro, gerenciamento, data). ^[strings.txt:163-200]

Embedded resources: Multiple .resources blobs for each form (Pizzaria_Management_VIEW.CadCliente.resources, etc.) plus a Properties.Resources.resources icon/data bundle. ^[strings.txt:274-283] Binwalk confirms four embedded PNG images (256×256, 400×226, 256×256, 508×508). ^[binwalk.txt]

String decoder: Trif32 method at strings.txt line 27 is the trivial Caesar-shift-23 decoder shared across the PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint/Pizzaria coursework cluster. Likely decodes an embedded SQL connection string or localized UI string block. No cryptographic sophistication. ^[strings.txt:27]

Build / RE

Toolchain: Visual Studio 2019/2022 Community, .NET Framework 4.0, C# WinForms Application template, IL linker v48.0. ^[exiftool.json:18] ^[strings.txt:316] InitializeComponent present (standard VS designer output). ^[strings.txt:316]

Packing / obfuscation: None. Single-section .text with entropy 7.96, no packer signatures, no obfuscator artifacts. ^[pefile.txt:92] No SmartAssembly, ConfuserEx, or Xenocode markers. No control-flow flattening, no string encryption beyond the trivial Trif32 decoder.

Anti-analysis: None. No debug checks, no VM detection, no time-bombs, no process enumeration. No System.Diagnostics.Debugger references. No IsDebuggerPresent. No AmsiScanBuffer / AmsiOpenSession. ^[strings.txt] ^[floss.txt] (floss errored on invocation — no decoded strings extracted).

Code quality: Designer-generated WinForms with hand-written ClienteDAL data-access layer. Student-grade or small-business quality. Consistent with a Visual Studio drag-and-drop CRUD tutorial application.

Signing: Unsigned. No Authenticode certificate. PE checksum invalid (0x0). ^[rabin2-info.txt] Not a stolen-certificate sibling (unlike 5ea6b79d).

Notable functions: radare2 level-3 analysis yielded 195 functions — all standard .NET method stubs and compiler-generated attributes. ^[r2:analysis.log] The only import is mscoree.dll!_CorExeMain (standard .NET bootstrap). No P/Invoke signatures, no native API calls, no DllImport attributes. No suspicious control-flow patterns.

Deploy / ATT&CK

Persistence: None. No registry writes, no scheduled tasks, no startup-folder placement, no service creation. No Microsoft.Win32.Registry persistence APIs. ^[strings.txt]

C2 / Network: None. Zero System.Net, System.Net.Sockets, System.Net.Http, System.Net.WebClient, System.Net.Mail, or System.IO.Pipes references. No hardcoded URLs, IPs, domains, or C2 infrastructure. ^[strings.txt] ^[pefile.txt] ^[r2:imports]

Lateral movement / exfil: None. No file-sharing APIs, no WMI, no PsExec, no RDP APIs, no COM/DCOM remoting.

capa → MITRE ATT&CK mapping (with false-positive annotations)

Attribution: None. Brazilian Portuguese UI strings (pedido, produto, funcionário, estoque, gerenciamento) and Valey Silicone developer/company name in VS_VERSIONINFO suggest Brazilian origin. ^[strings.txt:163-200] No code-reuse overlaps with known malware families. The distribution filename (PO#86637_copy.exe) follows the purchase-order social-engineering pattern observed across 40+ samples in the unclassified-dotnet cluster. The _copy suffix suggests manual filename modification by the distributor.

Dynamic behavior: CAPE skipped — no Windows guest available. Static-only inference. No reason to expect any runtime behavior beyond launching the WinForms MDI application and attempting SQL Server connection on form load.

Interesting Tidbits

• Third confirmed sibling — payload is byte-for-byte identical (or near-identical) to 7b3ef687 and 5ea6b79d (same Pizzaria_Management_VIEW namespace, same ClienteDAL method names, same Trif32 decoder, same Portuguese menu strings, same embedded PNG resources). The only meaningful deltas are: (1) internal name (Euiz.exe vs DzAz.exe vs Yhdk.exe), (2) distribution filename (PO#86637_copy.exe vs products-list.exe vs 52oTaV20K4bWnvN.exe), and (3) signing status (unsigned vs unsigned vs stolen Simon Tatham certificate). ^[strings.txt] ^[pefile.txt]
• No PDB path — like sibling 7b3ef687, no PDB reference in strings. Suggests Release build or PDB stripping before distribution.
• Plausible timestamp — 2024-07-30 02:06:30 UTC is consistent with the Jul 2024 build date of the cluster. Not future-dated or fabricated.
• floss failure — flare-floss errored on invocation (invalid choice argument parsing), producing no decoded strings. The .NET strings are already visible in plaintext; floss offers no advantage over strings -el for CIL metadata. ^[floss.txt]

Sibling Comparison

Deployable Signatures

YARA rule

rule PizzariaVIEW_Benign_DotNet
{
    meta:
        description = "Brazilian pizza-shop POS/CRM .NET WinForms application (benign, false-positive prone)"
        author = "PacketPursuit"
        hash = "000d931f8f76a4fc9ba255cbc972e03f58d3e49bcdd6008094ac0dc2e4fe25a6"
        date = "2026-07-15"

    strings:
        $ns1 = "Pizzaria_Management_VIEW" ascii wide
        $ns2 = "ClienteDAL" ascii wide
        $ns3 = "BuscarClientePorID" ascii wide
        $ns4 = "CadCliente" ascii wide
        $ns5 = "CadPedido" ascii wide
        $ns6 = "CadProduto" ascii wide
        $ns7 = "GerenciamentoCadastro" ascii wide
        $ns8 = "GerenciamentoPedido" ascii wide
        $ns9 = "GerenciamentoEstoque" ascii wide
        $vi1 = "Pizzaria VIEW" ascii wide
        $vi2 = "Valey Silicone" ascii wide
        $trif = "Trif32" ascii wide
        $dotnet = "v4.0.30319" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        ($dotnet or $trif) and
        (2 of ($ns*) or $vi1 or $vi2)
}

IOC list

References

• Artifact ID: f73b76ea-a89d-47be-9e74-edc2e3266f7b ^[metadata.json]
• Source: OpenCTI / MalwareBazaar
• Related wiki: unclassified-dotnet
• Related concepts: social-engineering-filename-lure, social-engineering-purchase-order-masquerade, trif32-caesar-shift-23-decoder, debug-build-capa-false-positives

Provenance

Analysis produced from:

• file.txt, exiftool.json, pefile.txt, strings.txt, ssdeep.txt, tlsh.txt, yara.txt, metadata.json, triage.json — automated triage pipeline (May 2026)
• floss.txt — FireEye flare-floss (errored on argument parsing, no decoded strings) ^[floss.txt]
• capa.txt — Mandiant flare-capa static analysis ^[capa.txt]
• binwalk.txt — embedded artefact scan ^[binwalk.txt]
• rabin2-info.txt — radare2 binary header summary ^[rabin2-info.txt]
• dynamic-analysis.md — CAPE skipped (no Windows guest available) ^[dynamic-analysis.md]
• radare2 level-3 analysis (195 functions, 1 import, no suspicious patterns)
• Python byte-scan for network indicators, Base64 blocks, and P/Invoke signatures (negative)