unclassified-dotnet: 0a0a24fc — Polish stock-charting app with stolen Simon Tatham certificate

Executive Summary

A .NET Framework 4.0 WinForms stock-charting / technical-analysis application (GAD_HW2 namespace, internal name fCGm.exe) signed with the stolen Simon Tatham (PuTTY) COMODO RSA Code Signing CA certificate and distributed as payment_Slip.exe. Polish-language UI (Sprawa, Wykonana, Data, Nazwa, Opis, wyczyscButton) with candlestick/HiLoOpenClose plotting, CSV import, and moving-average overlays. Contains the shared Trif32 Caesar-shift-23 decoder. No System.Net, no P/Invoke, no persistence, no anti-analysis. Tenth confirmed sibling in the stolen-Tatham-cert cluster. Threat is purely social-engineering masquerade plus stolen Authenticode lending false legitimacy.

What It Is

• SHA-256: 0a0a24fc88ba87cd8c77b6a493547b2dc780f60df1838e7b0ddcc87bb1277680
• File: payment_Slip.exe (distribution filename) / fCGm.exe (internal name)
• Size: 719,880 bytes (≈ 703 KB)
• Format: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, 3 sections ^[file.txt]
• Compiler: .NET Framework v4.0.30319, linker v48.0 ^[pefile.txt]
• Timestamp: Thu Sep 26 04:40:20 2024 UTC ^[pefile.txt]
• Signed: Yes — Authenticode signature present in security directory (0xAC600, size 0x3608) ^[binwalk.txt] ^[pefile.txt]
• Certificate chain: COMODO RSA Certification Authority → COMODO RSA Code Signing CA → CN=Simon Tatham, O=Simon Tatham, L=Cambridge, ST=Cambridgeshire, C=GB — the stolen PuTTY developer certificate. Embedded URL https://www.chiark.greenend.org.uk/~sgtatham/putty/ present in cert attributes. ^[openssl-cert-extract]
• Family: unclassified-dotnet — tenth confirmed sibling in the stolen-Tatham-cert sub-cluster.

How It Works

The binary is a benign Polish-language financial-charting GUI. Its threat value lies entirely in the social-engineering wrapper and stolen certificate:

1. Filename masquerade: Distributed as payment_Slip.exe — a payment/invoice-themed lure targeting finance/procurement employees. ^[triage.json]
2. Version-info masquerade: VS_VERSIONINFO fields are fabricated word-salad: FileDescription: pdf, CompanyName: microsoft, ProductName: exel, LegalTrademarks: zip, FileVersion: 63.055.33.33, OriginalFilename: fCGm.exe. ^[exiftool.json] ^[pefile.txt]
3. Stolen Authenticode: The COMODO RSA Code Signing CA chain with Simon Tatham end-entity gives the binary a trusted publisher appearance, bypassing "unknown publisher" warnings on execution. ^[openssl-cert-extract]
4. No malicious payload: Zero System.Net references, zero P/Invoke, zero registry or persistence APIs, zero anti-debug or anti-VM checks. The application opens a WinForms window, loads a CSV of OHLC data, and renders candlestick / line / bar charts with configurable moving averages. ^[strings.txt:1-500]

Decompiled Behavior

Static analysis (strings + pefile + binwalk) reveals a standard .NET WinForms charting application:

• Namespace: GAD_HW2 (likely "Graficzna Analiza Danych" — Polish for "Graphical Data Analysis") with sub-namespaces GAD_HW2.Properties and GAD_HW2.graph.
• Core classes: Sprawa (case/ticket object with Nazwa, Data, Wykonana, Opis properties), MojeOkienko (custom window/form helper), chart-rendering helpers (GetLargestInRange, GetSmallestInRange, PrintMovingAvg, ProcessBitmap). ^[strings.txt:48] ^[strings.txt:220] ^[strings.txt:78]
• UI surface: Form1 with button1, button_Close, button_HiLoOpenClose, button_CandleSticks, wyczyscButton (clear button), avg1Num/avg2Num/avg3Num numeric inputs, MonthYear combo box, dateTimePicker1, richTextBox1, checkedListBox1. ^[strings.txt:16-34] ^[strings.txt:181]
• Graphics: Heavy System.Drawing usage (DrawImage, DrawLine, DrawLines, FillRectangle, GetPixel, ScaleTransform, TranslateTransform, Brushes, Graphics). ^[strings.txt:77] ^[strings.txt:90] ^[strings.txt:185]
• File I/O: OpenFileDialog, ReadAllLines, GetFileNameWithoutExtension, GetDirectoryName — standard CSV import pipeline. ^[strings.txt:161] ^[strings.txt:262] ^[strings.txt:208]
• Resources: Embedded .resources files (GAD_HW2.Form1.resources, GAD_HW2.graph.resources, GAD_HW2.open.resources, GAD_HW2.Properties.Resources.resources) and multiple PNG icons (256×256, 520×520) plus a 115×115 32-bit bitmap. ^[strings.txt:251-254] ^[binwalk.txt]
• Trif32 decoder: Present in CIL metadata. Shared benign Caesar-shift-23 utility class seen across PrimeraVentana, GoldenCity, MyPaint.Editor, Ivanov_WF_Paint, AdvWinProgHW2, Paint, Lab4CSharp, Pizzaria, Checkers, Hadouken, OkuZ, Inheritance, JapaneseTrainer, and now GAD_HW2 clusters. ^[strings.txt:23]

No Ghidra decompilation was necessary — the binary is unobfuscated CIL with meaningful Polish/English identifiers and no packed or encrypted payload sections.

C2 Infrastructure

None. No hardcoded IPs, domains, URLs, mutexes, named pipes, or registry keys related to C2. No System.Net namespace references. No TcpClient, HttpWebRequest, WebClient, or socket APIs. The only network-related strings are COMODO CRL/OCSP URLs inside the Authenticode certificate block. ^[strings.txt:1-1677]

Interesting Tidbits

• Tenth stolen-Tatham sibling: This sample joins eea0dcbc, c4ee3a31081d, cae7ac1dc419, a1e6dc7a, b4814a17, 724d94aa, 72d8e3b2, 5ea6b79d, and 000d931f (the unsigned Pizzaria sibling, same distribution pipeline) as part of the same social-engineering repackaging cluster. ^[entities/unclassified-dotnet.md]
• Polish financial domain: Unlike the Spanish educational apps (PrimeraVentana, GoldenCity) or Brazilian POS (Pizzaria), this is the first Polish-language financial-analysis tool in the cluster — suggesting the repackager sources benign executables from diverse regional/courseware origins.
• Debug-build false positives: Capa flags T1620 (Reflective Code Loading) and B0013.001 (Analysis Tool Discovery) from DebuggerNonUserCodeAttribute, DebuggableAttribute, and DebuggerBrowsableAttribute — standard Debug-configuration compiler artefacts. ^[capa.txt]
• Floss failure: The floss.txt output shows an invocation error (__main__.py: error: argument --no: invalid choice) — floss was called with incorrect arguments during triage. No decoded strings were recovered. ^[floss.txt]
• Certificate overlap: The exact same PKCS#7 blob structure (COMODO RSA CA → COMODO RSA Code Signing CA → Simon Tatham end-entity + SHA-1 timestamp signer) is byte-identical across all stolen-Tatham siblings, suggesting a single stolen .pfx or exported certificate chain reused by the repackager.

How To Mess With It (Homelab Replication)

1. Build a comparable .NET WinForms charting app: Create a C# WinForms project in Visual Studio targeting .NET Framework 4.0. Add System.Drawing references, an OpenFileDialog, a PictureBox canvas, and simple candlestick-rendering logic from OHLC CSV input.
2. Compile in Debug configuration: This reproduces the capa false-positive profile (T1620/B0013.001 from Debug attributes).
3. Add a Trif32 decoder: Implement a static Trif32.Decode(string input) method that shifts each character by +23 (or −3) in ASCII. This matches the cluster fingerprint.
4. Fabricate VS_VERSIONINFO: Use a resource editor to set nonsense fields (FileDescription: pdf, CompanyName: microsoft, ProductName: exel).
5. Sign with a test certificate: Generate a self-signed code-signing cert with makecert or New-SelfSignedCertificate to observe Authenticode validation behavior (note: this will NOT reproduce the stolen CA chain).
6. Verify: Run capa on the built binary. Expect T1620 and B0013.001 false positives. No network or persistence capabilities should surface.

Deployable Signatures

YARA rule — GAD_HW2 Polish charting app + stolen Tatham cert cluster

rule unclassified_dotnet_gad_hw2_stolen_tatham
{
    meta:
        description = "Detects .NET Framework 4.0 Polish stock-charting app (GAD_HW2) signed with stolen Simon Tatham certificate"
        author = "PacketPursuit"
        date = "2026-07-16"
        sha256 = "0a0a24fc88ba87cd8c77b6a493547b2dc780f60df1838e7b0ddcc87bb1277680"
        family = "unclassified-dotnet"
    strings:
        $gad_ns = "GAD_HW2" ascii wide
        $sprawa = "Sprawa" ascii wide
        $wykonana = "Wykonana" ascii wide
        $mojeokienko = "MojeOkienko" ascii wide
        $trif32 = "Trif32" ascii wide
        $candle = "button_CandleSticks_Click" ascii wide
        $hilo = "button_HiLoOpenClose_Click" ascii wide
        $wyczysc = "wyczyscButton_Click" ascii wide
        $tatham_url = "https://www.chiark.greenend.org.uk/~sgtatham/putty/" ascii wide
        $comodo_codesign = "COMODO RSA Code Signing CA" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        ($gad_ns or $sprawa or $mojeokienko) and
        $trif32 and
        ($tatham_url or $comodo_codesign)
}

Sigma rule — Stolen Simon Tatham certificate execution

title: Execution of PE Signed with Stolen Simon Tatham Certificate
status: experimental
description: Detects execution of any PE bearing the stolen COMODO RSA Code Signing CA chain with CN=Simon Tatham. This certificate has been observed across multiple benign applications repackaged as social-engineering lures.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Hashes|contains:
            - '0a0a24fc88ba87cd8c77b6a493547b2dc780f60df1838e7b0ddcc87bb1277680'
            - 'eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a'
            - 'c4ee3a31081db5feff937ed7a716fd805b467dacc6c1d679c4508e5b51ba8895'
            - 'cae7ac1dc4191db8041bca77127910f900f9effbe1b9e87492ba49549de14676'
            - 'a1e6dc7a3172ae52663e446cb8286a8aeec8c92fe75eb97f290df80f2e1ac398'
            - 'b4814a1725a288805097151348d07a8322d14ced20eb5137fbf368d245fe6c68'
            - '724d94aa2eb7c09cdd8eca00e68017b430fe332c68a2201b5e308fe04715c545'
            - '72d8e3b25d5076a52640aca8d8e05fe629e8784d5fadbc533d4db50f0ae5aa70'
            - '5ea6b79d0efa5db5514fb0eb7f6307d35e504425a3af39bd226c22ac39121603'
    condition: selection
falsepositives:
    - Legitimate PuTTY binaries signed by the real Simon Tatham (unlikely to match the lure filenames)
level: high

IOC list

Behavioral fingerprint statement

This binary is a .NET Framework 4.0 WinForms GUI application that presents a stock-charting interface with Polish-language labels. It imports CSV files via OpenFileDialog, renders candlestick/line/bar charts with configurable moving averages, and contains a trivial Trif32 Caesar-shift string decoder. It is signed with a stolen COMODO RSA Code Signing CA certificate belonging to Simon Tatham (PuTTY developer). No network APIs, no persistence mechanisms, no process injection, and no anti-analysis routines are present. The threat is purely social-engineering masquerade — the victim is tricked into executing a benign application that carries a trusted publisher signature under a payment-themed filename.

Detection Signatures

References

• Artifact ID: 3beafe53-f541-4657-8c20-881db9762958
• Source: OpenCTI / MalwareBazaar
• Related wiki pages:
  • unclassified-dotnet — Umbrella entity for the stolen-Tatham-cert cluster
  • trif32-caesar-shift-23-decoder — Shared benign decoder fingerprint
  • stolen-certificate-signing — Concept page for stolen Authenticode abuse
  • social-engineering-filename-lure — Filename deception pattern
  • version-info-masquerade — VS_VERSIONINFO fabrication pattern
  • debug-build-capa-false-positives — Capa false-positive profile

Provenance

• file.txt — file v5.45
• exiftool.json — ExifTool v12.76
• pefile.txt — pefile v2023.2.7
• strings.txt — strings (GNU binutils)
• capa.txt — Mandiant capa v7.0.1 (static, dotnet format)
• binwalk.txt — binwalk v2.3.4
• rabin2-info.txt — radare2 v5.9.6
• triage.json — triage-fast v1 (2026-05-26)
• openssl-cert-extract — OpenSSL 3.0.13, manual PKCS#7 extraction from security directory at RVA 0xAC600
• floss.txt — FireEye flare-floss (invocation error, no output)
• Dynamic analysis: skipped — no CAPE Windows guest available. All behavior inferred from static analysis.