unclassified-dotnet: 0e9cc5f81798 — Spanish student-evaluation CRUD app, stolen PuTTY cert, Adobe Reader masquerade

Executive Summary

.NET Framework 4.0 WinForms CRUD application for Spanish-language student-evaluation tracking (Evaluacion namespace), signed with the stolen Simon Tatham (PuTTY) COMODO RSA Code Signing CA certificate, and distributed under the filename NewXOrder_00200457.exe with VS_VERSIONINFO masquerading as Adobe Reader. No malicious payload, no network APIs, no persistence, no anti-analysis. Second confirmed sibling of sample 5e34f10a. Threat is purely social-engineering masquerade — the certificate and filename lend false legitimacy to a benign student-grade application.

What It Is

How It Works

This is a straightforward .NET Framework 4.0 WinForms CRUD application for managing Spanish-language student evaluations. It uses System.Data.SqlClient for database connectivity and presents standard Windows Forms dialogs for data entry, search, and reporting.

Architecture

• Namespace: Evaluacion — Spanish-language student-evaluation tracking system
• Core entities: Estudiantes, Materias, Seccions, Indicadors, Evaluacions, Usuarios ^[strings.txt:14-24,317]
• UI layer: 21 WinForms .resources files (GMateria, GEstudiante, GEvaluacion, GIndicador, GSeccion, Principal, MLogin, MUsuario, etc.) ^[strings.txt:496-516]
• Data access: SqlConnection, SqlCommand, SqlDataAdapter, SqlParameter ^[strings.txt:134,369,465]
• Database: Evaluacion.db (local SQLite or SQL Server Compact) ^[strings.txt:60]

Controls and Features

Standard WinForms controls: DataGridView, ComboBox, TextBox, DateTimePicker, RadioButton, FlowLayoutPanel, ToolStrip, MenuStrip, Panel, PictureBox. No custom P/Invoke, no reflection beyond standard .NET JIT, no network surface. ^[strings.txt:1-500]

Build Evidence

The binary carries a CodeView PDB path SjbQ.pdb with GUID 0075A4C0-FD5C-48D8-A244-B7892BF43CB7. The internal name SjbQ.exe is a four-character nonsense string, consistent with auto-generated names from a repackaging tool or build script. The timestamp is future-dated to 2040. ^[rabin2-info.txt:11-13] ^[pefile.txt:333-353]

Authenticode Certificate

Signed with the same stolen Simon Tatham (PuTTY developer) COMODO RSA Code Signing CA certificate observed in samples eea0dcbc, c4ee3a31081d, cae7ac1dc419, a1e6dc7a, b4814a17, 724d94aa, 72d8e3b2, 5ea6b79d, 0a0a24fc, and 5e34f10a.

• Leaf cert: CN=Simon Tatham, O=Simon Tatham, L=Cambridge, ST=Cambridgeshire, C=GB
• Issuer: COMODO RSA Code Signing CA → COMODO RSA Certification Authority
• Serial: 0x7c1118cbbadc95da3752c46e47a27438
• Validity: 2018-11-13 to 2021-11-08 (expired) ^[pefile.txt:152-154]

This certificate chain has been observed across eleven confirmed samples in this corpus, all benign applications repackaged with social-engineering filenames. The certificate was likely stolen from the PuTTY project and is now a cluster fingerprint rather than an active trust anchor.

Decompiled Behavior

Entry point: Evaluacion.Program::Main (token 0x060000C9) → instantiates Evaluacion.Principal (main MDI form) and calls Application.Run. ^[dnfile: CLR EntryPointToken=0x60000C9]

No encryption, no reflective loading, no assembly resolution callbacks. The System.Reflection namespace is referenced only for standard compiler-generated attributes (CompilerGeneratedAttribute, GeneratedCodeAttribute, DebuggerNonUserCodeAttribute, DebuggableAttribute). ^[strings.txt:213-218]

The capa T1620 "Reflective Code Loading" hit is a false positive triggered by DebuggerNonUserCodeAttribute and DebuggableAttribute in a Debug-configuration build — a recurring pattern across 40+ samples in the unclassified-dotnet cluster. ^[capa.txt] ^[entities/unclassified-dotnet.md]

C2 Infrastructure

None. No System.Net, no System.Net.Sockets, no WinHTTP, no P/Invoke, no hardcoded URLs, IPs, domains, or C2 infrastructure. The threat surface is entirely social-engineering masquerade.

Interesting Tidbits

• Stolen-certificate lending false legitimacy: The Simon Tatham COMODO RSA cert gives this benign app a green shield in Windows SmartScreen, exactly as intended by the repackager. ^[pefile.txt:152-154]
• Purchase-order filename: NewXOrder_00200457.exe follows the NewXOrder_ + numeric-ID pattern seen in other social-engineering lures. The "X" prefix and six-digit ID masquerade as an internal procurement system reference number. ^[triage.json:5]
• Adobe Reader masquerade: VS_VERSIONINFO claims Adobe Reader / Microsoft PDF Document / PDF document — a triple-masquerade combining two legitimate software identities. ^[exiftool.json:36-46]
• Second Evaluacion sibling: This is the second confirmed sample with the Evaluacion namespace. The first (5e34f10a, PO#82924A.exe) is identical in namespace, class structure, SqlClient backend, and 16 WinForms .resources files. This sample adds five additional .resources files (GSeccion, LSeccion, MSeccion, LUsuario, MUsuario, MLogin) and is 46 KB larger (812 KB vs 766 KB). ^[entities/unclassified-dotnet.md]
• 524×524 PNG icon: Binwalk identified a 524×524 RGBA PNG at file offset 0x2B90B — likely the application icon or splash image embedded in the PE .rsrc. ^[binwalk.txt:6]
• No obfuscation: No ConfuserEx, no SmartAssembly, no Xenocode, no name mangling. The CIL is fully readable. The only anti-static measure is the certificate + filename + version-info masquerade triad.

How To Mess With It (Homelab Replication)

Build a comparable benign .NET Framework 4.0 WinForms app with VS_VERSIONINFO masquerade:

1. Create a C# WinForms project targeting .NET Framework 4.0 Client Profile.
2. Add AssemblyTitleAttribute("Adobe Reader"), AssemblyProductAttribute("Adobe Reader"), AssemblyCompanyAttribute("Adobe Inc."), AssemblyDescriptionAttribute("Microsoft PDF Document").
3. Set internal name to a random 4-char string (e.g., XyZq.exe).
4. Compile in Debug configuration (generates DebuggerNonUserCodeAttribute + DebuggableAttribute).
5. Sign with any test certificate (or self-signed with matching subject).
6. Rename output to NewXOrder_00200457.exe.
7. Run capa against the binary — expect T1620 false positive.

Verification: Compare capa output to capa.txt from this analysis. Should hit identical false positives: T1620 + B0013.001.

Deployable Signatures

YARA Rule

rule UnclassifiedDotNet_EvaluacionCluster_StolenTathamCert
{
    meta:
        description = "Detects .NET Framework Evaluacion-namespace student-evaluation CRUD app masquerading as Adobe Reader"
        author = "Titus"
        date = "2026-07-17"
        reference = "/intel/analyses/0e9cc5f817989d3f415dbe505b11bc79e34cf32e98ed16e14e1bd40f35b0724d.html"
        hash = "0e9cc5f817989d3f415dbe505b11bc79e34cf32e98ed16e14e1bd40f35b0724d"

    strings:
        $ns1 = "Evaluacion" wide ascii
        $ns2 = "Evaluacion.Estudiantes" wide ascii
        $ns3 = "Evaluacion.Materias" wide ascii
        $ns4 = "Evaluacion.Seccions" wide ascii
        $ns5 = "Evaluacion.Indicadors" wide ascii
        $ns6 = "Evaluacion.Evaluacions" wide ascii
        $ns7 = "Evaluacion.Usuarios" wide ascii
        $db = "Evaluacion.db" wide ascii
        $res1 = "Evaluacion.GMateria.resources" wide ascii
        $res2 = "Evaluacion.GEstudiante.resources" wide ascii
        $res3 = "Evaluacion.Principal.resources" wide ascii
        $cert_cn = "CN=Simon Tatham, O=Simon Tatham" ascii

    condition:
        uint16(0) == 0x5A4D and
        $ns1 and
        ($db or $res1 or $res2 or $res3) and
        $cert_cn
}

Sigma Rule

title: .NET Evaluacion Masquerade Execution
id: evaluacion-dotnet-masquerade-exec
status: experimental
description: Detects execution of .NET Framework PE with Evaluacion namespace and Adobe Reader masquerade VS_VERSIONINFO
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - CommandLine|contains:
      - 'NewXOrder_'
      - 'NewXOrder'
    - Image|endswith: '.exe'
  condition: selection
falsepositives:
  - Unknown
level: low

IOC List

Behavioral Fingerprint

This binary is a .NET Framework 4.0 IL-only PE32 with the Evaluacion namespace and standard WinForms controls, importing only mscoree.dll. It carries a VS_VERSIONINFO block masquerading as Adobe Reader, is signed with the stolen Simon Tatham COMODO RSA certificate (expired 2021), and is distributed under a purchase-order-themed filename (NewXOrder_00200457.exe). No network APIs, no P/Invoke, no persistence, no anti-analysis. The capa T1620 hit is a false positive from Debug-build compiler attributes. The threat is purely social-engineering masquerade.

Detection Signatures

No genuine MITRE ATT&CK techniques apply — the binary has no malicious runtime behavior.

References

• Sample: 0e9cc5f817989d3f415dbe505b11bc79e34cf32e98ed16e14e1bd40f35b0724d (MalwareBazaar)
• Sibling: 5e34f10aad66da3d4137e4cc4ce01ac33922d427141666bfa4a6f8ec6d181bf5 — first confirmed Evaluacion namespace sibling
• Entity: unclassified-dotnet
• Technique: version-info-masquerade
• Technique: social-engineering-filename-lure
• Technique: stolen-authenticode-certificate-signing
• Concept: debug-build-capa-false-positives

Provenance

• file.txt — file(1) v5.45
• exiftool.json — ExifTool v12.76
• pefile.txt — pefile + pefile-scripts (Python 3.12)
• strings.txt — strings v2.44
• floss.txt — flare-floss v2.4.0 (errored on invocation; no decoded strings)
• capa.txt — Mandiant capa v7.4.0 (static analysis)
• binwalk.txt — binwalk v2.3.4
• rabin2-info.txt — radare2 v5.9.2
• dnfile — dnfile 0.15.1 (Python 3.12) for CLR metadata parsing
• openssl — OpenSSL 3.0.13 for certificate chain extraction
• Certificate extraction: manual WIN_CERTIFICATE parsing at PE security directory offset 0xC2E00
• Dynamic analysis: skipped — no CAPE Windows guest available