unclassified-dotnet: 37d7de16 — MyPaint Editor sibling, "Quotation" lure

Executive Summary

A .NET Framework 4.0 WinForms vector-drawing application (MyPaint.Editor namespace) repackaged with a business-document social-engineering filename (Quotation.exe). Confirmed sibling to 6bc4e16d (same namespace, class hierarchy, Trif32 decoder, and UI surface). No malicious payload, no network APIs, no persistence, no anti-analysis. Capa T1620 and T1083 are false positives from standard .NET resource loading and file-dialog usage. Static-only analysis (no CAPE Windows guest).

What It Is

The binary is a C# WinForms paint program with three PE sections (.text entropy 7.89, .rsrc entropy 4.10, .reloc entropy 0.10), a minimal IAT importing only mscoree.dll!_CorExeMain, and a ~5.8 KB .rsrc section containing eight 16×16 PNG toolbar icons, one 588×588 PNG splash image, and a standard UAC manifest. ^[pefile.txt] ^[binwalk.txt]

Cluster sibling to 6bc4e16d — identical namespace (MyPaint.Editor / MyPaint.Bussiness), identical class hierarchy (MainForm, GraphicTool, Point2D, FileManager, Trif32), identical UI controls and event handlers. Deltas are: internal name (YvNg vs AwrU), distribution filename (Quotation.exe vs PURCHASE_ORDER-6350.exe), size (+257 KB due to a 588×588 splash vs 509×509), and one additional method (get_XPct). ^[strings.txt] ^[/intel/analyses/6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b.html]

How It Works

The application is the same basic 2D vector-drawing editor documented in the 6bc4e16d sibling report. Surface includes:

• Drawing canvas (pictureBoxPaint) with mouse event handlers for MouseDown, MouseMove, MouseUp, and Paint events ^[strings.txt]
• Shape tools — line, rectangle, square, circle, ellipse — selectable via RadioButton controls in a GroupBox (groupBoxShapes) ^[strings.txt]
• Origin/Ending pickers — two Panel controls (panelOriginPicker, panelEndingPicker) for setting stroke endpoints via click-and-drag ^[strings.txt]
• Console text box (tbConsole) — multiline read-only status area ^[strings.txt]
• Menu bar — standard WinForms MenuStrip with File, Edit, Tools, Help, and About items ^[strings.txt]
• Image I/O — OpenFileDialog / SaveFileDialog with Bitmap / ImageFormat saving and JSON serialization (SaveInJsonFormat, OpenDrawingFromJson) ^[strings.txt]
• Undo/Redo stack — managed via a List<Shape> backing field (_shapes) ^[strings.txt]

No malicious behavior: Zero references to System.Net, System.Security, System.Diagnostics.Process, Microsoft.Win32.Registry, or any P/Invoke DllImport signatures. ^[strings.txt] ^[pefile.txt]

The Trif32 class name appears at line 19 of strings.txt — a shared Caesar-shift-23 decoder utility observed across the PrimeraVentana, GoldenCity, and MyPaint.Editor clusters. ^[strings.txt] ^[concepts/trif32-caesar-shift-23-decoder.md]

Per-sample delta: get_XPct at line 313 of strings.txt — a getter method not present in sibling 6bc4e16d. Likely a minor UI enhancement (percentage-based X-coordinate calculation for the canvas). ^[strings.txt]

Decompiled Behavior

Entry point is standard .NET CIL: _CorExeMain → CLR bootstrap → Program.Main → Application.EnableVisualStyles → Application.Run(new MainForm()) → MainForm..ctor → InitializeComponent. ^[strings.txt]

Notable methods in the call tree (identical to sibling 6bc4e16d unless noted):

• InitializeComponent — WinForms designer-generated UI layout ^[strings.txt]
• pictureBoxPaint_MouseDown / MouseMove / MouseUp — drag-to-draw shape creation ^[strings.txt]
• panelOriginPicker_MouseDown / MouseMove / MouseUp — endpoint selection ^[strings.txt]
• panelEndingPicker_MouseDown / MouseMove / MouseUp — second endpoint selection ^[strings.txt]
• MainForm_KeyDown — keyboard shortcuts ^[strings.txt]
• CreateNewShape / SetLastShape — factory methods for shape primitives ^[strings.txt]
• DrawLine / DrawRectangle / DrawEllipse — GDI+ rendering ^[strings.txt]
• SaveDrawingAsBitmap / ProcessBitmap / DrawToBitmap — raster export ^[strings.txt]
• SaveInJsonFormat / OpenDrawingFromJson — vector serialization ^[strings.txt]
• undoToolStripMenuItem1_Click / redoToolStripMenuItem1_Click — stack manipulation ^[strings.txt]
• MainForm_Resize — responsive canvas scaling ^[strings.txt]
• Trif32 — Caesar-shift-23 decoder (cluster marker) ^[strings.txt]
• get_XPct — unique to this sibling; percentage-based canvas coordinate getter ^[strings.txt]

Capa flags T1620 Reflective Code Loading from Assembly.Load and MethodBase.Invoke — standard ResourceManager and designer-generated event-wireup, not payload injection. ^[capa.txt]

Capa flags T1083 File and Directory Discovery from GetFolderPath and file-dialog usage — standard OpenFileDialog / SaveFileDialog directory enumeration. ^[capa.txt]

C2 Infrastructure

None. No network APIs, no hardcoded URLs, no DNS resolution, no socket creation. The binary is entirely offline.

Interesting Tidbits

• Filename social engineering: Quotation.exe — business-document lure (quotation/RFQ theme) without numeric padding, simpler than the purchase-order lures used by siblings. Bare .exe extension, relying on Windows "Hide extensions for known file types" default. ^[metadata.json]
• VS_VERSIONINFO masquerade: Original app metadata (MyPaint Editor / YvNg.exe / v1.0.0.0) is preserved. The distribution filename contradicts it entirely — no attempt to fabricate Adobe Reader or Microsoft branding, unlike some siblings. ^[pefile.txt]
• Size delta: +257 KB (930 KB vs 673 KB) due to a larger splash image (588×588 PNG vs 509×509 PNG in sibling 6bc4e16d). The 131×131 bitmap found in the sibling is absent here; instead, the splash image is larger. ^[binwalk.txt]
• PDB path: YvNg.pdb — four-character nonsense prefix matching the internal name, consistent with auto-generated names by Visual Studio or a repackager tool. Same pattern as sibling AwrU.pdb. ^[pefile.txt]
• MyPaint.Bussiness namespace: The misspelling of "Business" as "Bussiness" (two s's) is preserved, indicating non-native English speaker authorship — consistent with the PrimeraVentana (Spanish) and GoldenCity clusters. ^[strings.txt]
• get_XPct delta: The only CIL-level difference from the sibling — a minor UI enhancement for percentage-based X-coordinate display. Not a functional divergence. ^[strings.txt]
• Debug build: Same DebuggableAttribute with DebuggingModes.Default and DebuggerNonUserCodeAttribute false-positive fingerprint as sibling. ^[strings.txt]
• GUID: $ac6d2d7f-d38f-4bfc-a687-916008002e71 — identical assembly GUID to sibling 6bc4e16d, confirming the same compiled assembly was repackaged with only filename and internal-name changes. ^[strings.txt] ^[/intel/analyses/6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b.html]

How To Mess With It (Homelab Replication)

See sibling 6bc4e16d report for the full replication recipe. To reproduce this specific variant:

1. Follow the 6bc4e16d replication steps (Visual Studio 2019/2022, .NET Framework 4.0, WinForms paint editor).
2. Add a get_XPct percentage-based coordinate getter to the Point2D or canvas class:

   public double XPct => (double)X / canvasWidth * 100;
   

3. Replace the 509×509 splash PNG with a 588×588 PNG to match the size delta.
4. Build in Debug configuration.
5. Rename output to YvNg.exe and set VS_VERSIONINFO to MyPaint Editor / YvNg.exe / v1.0.0.0.

Verification: Run capa on the output. Expect identical false-positive T1620/T1083 profile to this sample.

What you'll learn: How trivial source changes (one getter + larger splash image) produce a different SHA-256 while the underlying benign application remains unchanged, and how repackagers exploit this to evade hash-based detection.

Deployable Signatures

YARA Rule — MyPaint.Editor cluster

rule UnclassifiedDotnet_MyPaintEditor_Cluster
{
    meta:
        description = "MyPaint Editor .NET WinForms paint program cluster (social-engineering masquerade)"
        author = "pp-hermes"
        date = "2026-07-12"
        sha256_1 = "6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b"
        sha256_2 = "37d7de1665e2b4fce2a0781f513037bd5aaa0bc0358e63df5bac07d13c302996"
        reference = "/intel/analyses/37d7de1665e2b4fce2a0781f513037bd5aaa0bc0358e63df5bac07d13c302996.html"

    strings:
        $namespace1 = "MyPaint.Editor" ascii wide
        $namespace2 = "MyPaint.Bussiness" ascii wide
        $class1 = "MainForm" ascii wide
        $class2 = "GraphicTool" ascii wide
        $class3 = "Point2D" ascii wide
        $class4 = "FileManager" ascii wide
        $trif32 = "Trif32" ascii wide
        $ui1 = "pictureBoxPaint" ascii wide
        $ui2 = "panelOriginPicker" ascii wide
        $ui3 = "panelEndingPicker" ascii wide
        $ui4 = "tbConsole" ascii wide
        $ui5 = "tbShapesKeys" ascii wide
        $ui6 = "rbCircle" ascii wide
        $ui7 = "rbRectangle" ascii wide
        $ui8 = "rbLine" ascii wide
        $ui9 = "rbSquare" ascii wide
        $menu1 = "undoToolStripMenuItem1" ascii wide
        $menu2 = "openImageToolStripMenuItem" ascii wide
        $menu3 = "clearConsoleToolStripMenuItem" ascii wide
        $menu4 = "saveToolStripMenuItem" ascii wide
        $menu5 = "openDrawingToolStripMenuItem" ascii wide
        $menu6 = "bitmapToolStripMenuItem" ascii wide
        $method1 = "SaveInJsonFormat" ascii wide
        $method2 = "OpenDrawingFromJson" ascii wide
        $method3 = "SaveDrawingAsBitmap" ascii wide
        $method4 = "ProcessBitmap" ascii wide
        $method5 = "CreateNewShape" ascii wide
        $method6 = "SetLastShape" ascii wide
        $version1 = "MyPaint Editor" ascii wide
        $internal1 = "AwrU.exe" ascii wide
        $internal2 = "YvNg.exe" ascii wide
        $guid = "$ac6d2d7f-d38f-4bfc-a687-916008002e71" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        pe.is_dotnet and
        ($namespace1 or $namespace2) and
        $class1 and
        ($trif32 or 2 of ($class*)) and
        3 of ($ui*) and
        3 of ($menu*) and
        2 of ($method*) and
        ($internal1 or $internal2 or $guid)
}

Behavioral Fingerprint Statement

This binary is a .NET Framework 4.0 WinForms GUI executable with a three-section PE layout (.text, .rsrc, .reloc), minimal IAT (mscoree.dll only), and a ~5.8 KB embedded .rsrc section containing eight 16×16 PNG toolbar icons, a 588×588 PNG splash image, and a standard UAC manifest. It instantiates a MainForm with PictureBox, Panel, GroupBox, TextBox, RadioButton, MenuStrip, OpenFileDialog, and SaveFileDialog controls, wires mouse event handlers for drag-to-draw shape creation, and renders primitives via GDI+ Graphics.DrawLine / DrawRectangle / DrawEllipse. It supports undo/redo via a List<Shape> backing field and exports drawings to bitmap and JSON formats. No network APIs, no registry access, no process manipulation, and no P/Invoke imports are present. The DebuggableAttribute and DebuggerNonUserCodeAttribute compiler-generated attributes cause capa to flag T1620 falsely. The GetFolderPath and file-dialog usage triggers T1083. Assembly GUID $ac6d2d7f-d38f-4bfc-a687-916008002e71 is shared with sibling 6bc4e16d.

IOC List

Detection Signatures

References

• Artifact ID: 9f813823-4f73-4dd8-bdcf-76339cf6c341 ^[metadata.json]
• Source: OpenCTI / MalwareBazaar
• Related wiki pages:
  • unclassified-dotnet — umbrella entity for unattributed .NET samples
  • trif32-caesar-shift-23-decoder — shared benign coursework decoder concept
  • version-info-masquerade — VS_VERSIONINFO falsification technique
  • social-engineering-filename-lure — filename-based social engineering
  • debug-build-capa-false-positives — capa false-positive pattern
• Cluster sibling:
  • 6bc4e16d — MyPaint Editor with "Purchase Order" masquerade ^[/intel/analyses/6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b.html]

Provenance

• file.txt — file v5.44
• exiftool.json — ExifTool v12.76
• pefile.txt — pefile (Python) + custom script
• strings.txt — strings v2.39
• floss.txt — flare-floss v3.1.1 (errored on invocation — invalid CLI argument order)
• capa.txt — flare-capa v7.1.0 (static analysis, OS: any)
• binwalk.txt — binwalk v2.3.4
• rabin2-info.txt — radare2 v5.9.6
• metadata.json — triage pipeline schema v1
• .NET metadata — custom Python script using pefile + struct
• dynamic-analysis.md — CAPE skipped (no Windows guest)