unclassified-dotnet: 46c14f54 — OOP inheritance coursework app with purchase-order lure

Executive Summary

A .NET Framework 4.0 WinForms educational application demonstrating object-oriented inheritance (Vehicle → Car / SUV / Truck) distributed as PO45120992.exe. The binary is entirely benign — no network APIs, no crypto, no persistence, no anti-analysis — and its sole threat vector is social-engineering masquerade. It shares the Trif32 Caesar-shift-23 decoder with the PrimeraVentana / GoldenCity / MyPaint.Editor / Ivanov_WF_Paint / AdvWinProgHW2 / Pizzaria / Checkers / Hadouken / Paint clusters. Capa T1620 and B0013.001 are confirmed false positives from Debug-build compiler-generated attributes, consistent with 20+ prior siblings in this corpus. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

Namespace / class surface (all benign educational OOP patterns):

• Inheritance root namespace with Properties.Resources
• Forms: CarForm, SUVForm, TruckForm, DisplayForm, Main, displaySUVs, displayTrucks, displayCars
• Domain classes: MakeSound, StartEngine, ShowInfo with getters/setters for _price, _mileage, _make, _modelYear, _passengers, _doors, _wheelDrive
• UI controls: button1–button4, btnAddSUV, btnAddCar, btnAddTruck, btnDone, lstSUV, txtPrice, etc.
• Standard WinForms event handlers: button1_Click, btnAddSUV_Click, CarForm_Load, etc. ^[strings.txt:1–200]

How It Works

This is a straightforward .NET Framework WinForms application that demonstrates class inheritance in C#. The user can add cars, SUVs, and trucks via dedicated forms, then view aggregated lists in display forms. No runtime decryption, no reflective loading of external assemblies, no network communication, and no registry or filesystem persistence.

The Trif32 decoder present in the #Strings metadata (line 9) is the same benign Caesar-shift-23 utility class observed across the PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint/AdvWinProgHW2/Pizzaria/Checkers/Hadouken/Paint clusters. It is a student programming exercise, not a payload decoder. ^[strings.txt:9] ^[entities/unclassified-dotnet.md]

The capa capability Reflective Code Loading [T1620] and Analysis Tool Discovery::Process detection [B0013.001] are false positives caused by DebuggerNonUserCodeAttribute, DebuggableAttribute, and DebuggingModes compiler-generated metadata in a Debug-configuration build. This pattern has been confirmed in 20+ prior siblings and is documented at debug-build-capa-false-positives. ^[capa.txt:15–22] ^[strings.txt:63–70]

Decompiled Behavior

Ghidra import succeeded (46c14f54405d...-a423ff) but auto-analysis was not required — the binary's behavior is fully recoverable from CLR metadata and strings. 80 functions and 157 symbols were discovered, all mapping to standard WinForms event handlers and property accessors. No native API P/Invoke, no Assembly.Load, no MethodBase.Invoke, no Process.Start. ^[ghidra:metadata]

C2 Infrastructure

None. No hardcoded IPs, domains, URLs, mutexes, named pipes, or registry keys. No System.Net, System.Security, System.Diagnostics.Process, or Microsoft.Win32.Registry references in the import surface. ^[strings.txt]

Interesting Tidbits

• "Practi-Plan Mapping 2024" copyright — a fabricated publisher string with no web presence, suggesting the repackager invented it on the spot. ^[exiftool.json:39]
• eWfe.exe internal name — a nonsense four-character string (eWfe), consistent with the auto-generated internal-name pattern seen in other repackaged educational apps (e.g., NZiU, Zfio, Djxu, TZic, wHVe, kUEo, pKDK, HbxE, hovF, VvDt, DzAz, Yhdk, falD, iAQe, wvIf, srza, daQK, zzCV, hDQd). ^[exiftool.json:38] ^[entities/unclassified-dotnet.md]
• Future-dated timestamp — compiled July 2024, which is in the past from our July 2026 perspective, but the VS_VERSIONINFO and .NET assembly metadata show no timestamp tampering. The PE timestamp matches the build date.
• Ten .resources files — Inheritance.SUVForm.resources, Inheritance.TruckForm.resources, Inheritance.CarForm.resources, Inheritance.DisplayForm.resources, Inheritance.Main.resources, Inheritance.displaySUVs.resources, Inheritance.displayTrucks.resources, Inheritance.displayCars.resources, Inheritance.Properties.Resources.resources. Standard WinForms designer output. ^[strings.txt:161–169]
• Embedded PNG icons — binwalk found four PNG images: two 256×256, one 481×481, and one 256×256 in the .rsrc section. These are application icons and splash images, not steganographic carriers. ^[binwalk.txt:6–10]
• No Assembly.Load or reflection-based execution — while InvokeMember and GetExportedTypes strings are present (standard .NET reflection APIs), there is no evidence of runtime assembly loading or delegate-chain execution. The capa T1620 flag is a false positive.

How To Mess With It (Homelab Replication)

Toolchain: Visual Studio 2019/2022, .NET Framework 4.0 targeting pack, C# WinForms App (.NET Framework) template.

Steps:

1. Create a new WinForms project targeting .NET Framework 4.0.
2. Define a base Vehicle class with properties: Make, ModelYear, Price, Mileage.
3. Derive Car (add Passengers, Doors), SUV (add WheelDrive), and Truck classes.
4. Create separate forms for adding each vehicle type and a display form with ListBox controls.
5. Add a Trif32 utility class with a Caesar-shift-23 decoder (shift each character back by 23, wrapping around the alphabet).
6. Build in Debug configuration.
7. Observe that DebuggerNonUserCodeAttribute, DebuggableAttribute, and DebuggingModes appear in the compiled assembly metadata.
8. Run capa against the output EXE and confirm T1620 / B0013.001 false-positive matches.

What you'll learn: How benign Debug-build .NET metadata triggers capa reflective-loading and anti-analysis signatures, and why manual string review is required before treating capa ATT&CK mappings as ground truth.

Deployable Signatures

YARA Rule

rule UnclassifiedDotNet_OOPInheritance_Lure
{
    meta:
        description = "Detects .NET Framework educational OOP inheritance app repackaged with social-engineering lure"
        author = "PacketPursuit"
        date = "2026-07-14"
        sha256 = "46c14f54405d6c75a0ba41465e754314f586546d12135ef3d584b79fa75dc698"
        family = "unclassified-dotnet"

    strings:
        $ns1 = "Inheritance" ascii wide
        $cls1 = "CarForm" ascii wide
        $cls2 = "SUVForm" ascii wide
        $cls3 = "TruckForm" ascii wide
        $cls4 = "DisplayForm" ascii wide
        $dec = "Trif32" ascii wide
        $ui1 = "btnAddSUV" ascii wide
        $ui2 = "txtPrice" ascii wide
        $ui3 = "txtWheelDrive" ascii wide
        $copy = "Practi-Plan Mapping 2024" ascii wide
        $intname = "eWfe.exe" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        ($dec and $ns1 and 3 of ($cls*)) or
        ($copy and $intname)
}

Behavioral Hunt Query (Sigma-like)

title: .NET WinForms OOP Inheritance App Social-Engineering Lure
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - 'PO'
      - 'Purchase'
      - 'Order'
    TargetFilename|endswith: '.exe'
    - PEImphash: 'f34d5f2d4577ed6d9ceec516c1f5a744'
  condition: selection

Note: The above is illustrative. In practice, hunt on the combination of .NET Framework PE + Inheritance namespace strings + purchase-order filename + absence of System.Net references. The PE's only import is mscoree.dll._CorExeMain and it carries no Authenticode signature.

IOC List

Behavioral Fingerprint

This .NET Framework 4.0 WinForms PE32 executable has a single import (mscoree.dll._CorExeMain), no Authenticode signature, and no network, cryptography, process-management, or registry APIs. Its CLR metadata contains an Inheritance namespace with vehicle-related forms (CarForm, SUVForm, TruckForm, DisplayForm) and a Trif32 utility class. The binary was distributed with a purchase-order-themed filename (PO45120992.exe) but executes only a benign GUI for managing OOP inheritance hierarchies. Capa flags T1620 and B0013.001 are false positives from Debug-build compiler-generated attributes.

Detection Signatures

References

• unclassified-dotnet — umbrella entity for this cluster
• debug-build-capa-false-positives — documented false-positive pattern
• trif32-caesar-shift-23-decoder — benign decoder shared across clusters
• social-engineering-filename-lure — cross-family concept

Provenance

• file.txt, exiftool.json, pefile.txt, strings.txt, ssdeep.txt, tlsh.txt, yara.txt, metadata.json, triage.json, capa.txt, binwalk.txt, rabin2-info.txt — generated by triage-fast pipeline on 2026-05-26.
• floss.txt — flare-floss invocation failed due to argument parsing error; no decoded strings obtained.
• Ghidra 12.1 import queued (46c14f54405d...-a423ff) but auto-analysis not required; behavior fully recoverable from CLR metadata and strings.
• No CAPE detonation — Windows guest unavailable.