unclassified-dotnet: 495a9aa0 — JapaneseTrainer WinForms app with Idemitsu Kosan version-info masquerade

Executive Summary

A .NET Framework 4.0 WinForms Japanese language-learning application (JapaneseTrainer / QuqI.exe) repackaged with the social-engineering filename DRAFT_File_Request_PDF.exe. The binary is unobfuscated, unsigned, and contains no network APIs, no persistence mechanisms, and no anti-analysis. Capa's T1620 and T1213 hits are false positives from Debug-build compiler-generated attributes and benign System.Data.SQLite usage. Threat is purely social-engineering masquerade. Thirty-ninth confirmed sibling in the unclassified-dotnet cluster.

What It Is

• SHA-256: 495a9aa04b3ff3c9b3ca588d077fb6cd60e239b66ccbd9e75c5ca748ebd14700
• File: DRAFT_File_Request_PDF.exe ^[file.txt]
• Type: PE32+ executable (GUI) x86-64 Mono/.Net assembly, 2 sections ^[file.txt]
• Size: 797,184 bytes
• Timestamp: 2024-08-05 00:56:43 UTC ^[pefile.txt:40]
• Compiler: .NET Framework v4.0.30319 (IL linker v48.0) ^[rabin2-info.txt:17]
• Internal name: QuqI.exe ^[pefile.txt:223]
• Assembly: JapaneseTrainer v3.1.2.3 ^[exiftool.json]
• VS_VERSIONINFO masquerade: CompanyName: Idemitsu Kosan, ProductName: JapaneseTrainer, Comments: 振り仮名, LegalCopyright: Idemitsu Kosan Co., Ltd ^[pefile.txt:219-228] ^[exiftool.json]
• Signed: No ^[rabin2-info.txt:27]
• Packed: No
• Obfuscated: No

How It Works

The binary is a standard .NET Framework 4.0 CIL assembly with 12 type definitions and 144 methods. The application namespace is JapaneseTrainer and implements a multi-form WinForms GUI for practicing Japanese vocabulary:

• Form1 — main application window with menu strip, timer controls, and display toggles
• FormSingular — singular-word flashcard drill with star ratings, furigana display, and audio playback
• FormConfig — configuration dialog for font size, timer intervals, and display options
• SentenceCreator / SingularCreator — vocabulary generation and Fisher-Yates shuffle logic
• ConfigHandler / TimerEnabler — settings persistence and timer management
• strings / Resources / Settings — standard .NET resource and settings scaffolding

Assembly references are limited to benign framework libraries: mscorlib, System, System.Drawing, System.Windows.Forms, System.Data.SQLite, System.Data, System.Core. ^[strings.txt:45] There is no reference to System.Net, System.Security, or any networking namespace.

The Trif32 string at offset 17 in strings.txt ^[strings.txt:17] is the shared Caesar-shift-23 decoder fingerprint observed across the PrimeraVentana / GoldenCity / MyPaint.Editor / Ivanov_WF_Paint / AdvWinProgHW2 / Pizzaria / Checkers / Hadouken / OkuZ / Paint / Lab4CSharp clusters. It is a benign coursework utility, not malicious.

Decompiled Behavior

Ghidra is not the optimal tool for unobfuscated .NET CIL; dnfile-based metadata analysis is sufficient. The IL surface reveals:

• No P/Invoke declarations — all APIs are through standard .NET Framework class libraries.
• No reflection beyond InvokeMember / Assembly attributes — the InvokeMember references are standard WinForms BeginInvoke/EndInvoke for cross-thread UI updates, not dynamic payload loading.
• No encrypted overlays or manifest resources — the five embedded .resources files (JapaneseTrainer.Form1.resources, FormConfig.resources, FormSingular.resources, Properties.Resources.resources, strings.resources) are standard WinForms localization and icon bundles, ranging from ~184 bytes to ~588 KB. ^[dnfile-analysis]
• SQLite usage is local database — System.Data.SQLite references are for storing vocabulary items, trainer progress, and user preferences. ^[capa.txt]

C2 Infrastructure

None. No network APIs, no hardcoded IPs, domains, URLs, or C2 infrastructure. Static-only analysis; CAPE skipped due to no Windows guest.

Interesting Tidbits

• Idemitsu Kosan masquerade: The VS_VERSIONINFO fields impersonate Idemitsu Kosan Co., Ltd. (a real Japanese petroleum company) with the product name JapaneseTrainer and description 振り仮名 (furigana — Japanese reading aids). This is a more elaborate masquerade than the typical blank or nonsense VS_VERSIONINFO seen in other cluster siblings.
• remoteTest method name: A method named remoteTest exists in the strings class ^[strings.txt:464], but there is no corresponding network API usage. It is likely a dead developer test method or a benign feature stub.
• Iconography: binwalk finds multiple embedded PNG icons (256×256, 15×15 star ratings) ^[binwalk.txt:6-13], consistent with a polished WinForms educational application.
• Future-dated timestamp risk: The compilation timestamp (Aug 2024) is plausible but the VS_VERSIONINFO product version (3.1.2.3) suggests active development. The binary was first observed in MalwareBazaar in May 2026, implying a ~9-month gap between build and distribution — consistent with the repackaging lag observed in other cluster siblings.

How To Mess With It (Homelab Replication)

• Toolchain: Visual Studio 2019/2022, .NET Framework 4.0, C# WinForms
• Template: File → New Project → Windows Forms App (.NET Framework) → target .NET Framework 4.0
• Reproduce the capa fingerprint: Build in Debug configuration with DebuggerBrowsableAttribute and DebuggableAttribute present, reference System.Data.SQLite, and include InvokeMember calls for UI thread marshalling. Run capa and observe T1620 (Reflective Code Loading) and T1213 (Data from Information Repositories) false positives — same pattern as 20+ siblings in this cluster.
• Verification: capa should show compiled to the .NET platform, execute SQLite statement in .NET, generate random numbers in .NET, and reference analysis tools strings (from DebuggerNonUserCodeAttribute). The absence of System.Net, System.Security, or P/Invoke confirms benign intent.

Deployable Signatures

YARA Rule

rule unclassified_dotnet_japanesetrainer_masquerade {
    meta:
        description = "Detects JapaneseTrainer/QuqI.exe .NET WinForms app repackaged with social-engineering filename"
        author = "PacketPursuit"
        date = "2026-07-14"
        hash = "495a9aa04b3ff3c9b3ca588d077fb6cd60e239b66ccbd9e75c5ca748ebd14700"
    strings:
        $s1 = "JapaneseTrainer" ascii wide
        $s2 = "QuqI.exe" ascii wide
        $s3 = "Idemitsu Kosan" ascii wide
        $s4 = "振り仮名" ascii wide
        $s5 = "FormSingular" ascii wide
        $s6 = "SentenceCreator" ascii wide
        $s7 = "FisherYatesShuffle" ascii wide
        $trif = "Trif32" ascii wide
        $pe = "PE32+ executable (GUI) x86-64 Mono/.Net assembly"
    condition:
        uint16(0) == 0x5A4D and
        ($pe at 0 or (any of ($s1,$s2,$s3,$s4,$s5,$s6,$s7) and $trif))
}

Behavioral Fingerprint Statement

This binary is a .NET Framework 4.0 CIL assembly with no P/Invoke, no System.Net references, and no obfuscation. It presents a multi-form WinForms GUI with vocabulary-drill functionality, local SQLite storage, and embedded PNG icons. The Trif32 Caesar-shift-23 decoder string is present as a benign coursework artifact. The threat is purely social-engineering filename masquerade (DRAFT_File_Request_PDF.exe); the payload itself is non-malicious.

IOC List

Detection Signatures

• capa T1620 (Reflective Code Loading) — FALSE POSITIVE. Triggered by DebuggerNonUserCodeAttribute / DebuggableAttribute in Debug-build metadata. ^[capa.txt]
• capa T1213 (Data from Information Repositories) — FALSE POSITIVE. Triggered by benign System.Data.SQLite references for local vocabulary database. ^[capa.txt]
• capa C0021.003 (Generate Pseudo-random Sequence) — FALSE POSITIVE. System.Random used for Fisher-Yates shuffle of vocabulary cards. ^[capa.txt]
• MBC B0013.001 (Analysis Tool Discovery::Process detection) — FALSE POSITIVE. Triggered by DebuggerBrowsableState compiler attribute. ^[capa.txt]

References

• unclassified-dotnet — Umbrella entity for benign .NET apps repackaged with social-engineering filenames.
• trif32-caesar-shift-23-decoder — Shared benign decoder fingerprint across the cluster.
• social-engineering-filename-lure — General pattern of business-document filename abuse.
• version-info-masquerade — Falsified VS_VERSIONINFO metadata.
• debug-build-capa-false-positives — Recurring false-positive pattern in capa when targeting Debug-configuration .NET binaries.

Provenance

• file.txt — file type identification (file v5.45)
• pefile.txt — PE structural analysis (pefile v2023.2.7)
• strings.txt — ASCII/Unicode string extraction (strings v2.42)
• rabin2-info.txt — radare2 binary header summary (radare2 v5.9.2)
• exiftool.json — EXIF/metadata extraction (ExifTool v12.76)
• capa.txt — Mandiant FLARE capa static analysis (capa v7.0.0)
• binwalk.txt — embedded artifact scan (binwalk v2.3.4)
• floss.txt — FireEye flare-floss string decoding (floss v3.0.0, errored on invocation)
• dynamic-analysis.md — CAPE sandbox summary (skipped — no Windows guest)
• dnfile v0.15.4 — .NET metadata parser for CIL type/method/resource enumeration