unclassified-dotnet: 4cf48ffc — Spanish RPG character generator, invoice.exe lure

Executive Summary

.NET Framework 4.0 WinForms Spanish RPG character generator (ejemplo namespace, kUEo.exe, v1.0.0.0) distributed as invoice.exe. Third confirmed sibling of the ad301389 / 644892e9 cluster. Fabricated Microsoft Corporation / Thumbnail Handler version-info masquerade. No packing, no obfuscation, no network APIs, no persistence. Threat is purely social-engineering masquerade. Static-only (CAPE skipped — no Windows guest).

What It Is

The binary is an unobfuscated .NET Framework 4.0 CIL assembly with a standard three-section PE layout (.text entropy 7.86, .rsrc entropy 3.48, .reloc entropy 0.10) ^[pefile.txt]. The only import is mscoree.dll!_CorExeMain ^[pefile.txt]. No packing, no native API P/Invoke, no anti-analysis, no anti-debug, no VM detection.

How It Works

The binary is a benign Spanish-language RPG character generator written as a WinForms MDI application. It is not a loader, dropper, or stealer — the threat is purely the social-engineering masquerade of its distribution filename (invoice.exe) and its falsified version information.

Application Structure

The ejemplo namespace contains standard WinForms classes:

• ejemplo.Form1 — main entry form ^[strings.txt:1639]
• ejemplo.FormPrincipal — principal form ^[strings.txt:1857]
• ejemplo.MDIParent1 / ejemplo.MDIParent2 — MDI container forms ^[strings.txt:1699,1778]
• ejemplo.AboutBox1 — about dialog with okButton_Click handler ^[strings.txt:1548,1571]
• ejemplo.Properties.Resources — embedded resources ^[strings.txt:1809]

UI event handlers confirm RPG functionality:

• crearPersonajeToolStripMenuItem_Click — "create character" menu item ^[strings.txt:1672]
• btnGenerarPersonaje_Click — "generate character" button ^[strings.txt:1638]

Spanish UI strings present in the binary:

• Nombre, Raza, Magia, FechaNacimiento, Territorios ^[strings.txt: various]

Embedded resource files:

• ejemplo.MDIParent1.resources ^[strings.txt:1858]
• ejemplo.MDIParent2.resources ^[strings.txt:1859]
• ejemplo.Form1.resources ^[strings.txt:1856]
• ejemplo.FormPrincipal.resources ^[strings.txt:1857]
• ejemplo.Properties.Resources.resources ^[strings.txt:1860]
• ejemplo.AboutBox1.resources ^[strings.txt:1854]

Shared Cluster Artifacts

The Trif32 Caesar-shift-23 decoder class is present in the binary, shared with the broader unclassified-dotnet PrimeraVentana / GoldenCity / MyPaint.Editor / Ivanov_WF_Paint / AdvWinProgHW2 clusters ^[strings.txt].

Deltas from Confirmed Siblings

The sample sits between its two siblings in size and reuses the PNG toolbar icon pattern of the first sibling rather than the JPEG replacement set of the second.

Decompiled Behavior

.NET CIL assembly; Ghidra/radare2 native decompilation is of limited value against CIL. The entry point is standard mscoree.dll!_CorExeMain → CLR bootstrap → Application.Run(new Form1()) pattern inferred from WinForms class names and SetCompatibleTextRenderingDefault ^[strings.txt:2022]. No native functions to decompile. No reflection-based payload loading, no Assembly.Load from network or encrypted sources, no MethodBase.Invoke on foreign types. Capa dnfile analysis produced only parser warnings (duplicate #Strings/#GUID/#Blob stream names) with zero capability matches beyond the standard .NET runtime surface ^[capa.txt].

C2 Infrastructure

None. No System.Net, System.Net.Sockets, System.Net.Http, WebClient, HttpWebRequest, or WinInet P/Invoke references recovered. No hardcoded URLs, IPs, domains, or API tokens. No mutexes, named pipes, or marker files. ^[strings.txt] ^[pefile.txt]

Interesting Tidbits

• The internal name kUEo.exe follows the same four-character nonsense-string pattern as HFGe.exe, wHVe.exe, and other unclassified-dotnet siblings — likely auto-generated by a repackaging toolchain. ^[exiftool.json]
• The Thumbnail Handler / Microsoft Corporation version-info masquerade is identical across all three siblings, suggesting a shared repackaging template. ^[pefile.txt]
• The .rsrc section contains a standard UAC manifest (requestedExecutionLevel level="asInvoker") and the VS_VERSIONINFO block — no encrypted payload resources, no bitmap steganography. ^[pefile.txt]
• Binwalk found only the PE header, standard embedded PNG icon data, and a Zlib-compressed .resources blob — no anomaly. ^[binwalk.txt]
• FLOSS failed with an argument-parsing error and produced no decoded strings ^[floss.txt]; standard strings extraction was sufficient because the binary is unobfuscated CIL.

How To Mess With It (Homelab Replication)

This is a benign WinForms educational app; replicating the malware threat means replicating the social-engineering delivery, not the payload.

1. Build any .NET Framework 4.0 WinForms app in Visual Studio (Debug configuration).
2. Use a resource editor (e.g., Resource Hacker, rcedit) to overwrite VS_VERSIONINFO with:
   • CompanyName: Microsoft Corporation
   • FileDescription: Thumbnail Handler
   • ProductName: Thumbnail Handler
3. Rename the output to invoice.exe or PO<numbers>.exe.
4. Observe that standard triage pipelines will flag it as suspicious based on filename + version-info mismatch alone.

Verification: run capa on the reproducer. It should produce the same dnfile parser warnings and zero meaningful capability matches (or T1620 false positives from Debug-build attributes if present).

Deployable Signatures

YARA Rule

rule UnclassifiedDotNet_SpanishRPG_CharGen
{
    meta:
        description = "Spanish RPG character generator repackaged as social-engineering lure"
        author = "triage-pipeline"
        reference = "4cf48ffc9f596563aeb6d774e5f222c8ef639f62df9dd87c99c7be32f71643c2"
        family = "unclassified-dotnet"
    strings:
        $ns = "ejemplo" ascii wide
        $class1 = "Personaje" ascii wide
        $class2 = "MDIParent1" ascii wide
        $class3 = "crearPersonajeToolStripMenuItem_Click" ascii wide
        $ui1 = "Nombre" ascii wide
        $ui2 = "Raza" ascii wide
        $ui3 = "Magia" ascii wide
        $trif = "Trif32" ascii wide
        $desc = "Thumbnail Handler" ascii wide
        $company = "Microsoft Corporation" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $ns and ($class1 or $class2 or $class3) and
        ($ui1 or $ui2 or $ui3) and
        $trif and
        $desc and $company
}

Sigma Rule

title: UnclassifiedDotNet Spanish RPG Character Generator Execution
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - Image|endswith:
        - '\\invoice.exe'
        - '\\PO82200287.exe'
        - '\\Purchase_Order.pdf.exe'
    - OriginalFileName:
        - 'kUEo.exe'
        - 'HFGe.exe'
        - 'wHVe.exe'
  condition: selection
falsepositives:
  - None expected; these are fabricated internal names not used by legitimate software.
level: low

IOC List

Behavioral Fingerprint

This binary is a .NET Framework 4.0 PE32 with no native imports beyond mscoree.dll, no network APIs, no persistence mechanisms, and no process injection. It launches a WinForms MDI GUI with Spanish RPG character-creation menus. The only threat is social engineering: the distribution filename (invoice.exe) and fabricated Microsoft version information are designed to trick users into executing a benign application. Capa analysis produces zero meaningful capability matches. Suitable for low-priority triage whitelisting when the RPG class names are confirmed present.

Detection Signatures

References

• OpenCTI artifact: 99862a13-5da3-4853-ad05-47d95fe5d4bc ^[metadata.json]
• Sibling analysis: ad301389 — Spanish RPG character generator (HFGe.exe, PO82200287.exe) ^[/intel/analyses/ad301389152cb26900d3c06ea4f604dec119bf566b2f49dcdfdc21c658574420.html]
• Sibling analysis: 644892e9 — Spanish RPG character generator (wHVe.exe, Purchase_Order.pdf.exe) ^[/intel/analyses/644892e9fe96231990ad8095237bafee16d1fb77aadde35cd20105cef5f4b922.html]
• Entity page: unclassified-dotnet
• Concept: social-engineering-filename-lure
• Concept: version-info-masquerade

Provenance

• file.txt — file(1) 5.44
• pefile.txt — pefile 2023.2.7
• strings.txt — GNU strings 2.40
• exiftool.json — ExifTool 12.76
• rabin2-info.txt — radare2 5.9.4
• capa.txt — capa 7.3.0 (dnfile backend)
• binwalk.txt — binwalk v2.3.4
• floss.txt — flare-floss 3.1.1 (failed — argument parse error)
• metadata.json / triage.json — triage-fast.sh pipeline
• Binary path: <sample 4cf48ffc9f59.bin>

Analysis date: 2026-07-07