unclassified-dotnet: 4d780fea — Hadouken WinForms inventory CRUD app with MySQL backend and .bat.exe double-extension lure

Executive Summary

A .NET Framework 4.0 C# WinForms inventory-management CRUD application (namespace Hadouken, internal name zzCV.exe) with a MySQL (MySql.Data) backend, repackaged with a .bat.exe double-extension filename (##Swift_Copy.bat.exe). The binary contains the Trif32 Caesar-shift-23 decoder shared with the PrimeraVentana/GoldenCity/MyPaint.Editor educational-app cluster. No malicious payload, no network APIs beyond the MySQL connector, no persistence, no anti-analysis. Capa T1620 and T1083 flags are false positives from Debug-build compiler attributes and benign System.IO file operations. The Credit_Cart typo in a method name (get_Credit_Cart_2) and student-grade UI control naming (txtacc, txtpword, MAGIC_WORD) strongly indicate a coursework or student-project origin. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

The PE has three standard sections (.text, .rsrc, .reloc) with no packing, no obfuscation, and no native API imports beyond mscoree.dll._CorExeMain. ^[pefile.txt:78-137] The .text section entropy is 7.81 (high, typical for CIL bytecode). The .rsrc section contains multiple PNG/JPEG/PC bitmap UI assets. ^[binwalk.txt]

How It Works

The binary is a complete WinForms CRUD (Create-Read-Update-Delete) inventory-management application with a MySQL database backend. The UI is built with standard System.Windows.Forms controls across multiple forms.

Key namespaces and classes (from CIL metadata strings):

• Hadouken — root namespace ^[strings.txt:295, 457]
• Hadouken.ItemInfoForm — item detail form ^[strings.txt:370]
• Hadouken.CategoryForm — category management form ^[strings.txt:371]
• Hadouken.Main — main dashboard/form ^[strings.txt:372]
• Hadouken.Login — authentication form ^[strings.txt:373]
• Hadouken.user — user management form ^[strings.txt:374]
• Hadouken.Properties.Resources — embedded .resources blobs for UI images ^[strings.txt:375]
• Hadouken.IO — namespace for file I/O helpers ^[strings.txt:107]

Database layer:

• MySql.Data.MySqlClient — the Oracle/MySQL ADO.NET connector ^[strings.txt:111, 419]
• MySqlConnection, MySqlCommand, MySqlDataReader — standard MySQL database access ^[strings.txt:313, 139, 329]
• DbConnection, DbCommand, DbDataReader — base ADO.NET interfaces ^[strings.txt:138, 139, 328]
• ConnectionString — connection-string property ^[strings.txt:230]
• ExecuteNonQuery, ExecuteReader — CRUD operation methods ^[strings.txt:330, 451]

UI controls (extensive DataGridView/tabbed interface):

• dataGridView1 through dataGridView3 with DataGridViewTextBoxColumn columns ^[strings.txt:30-62]
• tabControl1 with tabPage1 through tabPage4 ^[strings.txt:27-66]
• textBox1 through textBox7 for text input ^[strings.txt:33-91]
• button1 through button11 with click handlers (button1_Click, button10_Click, etc.) ^[strings.txt:32-102, 245-258]
• label1 through label22 for UI labels ^[strings.txt:28-98]
• groupBox1 through groupBox3 for layout grouping ^[strings.txt:34-62]

Authentication / access-control fields:

• MAGIC_WORD — hardcoded or user-supplied access code field ^[strings.txt:104]
• magicWord — property backing field ^[strings.txt:142]
• txtacc — account/username textbox ^[strings.txt:115]
• txtpword, txtaddpword — password textboxes (login and add-user forms) ^[strings.txt:143, 144]
• btnlogin, btnlogin_Click — login button and handler ^[strings.txt:265, 296]

File-management helpers:

• ConductFindReplace, IsValidFileForReplace, ReplaceLastOccurance — find/replace utility ^[strings.txt:145-147]
• IFileDataSource, IDirectoryDataSource, IOutputController, IValidFileFactory — interface-driven architecture suggesting a coursework design pattern ^[strings.txt:149, 152, 341, 452]
• FindReplaceHelper, RenameHelper — utility classes ^[strings.txt:344, 345]
• FileRenameCounter, FolderRenameCounter — batch rename counters ^[strings.txt:349, 350]
• GetValidFileExtensionList, IsValidFile — file-validation methods ^[strings.txt:427, 166]

Notable developer artifact — Credit_Cart typo: The method get_Credit_Cart_2 at strings.txt offset 41 contains a misspelling of "Credit Card" as "Credit Cart". This is a strong indicator of a non-native-English student developer, not a professional crimeware author. The method name pattern (get_ prefix) is a C# auto-property getter.

Embedded resources (binwalk):

• PNG images: 256×256, 512×512, 520×520, 233×106, 233×30, 256×256 (UI icons, logos, backgrounds) ^[binwalk.txt:6-9, 20-21, 26-27]
• JPEG images: multiple JFIF-standard photos (likely product images or sample data) ^[binwalk.txt:14-18, 20, 25]
• PC bitmap: 130×129×32 (Windows 3.x format, likely a toolbar button) ^[binwalk.txt:19]
• Standard .NET .resources blobs and UAC manifest (not parsed by binwalk but present in .rsrc)

Decompiled Behavior

No native decompilation was performed — this is a .NET CIL assembly and the available static tools (strings, capa, pefile) provide sufficient metadata surface for assessment. The binary is unstripped and unobfuscated; all class/method/field names are visible in the #Strings CIL metadata stream. There is no ConfuserEx, SmartAssembly, Xenocode, or other .NET obfuscator signature. No P/Invoke (DllImport) declarations were observed. No System.Reflection.Emit, Assembly.Load(byte[]), or other reflective-loading patterns were detected beyond the standard .NET JIT bootstrap (which capa incorrectly flags as T1620).

C2 Infrastructure

No C2 indicators. The only external connectivity surface is the MySql.Data ADO.NET connector, which would connect to a user-configured MySQL server at runtime. No hardcoded server IP, hostname, or connection string was recovered in static strings. The MySQL connector is a legitimate Oracle library commonly used in .NET coursework.

Interesting Tidbits

• ##Swift_Copy.bat.exe filename: Uses ## prefix (sorts to top of directory listings in some file managers) and .bat.exe double-extension masquerade. "Swift_Copy" implies a banking/wire-transfer context, fitting the social-engineering pattern of the cluster. ^[triage.json:5]
• Hadouken branding: The VS_VERSIONINFO and namespace both reference "Hadouken" (a Street Fighter special-move reference). Combined with zzCV.exe internal name (likely a student's initials or handle), this strongly suggests a personal/student project. ^[exiftool.json:38, 42]
• Copyright 2015 vs. compile 2024: The version info claims Copyright © 2015, but the PE timestamp is Sep 2024. This 9-year gap suggests either old code recompiled, or a template left unchanged. ^[exiftool.json:41] ^[pefile.txt:34]
• IL linker v48.0: The linker version (48.0 = 0x30) indicates compilation with the .NET Framework 4.x toolset, consistent with the v4.0.30319 runtime string. ^[pefile.txt:45]
• Trif32 presence: The Trif32 string at offset 40 in strings.txt links this sample to the PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint/AdvWinProgHW2/Pizzaria/Windows_User_Interaction cluster of benign educational apps. ^[strings.txt:40] ^[concepts/trif32-caesar-shift-23-decoder.md]
• No System.Net or System.Web: Unlike the unclassified-dotnet-crypter-loader or unclassified-dotnet-protobuf-loader families, this sample has zero network surface beyond the database connector. No HttpWebRequest, WebClient, TcpClient, Socket, or SmtpClient references. This is a local/desktop application.

How To Mess With It (Homelab Replication)

This is a benign student project; replication is straightforward:

1. Toolchain: Visual Studio 2015–2022 Community, .NET Framework 4.0 target, C# WinForms Application template.
2. Dependencies: Install MySql.Data NuGet package (Oracle MySQL Connector/NET).
3. Build: Create a multi-form WinForms app with TabControl, DataGridView, TextBox, Button controls. Implement CRUD operations via MySqlConnection + MySqlCommand. Add a Trif32 static class with a Caesar-shift-23 decoder as a programming exercise.
4. Verification: Compile and run capa on the output. Expect T1620 (reflective loading) and T1083 (file discovery) false positives from Debug-build attributes and System.IO.Directory.EnumerateFiles usage if your app includes file browsing.

Deployable Signatures

YARA rule

rule dotnet_hadouken_inventory_app_fingerprint
{
    meta:
        description = "Detects .NET Framework Hadouken-namespace inventory CRUD app with Trif32 decoder"
        author = "PacketPursuit"
        date = "2026-07-08"
    strings:
        $a = "Hadouken" ascii wide
        $b = "zzCV.exe" ascii wide
        $c = "Trif32" ascii wide
        $d = "MySql.Data.MySqlClient" ascii wide
        $e = "MAGIC_WORD" ascii wide
        $f = "get_Credit_Cart_2" ascii wide
        $g = "ConductFindReplace" ascii wide
        $h = "ItemInfoForm" ascii wide
        $i = "CategoryForm" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.imports("mscoree.dll", "_CorExeMain") and
        $a and $b and $c and $d and any of ($e, $f, $g, $h, $i)
}

IOC list

Behavioral fingerprint

This binary is a .NET Framework 4.0 WinForms desktop application presenting a multi-tab CRUD inventory interface with embedded PNG/JPEG UI assets and MySQL database connectivity. It contains no network C2 surface, no persistence mechanisms, no process injection, no credential-harvesting APIs, and no anti-analysis countermeasures. The presence of Trif32, MAGIC_WORD, and get_Credit_Cart_2 method names indicates student-grade code quality. When observed in the wild under a .bat.exe or .pdf.exe filename, the threat is social-engineering masquerade — the application itself is benign.

Detection Signatures

capa → ATT&CK mapping (with false-positive assessment)

References

• Artifact ID: c7509206-9896-4f08-badb-0469f97e6b7d ^[triage.json:4]
• OpenCTI labels: exe, malware-bazaar ^[metadata.json:6-9]
• Related wiki pages: unclassified-dotnet, trif32-caesar-shift-23-decoder, social-engineering-filename-lure, debug-build-capa-false-positives, double-extension-masquerade

Provenance

Analysis based on static artifacts generated by the triage pipeline: file v5.44, exiftool v12.76, pefile (Python), strings (GNU binutils), floss (errored — no decoded strings), capa v7.x (static analysis mode), binwalk v2.3.3, radare2 (rabin2 -I), yara v4.x (PE_File_Generic rule), ssdeep v1.1, tlsh v4.x. No CAPE dynamic analysis was performed (no Windows guest available). All observations are static-only and reproducible with the same tool versions on the provided sample.