4f79aee0 — MicroMouseSimul .NET WinForms maze simulator

Build / RE

PE32 .NET assembly, 923 KB, compiled for .NET Framework v4.0.30319 (CLR 4.0) ^[file.txt]. Internal name hDQd.exe, assembly version 2.1.1.1, VS_VERSIONINFO product version 4.0.0.0 ^[strings.txt:45] ^[strings.txt:53]. No Authenticode signature (unsigned) ^[pefile.txt]. No packing, no obfuscation, no native API imports, no anti-analysis, no anti-debug ^[capa.txt] ^[pefile.txt].

Language & toolchain: C# compiled to CIL. Namespace MicroMouseSimul.MicroMouse with companion namespaces MicroMouseSimul.Algorithms and MicroMouseSimul.Properties ^[strings.txt:34] ^[strings.txt:39]. Primary framework references: System.Windows.Forms, System.Drawing, System.Core, System.IO, System.Threading, System.Resources, System.Runtime.Serialization.Formatters.Binary, System.IO.Compression ^[strings.txt:17-39].

Resource directory contains standard WinForms artefacts: application icon (RT_ICON / ID 1, 2491 bytes), group-icon directory (RT_GROUP_ICON / ID 32512), and VS_VERSIONINFO block (RT_VERSION / ID 1, 880 bytes) ^[pefile.txt] ^[binwalk.txt].

Capa produces three hits — all false positives from standard .NET Runtime behaviour:

• T1620 (reflective loading) — triggered by System.Reflection metadata and MethodBase/Invoke patterns used for benign WinForms delegate invocation ^[capa.txt].
• T1497.001 (system checks) — triggered by System.Globalization and EditorBrowsableState compiler-generated attributes ^[capa.txt].
• B0013.001 (anti-static analysis) — triggered by DebuggerBrowsableState / DebuggableAttribute present in Debug-configuration builds ^[capa.txt].

No System.Net, System.Security.Cryptography, System.Diagnostics.Process, System.ServiceProcess, or other malicious-capability namespaces present ^[strings.txt].

Notable class / method identifiers:

• MazeSolvingStatusHolder, BackgroundWorker, drawCellData, drawRobot, ValidateCells — UI rendering and simulation loop ^[strings.txt:3-12].
• BinaryFormatter, DeflateStream, GetData — used for maze-map serialisation (.map / .maz files) ^[strings.txt:13-15].
• TrunRight, TrunLeft, TrunBack — typo-style method names ("Trun" instead of "Turn") indicating student-grade code quality ^[strings.txt:30-32].
• Robot Direction is not Valid. But How!? Fuck you! — developer error-message string confirming non-professional origin ^[strings.txt:48].

The .text section is 0xE1D34 bytes (~926 KB) with zero entropy anomalies; the binary is a standard unobfuscated CIL assembly with embedded .rsrc bitmaps and no overlay ^[pefile.txt] ^[binwalk.txt].

Deploy / ATT&CK

No malicious payload. No network C2, no persistence, no credential access, no process injection, no crypto-ransom, no anti-analysis, and no data exfiltration behaviour.

The threat model is purely social-engineering masquerade: the benign educational / hobbyist maze-simulation program is repackaged with a purchase-order-themed distribution filename to trick finance/procurement staff into executing it. This pattern is consistent with the broader unclassified-dotnet cluster of benign .NET applications repackaged as business-document lures.

Static-only assessment. No CAPE dynamic analysis available (no Windows guest). Runtime behaviour inferred from CIL namespace surface and string corpus is consistent with a WinForms GUI application that loads maze definition files, simulates a robot traversing the grid, and renders the result.

Family & Attribution

Belongs to the unclassified-dotnet umbrella — benign .NET Framework applications repackaged with social-engineering filenames. Not a named malware family. No builder fingerprints, no packer signatures, no code-reuse links to known threat actors.

High-confidence assessment: benign payload, malicious distribution context.