unclassified-dotnet: 5335da6d — WinForms paint editor with Trif32 decoder (QUOTE lure)

Executive Summary

A .NET Framework 4.0 WinForms vector-drawing application (Paint namespace, internal name wvIf.exe) repackaged with the social-engineering filename QUOTE-2K840322-A-CCC.exe. Contains the Trif32 Caesar-shift-23 decoder shared with the PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint/AdvWinProgHW2 clusters. No packing, no obfuscation, no network APIs, no persistence, and no malicious payload. Capa T1620/B0013.001 flags are false positives from Debug-build compiler attributes. Unsigned. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

The binary is an unobfuscated CIL assembly with a single-namespace WinForms paint/drawing editor (Paint). Classes include MainForm (main canvas), NewImageDialog, LineStyleChoicer, HatchChoicer, LineWidthChoicer, ColorChoicer, ZoomForColorChoice, MyRectangle, MyLine, MyEllipse, MyFill, IShape, ShapeException, and BufferedGraphics wrapper. The UI supports GDI+ shape primitives (line, rectangle, ellipse), pen/fill tools, line-style chooser, hatch chooser, colour picker, zoom, layer management, and image save/load (BMP/JPEG/PNG/GIF). ^[strings.txt:35-500]

No System.Net, System.Security, Registry, Process, or cryptographic namespaces are referenced. The only namespace beyond System.Drawing and System.Windows.Forms is System.Text.RegularExpressions (used for the IsMatch method on input validation). ^[strings.txt:540-550]

How It Works

The binary is a fully functional WinForms paint application. On launch it creates a MainForm with a TableLayoutPanel hosting a GDI+ canvas (panel1), a toolstrip with draw-mode buttons (pen, line, rectangle, ellipse, fill, text), and docked chooser controls for colour, line width, line style, and hatch pattern. The canvas uses BufferedGraphics for double-buffered rendering to avoid flicker. ^[strings.txt:503-508]

Image save/load dialogs use standard SaveFileDialog/OpenFileDialog with filters for BMP, JPEG, PNG, and GIF. ^[strings.txt:263-266] The NewImageDialog prompts for canvas width/height with validation. ^[strings.txt:394]

The GetXorByte method at offset ~0xA0 in .text ^[strings.txt:226] and the ComputeStringHash method ^[strings.txt:271] are compiler-generated artifacts from C# compiler string-switch optimizations (Roslyn ComputeStringHash for switch on string literals), not malware-specific crypto.

Decompiled Behavior

No Ghidra/radare2 deep decompilation was required — the CIL metadata is fully unobfuscated. The entry point is standard .NET _CorExeMain via mscoree.dll. ^[pefile.txt:251] The MainForm constructor calls InitializeComponent() which wires up WinForms event handlers (add_Load, add_Click, add_MouseDown, add_MouseMove, add_MouseUp, add_Paint, etc.) via standard delegate multicast. ^[strings.txt:59-85]

The Trif32 class (offset ~0x200 in .text) contains a single static Decode method that performs a Caesar cipher with shift=23 (equivalent to ROT-23 or shift backward by 3). This is identical to the decoder observed in the PrimeraVentana, GoldenCity, MyPaint.Editor, Ivanov_WF_Paint, AdvWinProgHW2, and Pizzaria clusters. ^[strings.txt:20] In those samples the decoder is used for trivial embedded-string decoding (likely a shared coursework utility). Here it appears in the same form but its exact call site is not exercised by the visible UI surface.

C2 Infrastructure

None. No network APIs, no hardcoded IPs, domains, URLs, mutexes, named pipes, or registry keys. The threat vector is purely social-engineering masquerade.

Interesting Tidbits

• QUOTE lure filename — Business-document social-engineering: QUOTE-2K840322-A-CCC.exe targets procurement/finance employees with a fake quotation document. This follows the same pattern as the unclassified-dotnet-crypter-loader siblings (PO1.exe, P.O_.exe) but with a benign payload. ^[triage.json:5]
• Empty VS_VERSIONINFO — FileDescription: (single space), LegalCopyright: , AssemblyVersion: 0.0.0.0, ProductVersion: 0.0.0.0 ^[exiftool.json:36-41] — a common trait of repackaged benign .NET samples where the repackager strips or leaves default version info.
• Internal name wvIf.exe — Nonsense auto-generated internal name, same pattern as NZiU.exe, Zfio.exe, fiwi.exe, pKDK.exe in other benign repackaged .NET samples. ^[exiftool.json:38]
• Trif32 decoder fingerprint — This is the twelfth confirmed sample carrying the Trif32 Caesar-shift decoder in the corpus, confirming a shared coursework origin or a single repackager reusing the same benign codebase. ^[strings.txt:20]
• Capa false positives — T1620 (Reflective Code Loading) triggered by DebuggableAttribute + MethodBase::Invoke (standard WinForms event dispatch). B0013.001 (Analysis Tool Discovery) triggered by DebuggerNonUserCodeAttribute. Both are Debug-build compiler artifacts, not anti-analysis. ^[capa.txt:15-16]
• Binwalk finds only benign resources — 523×523 PNG icon, multiple 128×128 and 48×48 toolbar icons, Zlib-compressed .resources blobs for WinForms localization. ^[binwalk.txt:13-40]
• No .NET manifest resource payload — Unlike unclassified-dotnet-crypter-loader siblings, there is no large encrypted manifest resource (~919 KB) or raw overlay payload. The .rsrc section is only 0xF50 bytes (3,920 bytes) of icons and version info. ^[pefile.txt:100-116]

How To Mess With It (Homelab Replication)

This is a benign paint application, not malware. Replication is trivial:

1. Open Visual Studio → New Project → Windows Forms App (.NET Framework 4.0)
2. Add a Panel for canvas, ToolStrip for draw-mode buttons, and docked user controls for colour/line-width/line-style/hatch choosers
3. Implement GDI+ drawing with Graphics.DrawLine, DrawRectangle, DrawEllipse, FillRectangle, FillEllipse
4. Add a Trif32 class with a static Decode method doing (char)(c + 23)
5. Build in Debug configuration
6. Rename output to QUOTE-2K840322-A-CCC.exe
7. Run capa — expect T1620 and B0013.001 false positives

Verification: capa should hit the same false positives as this sample. Compare capa.txt — T1620 from DebuggableAttribute + MethodBase::Invoke, B0013.001 from DebuggerNonUserCodeAttribute.

Deployable Signatures

YARA rule — Benign .NET paint editor with Trif32 decoder

rule dotnet_paint_editor_trif32_false_positive
{
    meta:
        description = "Detects benign .NET WinForms paint/drawing applications with Trif32 decoder — false-positive cluster"
        author = "PacketPursuit"
        date = "2026-07-09"
        sha256 = "5335da6d96c3dbf74623c5ec6374b8bd7b95966e3a40a4d37347984a7c17d029"
    strings:
        $a = "Trif32" ascii wide
        $b = "Paint.MainForm.resources" ascii wide
        $c = "Paint.NewImageDialog.resources" ascii wide
        $d = "Paint.Properties.Resources.resources" ascii wide
        $e = "LineStyleChoicer" ascii wide
        $f = "HatchChoicer" ascii wide
        $g = "ColorChoicer" ascii wide
        $h = "BufferedGraphics" ascii wide
        $i = "IShape" ascii wide
        $j = "ShapeException" ascii wide
        $k = "GetXorByte" ascii wide
        $l = "wvIf.exe" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.imports("mscoree.dll", "_CorExeMain") and
        $a and
        4 of ($b, $c, $d, $e, $f, $g, $h, $i, $j, $k, $l)
}

Sigma rule — .NET WinForms paint editor execution

Not applicable — this is a benign application. No suspicious behavior to detect at runtime.

IOC list

Behavioral fingerprint statement

This binary is a .NET Framework 4.0 WinForms paint/drawing application with GDI+ canvas, shape primitives, colour/line-style/hatch choosers, and image save/load. It contains a trivial Trif32 Caesar-shift decoder (shift=23) shared with the PrimeraVentana/GoldenCity/MyPaint.Editor coursework cluster. No network APIs, no persistence, no anti-analysis, no payload. Capa T1620 and B0013.001 are false positives from Debug-build compiler attributes. Threat is purely social-engineering masquerade.

Detection Signatures

References

• Artifact ID: 3e7fead7-49f8-4059-b7a5-ed240b3ba2e8 ^[triage.json:4]
• Source: MalwareBazaar (OpenCTI connector urlhaus-recent-payloads) ^[metadata.json:10]
• Related wiki pages: unclassified-dotnet, trif32-caesar-shift-23-decoder, debug-build-capa-false-positives, social-engineering-filename-lure

Provenance

Analysis based on static artifacts in raw/analyses/5335da6d96c3dbf74623c5ec6374b8bd7b95966e3a40a4d37347984a7c17d029/:

• file.txt — file(1) output
• exiftool.json — EXIF/PE metadata
• pefile.txt — pefile dump (DOS/NT headers, sections, imports, resources, version info)
• strings.txt — full ASCII/Unicode strings (2176 lines)
• capa.txt — Mandiant capa v7 static analysis
• rabin2-info.txt — radare2 binary info
• binwalk.txt — embedded file carving
• triage.json — triage pipeline metadata
• yara.txt — YARA matches (only generic PE_File_Generic)
• dynamic-analysis.md — CAPE sandbox status (skipped — no Windows guest)

No floss output available (tool invocation errored with invalid argument). No Ghidra decompilation required (unobfuscated CIL). No radare2 deep analysis performed (surface questions answered by strings + pefile).