unclassified-dotnet: 54956960 — Lab4CSharp WinForms picture-viewer lab with CV lure and PictureViewer masquerade

Executive Summary

A .NET Framework 4.0 C# WinForms educational picture-viewer / drawing application (Lab4CSharp namespace, internal name srza.exe) repackaged with a CV-themed social-engineering filename (CV_Forner_Eugenia.exe). VS_VERSIONINFO masquerades as LabSharp / PictureViewer v8.4.1.1. Contains the Trif32 Caesar-shift-23 decoder shared with the PrimeraVentana/GoldenCity/MyPaint.Editor/AdvWinProgHW2/Pizzaria/Ivanov_WF_Paint/Checkers/Hadouken/Paint clusters. No packing, no obfuscation, no network APIs, no persistence, no anti-analysis. Capa T1620/T1083/B0013.001 flags are false positives from Debug-build compiler attributes. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

The PE has three standard sections (.text entropy 7.98, .rsrc entropy 2.93, .reloc entropy 0.10) with no packing, no obfuscation, and no native API imports beyond mscoree.dll._CorExeMain. ^[pefile.txt:78-137]

How It Works

The binary is a benign C# Windows Forms educational application — a picture viewer / basic image editor with colour-picking, drawing primitives, and a menu-driven UI. The Lab4CSharp namespace and PictureViewer product name suggest it is a university or vocational-school coursework assignment ("Lab 4" in a C# curriculum). ^[strings.txt:265,285,302-307]

Application Structure

Key classes and namespaces from CIL metadata strings:

• Lab4CSharp.Form1 / Form2 — main image-viewer forms with Form1_Load / Form2_Load handlers ^[strings.txt:68-70]
• PictureViewer.Form0 — secondary form / child window ^[strings.txt:302]
• PictureViewer.Properties.Resources — embedded .resources blobs for icons and UI assets ^[strings.txt:304,307]
• Program — standard Main() entry point with STAThreadAttribute ^[strings.txt:210,126]

UI control surface (all standard WinForms toolbox items):

• PictureBox (pictureBox1), CheckBox (checkBox1–checkBox5), RadioButton (RadioButton1–RadioButton2) ^[strings.txt:26,28,36,48]
• ToolStrip (ToolStrip1), StatusStrip (StatusStrip1), MenuStrip (MenuStrip1) ^[strings.txt:21-23]
• ToolStripButton1–ToolStripButton11, ToolStripSeparator1–ToolStripSeparator3 ^[strings.txt:20,25,38,43,47,49,52-55]
• ListBox1, TextBox1, GroupBox1, TableLayoutPanel, FlowLayoutPanel ^[strings.txt:30-31,29,16-17]
• SaveFileDialog1, OpenFileDialog1, ColorDialog1 ^[strings.txt:11-14]
• Timer1 with Timer1_Tick handler ^[strings.txt:24,180-181]

Drawing / image-processing methods:

• FillRectangle, DrawRectangle, FillEllipse, DrawEllipse, FillPolygon, DrawPolygon ^[strings.txt:96-97,123-124,235-236]
• FromArgb, get_Red, get_Green, get_Blue, get_Black, get_Magenta, get_Aqua — colour/channel accessors ^[strings.txt:64,71,230,147,179,62,63]
• set_Image, set_SizeMode (PictureBoxSizeMode), Bitmap — image display and loading ^[strings.txt:88,85,260]

Event handlers confirm interactive image editing:

• Button1_Click–Button2_Click, backgroundButton_Click, closeButton_Click, clearButton_Click, showButton_Click, Run_Click, Info_Click, Exit_Click, Result_Click, About_Click, Input_Click, AddWindow_Click, CloseWindow_Click ^[strings.txt:182-199]
• Reneme_Click / RenameToolStripMenuItem — typoed "Rename" preserved from student source ^[strings.txt:185,213-214]

Trif32 decoder: The Trif32 class name appears at line 32 of strings.txt — a shared Caesar-shift-23 string decoder also observed in the PrimeraVentana educational-app cluster (a42443c8, c4ee3a31081d, cae7ac1dc419, 6a53c56172ce), the GoldenCity game cluster (61c10411, 92de8242), the MyPaint.Editor vector-drawing app (6bc4e16d), the Ivanov_WF_Paint editor (6d114209), the AdvWinProgHW2 calculator (724d94aa), the Pizzaria POS/CRM (7b3ef687), the Checkers game (4cce5506), the Hadouken inventory app (4d780fea), and the Paint editor (5335da6d). ^[strings.txt:32] This confirms a shared coursework template or instructor-provided helper class reused across multiple student projects.

Colour-processing helper methods: The binary contains GetXorByte/xorByte, GetGValue/gValue, and CalculateIntermediate1–CalculateIntermediate4 / CalculateKi / CalculateLast — all consistent with RGB/HSV colour-space conversion utilities in a picture-editing application, not cryptographic payload decryption. ^[strings.txt:145-149,9-10,34-35,40-41,45-46,177,345]

Embedded Resources

Binwalk confirms four embedded PNG images (256×256 and 128×128 toolbar/background icons) and standard Zlib-compressed .resources blobs. ^[binwalk.txt] The .rsrc section is only 0x388 bytes (low entropy 2.93), containing the VS_VERSIONINFO block plus a small icon bitmap. No encrypted overlay, no steganographic bitmap carriers, no manifest-resource payload. The total resource footprint is consistent with a simple WinForms lab assignment, not a loader or dropper.

No threat logic: Absence of System.Net, System.Security.Cryptography, System.Diagnostics.Process, System.IO.FileSystemWatcher, registry, or native API P/Invoke references. The only "cryptographic" references (GetXorByte, xorByte) are colour-channel XOR utilities, not payload encryption. ^[strings.txt:145-146]

Decompiled Behavior

No Ghidra/pyghidra analysis was performed — the binary is a standard .NET Framework CIL assembly with no native code. radare2 confirms cil language, signed: false, overlay: false, and 33 standard .NET method stubs. ^[rabin2-info.txt]

Entry point is _CorExeMain via mscoree.dll import, standard for .NET PE32. ^[pefile.txt:255]

C2 Infrastructure

None. No hardcoded IPs, domains, URLs, mutexes, named pipes, or registry keys related to C2.

Interesting Tidbits

• VS_VERSIONINFO fabrication: The version-info block invents a fake company LabSharp and product PictureViewer (v8.4.1.1 / AssemblyVersion 8.5.0.6) that do not correspond to any known legitimate software. This is pure masquerade to make the binary appear benign during triage. ^[exiftool.json:37-46]
• "Reneme" typo: The Reneme_Click event handler and RenemeToolStripMenuItem UI item both misspell "Rename" as "Reneme" — a human typo preserved from the original student coursework. ^[strings.txt:185,213-214]
• get_homer property: An unusual property name get_homer in the string table (line 278) suggests the original developer used whimsical or placeholder naming, consistent with student-grade code. ^[strings.txt:278]
• Capa false positives: The "anti-analysis" hit (reference analysis tools strings) is triggered by DebuggerNonUserCodeAttribute and DebuggableAttribute present in Debug-configuration builds. ^[capa.txt] The MBC B0013.001 (Process detection) is similarly a false positive from standard .NET JIT/debug metadata. The T1620 (Reflective Code Loading) and T1083 (File and Directory Discovery) flags are also false positives from InvokeMember (used in WinForms resource-manager initialization) and Exists (used in file-dialog path validation). ^[capa.txt]
• CV-themed lure: The distribution filename CV_Forner_Eugenia.exe targets HR/recruitment workflows — a curriculum-vitae lure where the victim expects a job applicant's resume. This is higher-fidelity than generic "Invoice" lures because CVs are expected to arrive as executables only in very specific (and suspicious) contexts, yet the filename itself is plausible enough to lower guard in poorly trained environments.
• F706170C... static array: A __StaticArrayInitTypeSize=56 with hex constant F706170C62CCEFA855935D11B203B15765E30E87A115C77FF37ADFBADB2C5B8A appears in the CIL metadata. This is likely a compiler-generated salt or hash for the Trif32 decoder or a resource manifest, not a cryptographic key. ^[strings.txt:58]

How To Mess With It (Homelab Replication)

Toolchain: Visual Studio 2019/2022, .NET Framework 4.0, C# WinForms Application template.

Build steps:

1. Create a new C# WinForms App (.NET Framework 4.0).
2. Add PictureBox, MenuStrip, ToolStrip, StatusStrip, ColorDialog, OpenFileDialog, SaveFileDialog to Form1.
3. Add a Trif32 utility class with Caesar-shift-23 decoder (see trif32-caesar-shift-23-decoder).
4. Implement FillRectangle, DrawRectangle, FillEllipse, DrawEllipse with System.Drawing.Graphics.
5. Add a Timer1 control with a Tick handler for animation or slideshow cycling.
6. Build in Debug configuration to reproduce the capa false-positive fingerprint.

Verification step: Run capa <repro.exe> and confirm hits on T1620, T1083, C0021.003, and B0013.001 — identical false-positive pattern to this sample.

Deployable Signatures

YARA rule — Lab4CSharp / PictureViewer cluster fingerprint

rule dotnet_lab4csharp_pictureviewer_masquerade
{
    meta:
        description = "Detects .NET Framework PE32 with Lab4CSharp/PictureViewer namespace and Trif32 decoder — benign educational app repackaged for social engineering"
        author = "PacketPursuit"
        date = "2026-07-09"
        reference = "549569602f3994b3b7058689b193a28d568cff27d4bbdfcfd527c36890579884"
    strings:
        $a = "Lab4CSharp" ascii wide
        $b = "PictureViewer" ascii wide
        $c = "Trif32" ascii wide
        $d = "LabSharp" ascii wide
        $e = "srza.exe" ascii wide
        $f = "get_homer" ascii wide
        $g = "Reneme_Click" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.imports("mscoree.dll", "_CorExeMain") and
        any of ($a, $b, $d) and
        $c and
        filesize < 1MB
}

Sigma rule — .NET Debug-build false-positive detection (capa-correlated)

title: .NET Debug-Build Capa False-Positive Pattern
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '.exe'
        CommandLine|contains:
            - 'Lab4CSharp'
            - 'PictureViewer'
            - 'LabSharp'
    condition: selection
falsepositives:
    - Benign student coursework distributed under social-engineering filenames
level: informational

IOC list

Behavioral fingerprint statement

This binary is a .NET Framework 4.0 CIL assembly with a standard three-section PE layout (.text / .rsrc / .reloc), no packing, no native API imports beyond mscoree.dll!_CorExeMain, and a VS_VERSIONINFO block masquerading as LabSharp PictureViewer. It contains the Trif32 Caesar-shift-23 decoder class shared across a cluster of benign student coursework projects (PrimeraVentana, GoldenCity, MyPaint.Editor, AdvWinProgHW2, Ivanov_WF_Paint, Pizzaria, Checkers, Hadouken, Paint). The application is a WinForms picture viewer with PictureBox, MenuStrip, ToolStrip, ColorDialog, and drawing primitives (FillRectangle, DrawEllipse). No network, registry, process-injection, or persistence APIs are present. The capa-detected T1620, T1083, C0021.003, and B0013.001 capabilities are false positives from Debug-build compiler attributes and standard .NET reflection / file-dialog usage.

Detection Signatures

References

• Artifact: 549569602f3994b3b7058689b193a28d568cff27d4bbdfcfd527c36890579884 (MalwareBazaar)
• Related cluster: unclassified-dotnet — benign .NET Framework educational-app masquerade cluster
• Shared decoder concept: trif32-caesar-shift-23-decoder
• Capa false-positive concept: debug-build-capa-false-positives
• Social-engineering tactic: social-engineering-filename-lure

Provenance

• file.txt — file(1) v5.45
• exiftool.json — ExifTool 12.76
• pefile.txt — pefile 2024.8.26
• rabin2-info.txt — radare2 5.9.4
• strings.txt — strings(1) from binutils
• capa.txt — Mandiant capa v7.4.0 (static)
• binwalk.txt — binwalk v2.4.3
• floss.txt — flare-floss v3.1.0 (CLI error — no decoded strings produced)
• dynamic-analysis.md — CAPE skipped (no Windows guest available)