> Analysis · 5bf25358184f_

1. Build / RE

.NET Framework 4.0 PE32 x86 GUI, compiled with VS2010+ tool-chain. Internal name falD.exe; PDB falD.pdb. Timestamp 2104-05-04 (fabricated/future-dated). ^[file.txt] ^[pefile.txt]

Unobfuscated CIL assembly. Namespace MonopolyGame with MonopolyGameServer (TCP multiplayer host), MonopolyGameClient, MonopolyGameForm (WinForms board), SendData/broadcastData networking helpers, and full Entity Framework MonopolyDB EDMX model (~600 lines of embedded CSDL/MSL/SSDL XML). ^[strings.txt:60] ^[strings.txt:1931] ^[strings.txt:316]

Third-party dependencies: NetComm (TCP socket wrapper), Newtonsoft.Json (serialization), System.Data.Entity (EF6/LocalDB persistence). System.Diagnostics is the only security-adjacent import; no System.Net.Security, System.Management, Microsoft.Win32, System.IO.Compression, or reflection beyond standard .NET assembly loading. ^[strings.txt:398]

Trif32 trivial Caesar-shift-23 decoder present (shared benign utility across PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint clusters). ^[strings.txt:19] ^[concepts/trif32-caesar-shift-23-decoder]

No packing, no ConfuserEx, no anti-debug, no VM detection, no AMSI bypass, no native P/Invoke. Unsigned. UAC manifest requests asInvoker. ^[metadata.json] ^[strings.txt:2464]

Capa produced the expected false-positive pattern for .NET binaries: T1620 (reflective code loading) from standard Assembly.Load/MethodBase.Invoke JIT mechanics; B0013.001 (analysis-tool discovery) from System.Diagnostics import; and "reference analysis tools strings" under anti-analysis namespace — all standard metadata artifacts in unobfuscated .NET builds, not actual evasion. The only non-false-positive hits are benign library references (Newtonsoft.Json, resource access, .NET platform compilation). No malicious capabilities detected. ^[capa.txt] ^[entities/unclassified-dotnet]

2. Deploy / ATT&CK

No malicious payload. The binary is a functional Turkish-language Monopoly board game with local save/load (SQL Server LocalDB), dice rolling (zar1/zar2), property ownership (tapu, tapuSenedi), Chance/Community Chest cards (SansKartlari, KamuFonuKartlari), prison mechanics (hapisahenedeMi), and mortgage (ipotekliMi). All strings are Turkish (oyuncu, kare, piyon, oyun). ^[strings.txt:14-120] ^[floss.txt]

Filename at ingestion: SALES_ORDER.pdf.exe — .pdf.exe double-extension masquerade targeting procurement/finance staff. This is the sole threat vector. ^[triage.json]

MITRE ATT&CK:

• T1204.002 (User Execution: Malicious File) — the .pdf.exe masquerade relies on victim double-click. ^[triage.json]
• No persistence, no C2, no data exfiltration, no credential access, no process injection, no defense evasion beyond the filename itself.

Static-only analysis. CAPE skipped — no Windows guest available. ^[dynamic-analysis.md]

Attribution

Assigned to unclassified-dotnet family. No crimeware builder fingerprints, no packer signatures, no code-reuse ties to known families. The Trif32 decoder and .pdf.exe masquerade pattern place it in the same social-engineering distribution cluster as 4cce5506, 6bc4e16d, 6d114209, 724d94aa, and 5335da6d, but the payload itself is a distinct Turkish Monopoly game rather than a paint editor, calculator, or character generator.

Confidence

Medium — static-only, no runtime confirmation, but the surface is so thoroughly benign (game UI strings, EF model, no crypto/network beyond local TCP multiplayer) that a hidden payload would require extreme steganography. File size and entropy are consistent with the visible content.