unclassified-dotnet: 5e34f10a — Spanish student-evaluation app with PO masquerade

Executive Summary

A .NET Framework 4.0 WinForms CRUD application for Spanish-language student evaluation (Evaluacion), submitted to MalwareBazaar as PO#82924A.exe. Static analysis reveals no P/Invoke, no obfuscation, no network APIs, and no malicious behavior. The threat surface is purely social-engineering filename masquerade. Capa's T1620 (Reflective Code Loading) is a Debug-build false positive from DebuggerBrowsableAttribute and DebuggableAttribute metadata, a pattern well-documented in the corpus. ^[debug-build-capa-false-positives]

What It Is

• File: PO#82924A.exe (796,672 bytes) ^[file.txt]
• Format: PE32 GUI, .NET Framework 4.0, 3 sections, no packing ^[file.txt] ^[pefile.txt]
• Timestamp: Fabricated Sat Dec 19 18:13:32 2043 UTC — impossible future date ^[pefile.txt:34]
• PDB: iAQe.pdb — nonsensical prefix, likely auto-generated by VS ^[rabin2-info.txt:13]
• Version Info: ProductName Evaluacion, InternalName iAQe.exe, Copyright 2020 ^[exiftool.json]
• CLR: v4.0.30319, 5 metadata streams (#~, #Strings, #US, #GUID, #Blob) ^[rabin2-info.txt]
• Resources: RT_VERSION, RT_MANIFEST, 16 .resources files (WinForms form localizations) ^[binwalk.txt]
• Signing: Unsigned ^[rabin2-info.txt:29]

How It Works

The binary is a standard .NET Framework 4.0 Windows Forms application with the following architecture:

• Namespace: Evaluacion — contains forms MLogin, Principal, MEstudiante, GEstudiante, LEstudiante, MSeccion, GSeccion, LSeccion, MMateria, GMateria, LMateria, MIndicador, GIndicador, LIndicador, MEvaluacion, GEvaluacion, ResumenPorIndicador ^[strings.txt:495-516]
• Data Layer: System.Data.SqlClient with stored-procedure and inline-SQL CRUD operations ^[strings.txt:576]
• Database: Hardcoded SQL Server connection string in the #US metadata stream: Data Source=server;Initial Catalog=School; Persist Security Info=True; User ID=SalonAlba;Password=Salon360Ba ^[strings.txt:283]
• No P/Invoke: MemberRef table contains no DllImport, VirtualAlloc, CreateRemoteThread, WriteProcessMemory, or any other native API references. ^[manual-metadata-parse]
• No obfuscation: All type/method names are meaningful Spanish or English identifiers. No ConfuserEx, SmartAssembly, or Xenocode signatures. No encrypted resources beyond standard .NET .resources localization files.
• No overlay: File ends exactly at the last section boundary (0 bytes overlay) ^[manual-overlay-check]

Decompiled Behavior

No decompiler (dnSpy, ILSpy, monodis) is installed on this station. Manual metadata parsing via pefile confirms:

• 321 MethodDefs with RVAs in the .text section — standard WinForms event handlers (*_Click, *_TextChanged, *_SelectedIndexChanged, *_DoubleClick) ^[strings.txt:256-286]
• 444 FieldDefs — UI control bindings (tbNombre, lbNombre, dtgvEstudiante, etc.) ^[strings.txt:36-44]
• 144 TypeRefs — all from System, System.Data, System.Drawing, System.Windows.Forms, System.Collections.Generic ^[strings.txt:533-611]
• No native interop: Zero System.Runtime.InteropServices P/Invoke declarations. Zero DllImport attributes. ^[manual-metadata-parse]
• No reflection abuse: No System.Reflection.Assembly::Load(byte[]) or Delegate::CreateDelegate calls in MemberRef. ^[manual-metadata-parse]

The application flow, inferred from method names and #US SQL strings:

1. MLogin form authenticates against Usuario table with plaintext password comparison (no hashing) ^[strings.txt:230-232]
2. Principal form presents a menu strip for CRUD operations on Estudiante, Materia, Seccion, Indicador, and Evaluacion
3. Each entity has G (Grid/List), L (Lookup), and M (Maintenance) forms
4. ResumenPorIndicador generates indicator-level summary reports

C2 Infrastructure

None. No network APIs, no hardcoded URLs, no C2 infrastructure. Static-only analysis (CAPE skipped — no Windows guest available). ^[dynamic-analysis.md]

Interesting Tidbits

• The hardcoded DB password Salon360Ba suggests the app was built for a salon or small school named "Alba" (SalonAlba / Salon360Ba) ^[strings.txt:283]
• The PO#82924A.exe filename is a classic purchase-order social-engineering lure, but the binary content is entirely unrelated — either a mistaken MalwareBazaar submission or a deliberate masquerade attempt using an off-the-shelf app ^[triage.json]
• The build timestamp 2043 is clearly fabricated, yet the copyright says 2020 — a mismatch that suggests either deliberate anti-forensics or a simple build-time spoof ^[pefile.txt:34] ^[exiftool.json:41]
• DebuggerNonUserCodeAttribute, DebuggableAttribute, and DebuggerBrowsableAttribute are present in the metadata, triggering capa's T1620 false positive. This is the same pattern observed in 20+ other unclassified-dotnet samples. ^[capa.txt] ^[debug-build-capa-false-positives]
• The #US stream contains SQL injection-prone inline queries: Select * from Usuario where Usuario='{0}' and Pass='{1}' — sloppy coding, not malware ^[strings.txt:230-232]

How To Mess With It (Homelab Replication)

This is a benign app, but it serves as a useful baseline for understanding Debug-build capa false positives and social-engineering masquerade.

1. Reproduce the capa false positive:

   # Build any .NET Framework 4.0 WinForms app in Debug configuration
   # Add [DebuggerBrowsable] or [Debuggable] attributes
   # Run: capa yourapp.exe
   # Should hit T1620 (Reflective Code Loading) despite no reflective loading
   

2. Verify the benign nature:
   • Open in dnSpy — all methods are readable WinForms event handlers
   • Check MemberRef table for System.Runtime.InteropServices — absent
   • Check for encrypted resources — none (only .resources localization files)

Deployable Signatures

YARA Rule

rule UnclassifiedDotnet_StudentEval_PO_Masquerade
{
    meta:
        description = "Detects the Evaluacion student-evaluation .NET app submitted as PO#82924A.exe"
        author = "PacketPursuit"
        date = "2026-07-11"
        sha256 = "5e34f10aad66da3d4137e4cc4ce01ac33922d427141666bfa4a6f8ec6d181bf5"
        confidence = "high"
    strings:
        $ns1 = "Evaluacion" wide
        $ns2 = "Evaluacion.Properties.Resources" wide
        $ns3 = "Evaluacion.MLogin" wide
        $ns4 = "Evaluacion.Principal" wide
        $conn = "Data Source=server;Initial Catalog=School; Persist Security Info=True; User ID=SalonAlba;Password=Salon360Ba" wide
        $eval = "Evaluacion.Evaluacion" wide
        $res1 = "Evaluacion.MEstudiante.resources"
        $res2 = "Evaluacion.GEstudiante.resources"
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C) + 0x14) == 0x00004550 and
        uint16(uint32(0x3C) + 0x18) == 0x010B and
        4 of ($ns*) and
        ($conn or ($eval and 2 of ($res*)))
}

Behavioral Hunt Query (KQL)

let po_pattern = @"PO[#\d]+.*\.exe$";
let purchase_pattern = @"(?i)(purchase.?order|po|invoice|payment).*\.exe$";
DeviceFileEvents
| where FileName matches regex po_pattern or FileName matches regex purchase_pattern
| join kind=inner (
    DeviceImageLoadEvents
    | where FileName has_any ("mscoreei.dll", "clr.dll")
    | summarize arg_min(Timestamp, *) by DeviceId, InitiatingProcessFileName
) on $left.DeviceId == $right.DeviceId and $left.FileName == $right.InitiatingProcessFileName
| where isnull(InitiatingProcessCommandLine) or InitiatingProcessCommandLine !contains "powershell"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessParentFileName, InitiatingProcessCommandLine

IOC List

Behavioral Fingerprint

A .NET Framework 4.0 PE32 GUI binary with the Evaluacion namespace, 16 WinForms .resources files, hardcoded SQL Server credentials for a School database, and no P/Invoke or network APIs. The binary was submitted to MalwareBazaar under the filename PO#82924A.exe, a purchase-order social-engineering masquerade with no actual malicious payload.

Detection Signatures

References

• unclassified-dotnet — Umbrella entity for .NET Framework binaries lacking clear crimeware signatures
• social-engineering-filename-lure — Cross-family pattern: professional-context filenames to lower suspicion
• debug-build-capa-false-positives — Recurring capa false-positive pattern from Debug-build .NET metadata
• MalwareBazaar: 5e34f10aad66da3d4137e4cc4ce01ac33922d427141666bfa4a6f8ec6d181bf5

Provenance

• File type: file v5.45 ^[file.txt]
• Metadata: exiftool v12.76 ^[exiftool.json]
• PE parsing: pefile v2023.2.7 (Python) ^[pefile.txt]
• Strings: strings (default) ^[strings.txt]
• Capabilities: capa static analysis ^[capa.txt]
• Embedded artefacts: binwalk v2.3.4 ^[binwalk.txt]
• Header summary: rabin2 v5.9.8 ^[rabin2-info.txt]
• FLOSS: Failed (flag error) ^[floss.txt]
• CLR metadata: Manual parse via pefile Python script ^[manual-metadata-parse]
• Dynamic: CAPE skipped — no Windows guest ^[dynamic-analysis.md]