unclassified-dotnet: 5ea6b79d — Stolen-Tatham-cert pizza POS sibling (52oTaV20K4bWnvN.exe)

Executive Summary Second confirmed sibling of the Brazilian pizza-shop POS/CRM Pizzaria_Management_VIEW cluster. Identical build stack, namespace, and benign functionality to 7b3ef687, but signed with the stolen Simon Tatham (PuTTY) COMODO RSA Code Signing CA certificate and carrying Adobe Reader / Microsoft PDF Document VS_VERSIONINFO masquerade. No malicious payload; threat is social-engineering masquerade + stolen certificate false legitimacy.

What It Is

How It Works

Identical to sibling 7b3ef687 — a .NET Framework 4.0 WinForms pizza-restaurant management system (Pizzaria_Management_VIEW namespace). Forms for customer registration (CadCliente, GerenciamentoCadastro), order management (CadPedido, GerenciamentoPedido), product/stock control (CadProduto, GerenciamentoEstoque), and employee management (CadFuncionario). ^[strings.txt:53-125] ^[strings.txt:277-285]

Database layer: ClienteDAL under DAL.Model namespace using System.Data.SqlClient (SqlConnection, SqlCommand, SqlDataReader, SqlParameter). ^[strings.txt:54-56] ^[strings.txt:78-80] ^[strings.txt:251-253]

UI layer: Portuguese-language WinForms MDI with TabControl, MenuStrip, DataGridView, PictureBox, DateTimePicker, MaskedTextBox, ComboBox. Menu items: pedido, produto, estoque, login, funcionário, cadastro, gerenciamento. ^[strings.txt:12-50] ^[strings.txt:163-200]

Embedded resources: .resources blobs for each form plus Properties.Resources.resources. Binwalk finds four PNG images (256×256, 400×226, 256×256, 523×523). ^[binwalk.txt]

String decoder: Trif32 trivial character-pair decoder shared with PrimeraVentana/GoldenCity coursework cluster. ^[strings.txt:27]

Certificate: PKCS#7 signed-data block at PE security directory (raw offset 0xC7400, size 13832 bytes). Certificate chain includes COMODO RSA Certification Authority → COMODO RSA Code Signing CA → leaf CN=Simon Tatham, O=Simon Tatham, L=Cambridge, ST=Cambridgeshire, C=GB. Serial validity 181113000000Z to 211108235959Z. This is the same stolen certificate observed in eight prior unclassified-dotnet siblings. ^[strings.txt:1885-1987] ^[pefile.txt:152-154]

Decompiled Behavior

radare2 analysis completed at level 2, yielding 195 functions — all standard .NET method stubs and compiler-generated attributes. ^[rabin2-info.txt] The only import is mscoree.dll!_CorExeMain (standard .NET bootstrap). No P/Invoke signatures, no native API calls, no DllImport attributes. No suspicious control-flow patterns, no anti-debug checks, no VM detection. Code quality is consistent with a Visual Studio WinForms designer-generated application.

C2 Infrastructure

None. Zero network, socket, HTTP, FTP, or email APIs. No hardcoded URLs, IPs, domains, or C2 infrastructure. No System.Net namespace references. ^[strings.txt]

Interesting Tidbits

• Stolen certificate cluster: Ninth confirmed sibling using the same Simon Tatham (PuTTY) COMODO RSA Code Signing CA certificate. Prior siblings: eea0dcbc, c4ee3a31081d, cae7ac1dc419, a1e6dc7a, b4814a17, 724d94aa, 72d8e3b2, plus this sample. ^[strings.txt:1885-1987] ^[entities/unclassified-dotnet.md]
• Adobe Reader masquerade: VS_VERSIONINFO cloned from Adobe Reader — Microsoft PDF Document, Adobe Reader, Yhdk.exe — same pattern as a1e6dc7a and 724d94aa. ^[exiftool.json]
• Same build day as sibling: Timestamp Jul 30 01:57:10 2024 is 17 minutes before sibling 7b3ef687 (Jul 30 02:14:49 2024) and identical to a1e6dc7a. Suggests same build pipeline or repackaging batch. ^[pefile.txt:34]
• No PDB path: Release configuration or stripped before distribution. ^[strings.txt]
• capa false positives: T1213 triggered by System.Data.SqlClient, T1620 by System.Reflection metadata, B0013.001 by generic .NET runtime. Same false-positive profile as 7b3ef687. ^[capa.txt]

How To Mess With It (Homelab Replication)

Identical to 7b3ef687 — see that report's replication section. The only additional step is signing with a stolen or test certificate and embedding Adobe Reader VS_VERSIONINFO to match the masquerade fingerprint.

Deployable Signatures

YARA rule

rule PizzariaVIEW_StolenTatham_Sibling
{
    meta:
        description = "Brazilian pizza-shop POS/CRM .NET WinForms (stolen Simon Tatham cert, Adobe Reader masquerade)"
        author = "PacketPursuit"
        hash = "5ea6b79d0efa5db5514fb0eb7f6307d35e504425a3af39bd226c22ac39121603"
        date = "2026-07-11"

    strings:
        $ns1 = "Pizzaria_Management_VIEW" ascii wide
        $ns2 = "ClienteDAL" ascii wide
        $ns3 = "BuscarClientePorID" ascii wide
        $ns4 = "CadCliente" ascii wide
        $ns5 = "CadPedido" ascii wide
        $ns6 = "CadProduto" ascii wide
        $ns7 = "GerenciamentoCadastro" ascii wide
        $ns8 = "GerenciamentoPedido" ascii wide
        $ns9 = "GerenciamentoEstoque" ascii wide
        $vi1 = "Microsoft PDF Document" ascii wide
        $vi2 = "Adobe Reader" ascii wide
        $vi3 = "Yhdk.exe" ascii wide
        $trif = "Trif32" ascii wide
        $cert1 = "Simon Tatham" ascii wide
        $cert2 = "COMODO RSA Code Signing CA" ascii wide
        $dotnet = "v4.0.30319" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        ($dotnet or $trif) and
        (2 of ($ns*) or $vi1 or $vi2) and
        ($cert1 or $cert2)
}

Behavioral fingerprint

An 810 KB PE32 .NET Framework 4.0 GUI assembly launches a WinForms MDI application with Portuguese pizza-restaurant menu tabs. It initializes a System.Data.SqlClient connection on form load and populates DataGridView controls. The binary carries a PKCS#7 Authenticode signature with a COMODO RSA Code Signing CA chain leaf belonging to Simon Tatham (PuTTY developer) — a known stolen certificate. VS_VERSIONINFO masquerades as Adobe Reader / Microsoft PDF Document. No network sockets, no registry persistence, no process injection, no anti-debug checks. Benign application repackaged for social engineering.

IOC list

Detection Signatures

capa → MITRE ATT&CK mapping (with false-positive annotations)

References

• Artifact ID: 9712b077-10d7-426b-a9f2-d8775613a898 ^[metadata.json]
• Source: OpenCTI / MalwareBazaar
• Related wiki: unclassified-dotnet
• Related concept: social-engineering-filename-lure
• Sibling analysis: 7b3ef6871b0c4d64dd7fd96937c190763fae58bd560131b96dbc9ef860c75e54 (same pizza POS, no cert)

Provenance

Analysis produced from:

• file.txt, exiftool.json, pefile.txt, strings.txt, ssdeep.txt, tlsh.txt, yara.txt, metadata.json, triage.json — automated triage pipeline (May 2026)
• floss.txt — FireEye flare-floss (failed on argument parsing, no decoded strings extracted) ^[floss.txt]
• capa.txt — Mandiant flare-capa static analysis
• binwalk.txt — embedded artefact scan
• rabin2-info.txt — radare2 binary header summary
• dynamic-analysis.md — CAPE skipped (no Windows guest available)
• radare2 level-2 analysis (195 functions, 1 import, no suspicious patterns)
• Python byte-scan for network indicators, Base64 blocks, and P/Invoke signatures (negative)