unclassified-dotnet: 61c10411 — GoldenCity Wild West city-builder with "Accessibility shortcut" masquerade

Executive Summary

A .NET Framework 4.0 WinForms city-building game (GoldenCity namespace) repackaged with a Microsoft-themed VS_VERSIONINFO masquerade (Accessibility shortcut / qAdT.exe / Microsoft Corporation.) and distributed as att1-240906081402.exe. No malicious payload, no network APIs, no persistence, no anti-analysis. Capa-detected T1620 and T1083 are false positives from standard .NET resource loading and sprite-directory enumeration. Static-only analysis (no CAPE Windows guest). Confirmed sibling to 92de8242 (same GoldenCity game, different VS_VERSIONINFO masquerade).

What It Is

The binary is a C# WinForms game with three PE sections (.text entropy 7.91, .rsrc, .reloc), a minimal IAT importing only mscoree.dll!_CorExeMain, and a ~855 KB .resources blob containing game sprites, UI strings, and menu text. ^[pefile.txt] ^[binwalk.txt]

How It Works

The application is a Spanish-language Wild West city-building simulation. The player constructs buildings (Jail, Living House, Railroad Station, Saloon, Sheriff's House, Store, Town Hall), manages citizens and workers, and defends against periodic bandit raids. Game mechanics include:

• Building placement with cost, happiness, budget-weakness, and income parameters
• Citizen generation timed by aggregate building happiness
• Bandit raids at intervals determined by Jail worker count
• Victory condition: build Town Hall requiring 8× map-size citizens and $150,000

The game UI includes a main menu, settings dialog (map size 5–8), building-parameters guide, bandit guide, and in-game HUD showing money, citizens, sheriffs, and attack timer. ^[strings.txt] ^[floss.txt] (floss invocation errored — no decoded strings recovered)

Caesar-shift-23 obfuscation is present in the Trif32 class: the literal FuhdwhLqvwdqfh decodes to CreateInstance with a shift of 23 (or equivalently ROT13 then shift 10). ^[strings.txt] This is the same Trif32 / CustomDecode utility observed in the PrimeraVentana educational-app cluster (a42443c8, c4ee3a31081d, cae7ac1dc419), suggesting a shared coursework template or instructor-provided helper class. ^[/intel/analyses/a42443c84fc9ec4a4f00c4363eee5074e94cfbb286a48fcbd33496dbbf0f5455.html]

No malicious behavior: There are zero references to System.Net, System.Security, System.Diagnostics.Process, Microsoft.Win32.Registry, or any P/Invoke DllImport signatures. The #Blob metadata stream contains no native API names. ^[pefile.txt] ^[strings.txt]

Decompiled Behavior

Entry point is standard .NET CIL: _CorExeMain → CLR bootstrap → MainForm..ctor → InitializeComponent → Form1_Load. The Form1_Load event handler sets up game timers (gameAttackTimer, gameNewCitizenTimer, repaintTimer, gamePayTimer) and loads embedded PNG sprites from the .resources stream via ResourceManager.GetObject. ^[strings.txt]

Notable methods in the call tree:

• Trif32 — utility class with Caesar-shift-23 string decoder; decodes FuhdwhLqvwdqfh → CreateInstance ^[strings.txt]
• InitializeComponent — WinForms designer-generated UI layout (labels, buttons, combo boxes, group boxes) ^[strings.txt]
• CheckIfGameFinished — checks win condition (Town Hall built + sufficient citizens + $150,000) ^[strings.txt]
• DrawBandits, DrawBuildings, DrawBackground — GDI+ rendering via Graphics.DrawImage / DrawRectangle ^[strings.txt]
• saveBtn_Click / resetBtn_Click — save/load game state via SaveFileDialog and FileStream ^[strings.txt]

Capa flags T1620 Reflective Code Loading from Assembly.Load and MethodBase.InvokeMember — these are standard .NET resource-manager and designer-generated event-wireup patterns, not payload injection. ^[capa.txt]

Capa flags T1083 File and Directory Discovery from Directory.GetFiles — used to enumerate sprite PNGs in the embedded .resources stream. ^[capa.txt]

C2 Infrastructure

None. No network APIs, no hardcoded URLs, no DNS resolution, no socket creation. The binary is entirely offline.

Interesting Tidbits

• Filename social engineering: att1-240906081402.exe — "att1" strongly suggests an email attachment, with a date stamp of 2024-09-06 08:14:02. The .exe extension is bare (no double-extension masquerade), relying on recipient inattention or "Hide extensions" default. ^[metadata.json]
• VS_VERSIONINFO masquerade: Clones Microsoft Corporation branding with Accessibility shortcut as FileDescription and ProductName, internal name qAdT.exe (nonsense string, likely auto-generated by repackager). This is a different masquerade from sibling 92de8242 which used Adobe Reader / AcroRd32.exe. ^[pefile.txt]
• Russian UI text: The .resources stream contains Russian-language game-guide strings explaining bandit mechanics, building parameters, and win conditions. The game itself is titled "Golden City" (English) with Cyrillic help text. ^[strings.txt]
• Car registration dialog: A secondary UI screen (likely a mini-game or tutorial) includes car-brand strings (MAZDA, MERCEDEZ, AUDI) and model variants (Mazda3 GT, Mazda3 speed, Audi turbo, audi sport). This appears to be a student coursework mini-project embedded in the same assembly. ^[strings.txt]
• PDB path: qAdT.pdb — nonsense prefix matching the internal name, consistent with auto-generated names by a repackager tool. ^[pefile.txt]
• Resource structure: 855 KB .resources blob at RVA 0xc0c4 contains System.Resources.ResourceReader header, System.Resources.RuntimeResourceSet type name, and standard PAD padding. No encrypted payload or manifest resource decryption. ^[binwalk.txt]
• Debug build: DebuggableAttribute with DebuggingModes.Default and DebuggerNonUserCodeAttribute on designer-generated methods. These trigger capa T1620 false positives. ^[strings.txt]

How To Mess With It (Homelab Replication)

Toolchain: Visual Studio 2019/2022, .NET Framework 4.0 Targeting Pack, C# WinForms Application template.

Steps:

1. Create a new WinForms project targeting .NET Framework 4.0.
2. Add a Panel for the game map, Timer controls for game loop events, and PictureBox / Bitmap for sprite rendering.
3. Implement game classes (Building, Citizen, Bandit, Map) with properties matching the backing-field pattern (<X>k__BackingField).
4. Add a Trif32 utility class with a Caesar-shift-23 decoder:

   public static string Decode(string input) {
       return new string(input.Select(c => char.IsLetter(c) ? 
           (char)((c - (char.IsUpper(c)?'A':'a') + 23) % 26 + (char.IsUpper(c)?'A':'a')) : c).ToArray());
   }
   

5. Embed PNG sprites as .resources via Project → Properties → Resources.
6. Build in Debug configuration to reproduce the capa false-positive fingerprint.
7. Alter VS_VERSIONINFO via a resource editor or post-build tool to inject masquerade metadata.

Verification: Run capa on the output. Expect T1620 (from Assembly.Load in resource manager) and T1083 (from Directory.GetFiles if loading external sprites). Compare to this sample's capa.txt.

What you'll learn: How a benign .NET game acquires a malware-like static fingerprint through standard framework APIs, and how capa's heuristics can be fooled by Debug-build compiler attributes.

Deployable Signatures

YARA Rule

rule UnclassifiedDotnet_GoldenCity_Masquerade
{
    meta:
        description = "GoldenCity .NET WinForms game with social-engineering masquerade"
        author = "pp-hermes"
        date = "2026-07-02"
        sha256 = "61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd"
        reference = "/intel/analyses/61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd.html"

    strings:
        $namespace = "GoldenCity" ascii wide
        $class1 = "Models.Bandits" ascii wide
        $class2 = "Models.Building" ascii wide
        $class3 = "Models.Maps" ascii wide
        $class4 = "Models.Citizen" ascii wide
        $trif32 = "Trif32" ascii wide
        $game1 = "GameAttackTimerTick" ascii wide
        $game2 = "GameNewCitizenTimerTick" ascii wide
        $game3 = "GamePayTimerTick" ascii wide
        $game4 = "CheckIfGameFinished" ascii wide
        $russian1 = "Бандиты нападают" ascii wide
        $russian2 = "Дикого Запада" ascii wide
        $russian3 = "Вы создаете свой город" ascii wide
        $masquerade1 = "Accessibility shortcut" ascii wide
        $masquerade2 = "qAdT.exe" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        pe.is_dotnet and
        ($namespace or $trif32) and
        2 of ($class*) and
        2 of ($game*) and
        (1 of ($russian*) or 1 of ($masquerade*))
}

Behavioral Fingerprint Statement

This binary is a .NET Framework 4.0 WinForms GUI executable with a three-section PE layout (.text, .rsrc, .reloc), minimal IAT (mscoree.dll only), and an ~855 KB embedded .resources blob. It loads PNG sprites via ResourceManager.GetObject, renders a game board via GDI+ Graphics.DrawImage, and manages game state through Timer-driven event handlers. No network APIs, no registry access, no process manipulation, and no P/Invoke imports are present. The DebuggableAttribute and DebuggerNonUserCodeAttribute compiler-generated attributes cause capa to flag T1620 falsely. The Directory.GetFiles call (if external sprites are used) triggers T1083.

IOC List

Detection Signatures

References

• Artifact ID: 6a93e60a-26b4-4cb6-a15c-9505fc19f49c ^[metadata.json]
• Source: OpenCTI / MalwareBazaar
• Related wiki pages:
  • unclassified-dotnet — umbrella entity for unattributed .NET samples
  • version-info-masquerade — VS_VERSIONINFO falsification technique
  • social-engineering-filename-lure — filename-based social engineering
• Sibling analyses:
  • 92de8242 — confirmed GoldenCity sibling with Adobe Reader masquerade ^[/intel/analyses/92de82423ad9fbbae32673ebf26710b8fbfae04b09bcf678d46ff8bf0512ae6a.html]
  • a42443c8 — PrimeraVentana sibling sharing Trif32 decoder ^[/intel/analyses/a42443c84fc9ec4a4f00c4363eee5074e94cfbb286a48fcbd33496dbbf0f5455.html]

Provenance

• file.txt — file v5.44
• exiftool.json — ExifTool v12.76
• pefile.txt — pefile (Python) + custom script
• strings.txt — strings v2.39
• floss.txt — flare-floss v3.1.1 (errored on invocation)
• capa.txt — flare-capa v7.1.0 (static analysis, OS: any)
• binwalk.txt — binwalk v2.3.4
• rabin2-info.txt — radare2 v5.9.6
• metadata.json — triage pipeline schema v1
• .NET metadata — custom Python script using pefile + struct
• dynamic-analysis.md — CAPE skipped (no Windows guest)