unclassified-dotnet: 644892e9 — Spanish RPG character generator masquerading as purchase order (confirmed sibling of ad301389)

Executive Summary

A .NET Framework 4.0 WinForms GUI application — a Spanish-language RPG character generator (ejemplo namespace) — distributed as Purchase_Order.pdf.exe with fabricated Microsoft Corporation version-info masquerade. Confirmed sibling of ad301389 (same codebase, same class structure, same Spanish UI strings); differs only in internal name (wHVe.exe vs HFGe.exe), distribution filename, and embedded image set. No packing, no obfuscation, no network APIs, no persistence, and no payload beyond the WinForms surface. Threat is purely social-engineering masquerade. Static-only analysis (CAPE skipped: no Windows guest).

What It Is

Build / RE

Toolchain

• Runtime: .NET Framework 4.0 (CLR v4.0.30319) ^[exiftool.json:18] ^[pefile.txt:4]
• Architecture: PE32, x86, CIL ^[file.txt:1] ^[rabin2-info.txt:1,5,21]
• Linker: Microsoft linker v48.0 (Visual Studio / MSBuild) ^[exiftool.json:18]
• COM descriptor: RVA 0x2008, size 0x48 ^[pefile.txt:183-184]
• Entry point: Token 0x600004f (method in ejemplo.Program) ^[pefile.txt:50, exiftool.json:22]

Packing / Obfuscation

None. Plain PE32 with three standard sections (.text, .rsrc, .reloc). No packer, no obfuscator, no native API imports beyond mscoree.dll._CorExeMain ^[file.txt:1] ^[pefile.txt:255]. The .text section entropy is 7.87 — high because it contains the entire CIL bytecode and embedded resources, not because of encryption ^[pefile.txt:92].

Anti-Analysis

None. No debugger checks, no VM detection, no sandbox evasion, no time-bombs. Capa flags T1620 (Reflective Code Loading) and T1083 (File and Directory Discovery) — these are false positives from standard .NET JIT compilation and System.IO.Path/FileDialog usage in the WinForms designer-generated code ^[capa.txt].

Metadata Surface

TypeDefs (inferred from #Strings): ^[strings.txt:1601-1942]

• ejemplo.FormPrincipal
• ejemplo.MDIParent1
• ejemplo.MDIParent2
• ejemplo.Personaje (Character)
• ejemplo.Elfo (Elf race)
• ejemplo.Humano (Human race)
• ejemplo.Vampiro (Vampire race)

Identical class structure to sibling ad301389. All core method names match:

• btnGenerarPersonaje_Click ^[strings.txt:1721]
• CalculateIntermediate2, CalculateIntermediate3, CalculateIntermediate4 ^[strings.txt:1761,1763,1765]
• get_account_1, get_account_2, get_account_3 ^[strings.txt:1900,1902,1903]
• get_FechaNacimiento, set_FechaNacimiento, get_Territorios, set_Territorios ^[strings.txt:1875-1884]

TypeRefs: Pure WinForms / System.Drawing / System.IO surface. Notable references include System.Windows.Forms.Form, .MenuStrip, .ToolStripMenuItem, .OpenFileDialog, .SaveFileDialog ^[strings.txt:1704-1720].

No references to: System.Net.*, System.Security.Cryptography.*, System.Diagnostics.Process, System.Reflection.Assembly.Load, System.Runtime.InteropServices (beyond standard COM interop decoration), System.Threading.

Embedded Resources

• JPEG images: Four JFIF images embedded in .text section — 33,921 bytes (offset 0x141a), 23,357 bytes (0x1d68c), 320,625 bytes (0x3fc74), and 299,770 bytes (0xa6b06). ^[binwalk.txt] ^[terminal:JPEG scan]
• No PNG images: Unlike sibling ad301389 which contained ~40 embedded PNG toolbar icons, this sample has zero PNG signatures. The size delta (+129,024 bytes) is explained by the four large JPEGs replacing the PNG icon set. ^[terminal:PNG scan]
• .resources files: ejemplo.MDIParent1.resources, ejemplo.MDIParent2.resources ^[strings.txt:1941-1942]
• XML manifest: Standard Windows UAC manifest in .rsrc ^[pefile.txt:298-328]

Version Info Masquerade

Fabricated Microsoft Corporation metadata: ^[exiftool.json:37-44] ^[pefile.txt:235-243]

• CompanyName: Microsoft Corporation
• FileDescription: Thumbnail Handler
• InternalName: wHVe.exe
• OriginalFilename: wHVe.exe
• ProductName: Thumbnail Handler
• LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.

The internal name wHVe.exe and PDB wHVe.pdb match; wHVe is a nonsense string consistent with auto-generated or repackaged build artifacts. The same masquerade pattern (Microsoft Corporation / Thumbnail Handler) was used on sibling ad301389 with internal name HFGe.exe.

Deploy / ATT&CK

Static-only inference. CAPE detonation was skipped (no Windows guest) ^[dynamic-analysis.md:1-3].

Persistence: None observed. No registry references, no scheduled-task strings, no startup-folder paths.

C2 / exfiltration: None observed. No System.Net, WebClient, HttpWebRequest, Socket, Mail, or raw TCP/UDP references in TypeRefs or strings.

Lateral movement: None observed.

Attribution: No linguistic or infrastructure clues beyond the Spanish UI strings and ejemplo (Spanish "example") namespace. No hardcoded URLs, IPs, or wallet addresses. Low-confidence attribution: repackaged Spanish educational / tutorial RPG game project. The existence of two confirmed siblings (ad301389 and 644892e9) with different internal names and distribution filenames suggests a repackaging pipeline or copy-paste build process rather than a single actor.

Decompiled Behavior

The application is a classic WinForms MDI (Multiple Document Interface) RPG character generator with the following observed behavior:

1. Character creation form (FormPrincipal): Contains fields for name (Nombre), race (Raza — Elfo, Humano, Vampiro), birth date (FechaNacimiento), magic type (Magia), magic enabled checkbox (ckbMagia), and territory count (Territorios) ^[strings.txt:1704-1720,1761-1765,1875-1884].

2. MDI parent windows (MDIParent1, MDIParent2): Standard WinForms MDI container with menu items for Cascade, Tile Vertical, Tile Horizontal, Arrange Icons, Close All ^[strings.txt:1782,1861,1941-1942].

3. Intermediate calculation methods: CalculateIntermediate2, CalculateIntermediate3, CalculateIntermediate4 — derive derived stats from base character attributes ^[strings.txt:1761,1763,1765].

4. Account/getter methods: get_account_1, get_account_2, get_account_3 — auto-generated property accessors or game-account fields ^[strings.txt:1900,1902,1903].

5. File dialogs: OpenFileDialog and SaveFileDialog for saving/loading character files ^[strings.txt:1704-1720].

No encryption, no networking, no process injection, no registry manipulation.

C2 Infrastructure

None. No hardcoded IOCs. No network APIs. No C2 infrastructure observable statically.

Sibling Comparison (644892e9 vs ad301389)

The +129,024 byte size difference is fully explained by the embedded image set: this sample carries four large JPEG photographs (~680 KB total) instead of the ~40 small PNG toolbar icons found in ad301389. The CIL bytecode and metadata structure are otherwise unchanged.

Interesting Tidbits

• Confirmed sibling cluster: The existence of two independently submitted samples (ad301389 and 644892e9) with identical codebase but different internal names and lure filenames suggests either a repackaging service or a tutorial/build exercise being reused by multiple threat actors. ^[/intel/analyses/ad301389152cb26900d3c06ea4f604dec119bf566b2f49dcdfdc21c658574420.html]
• "wHVe" internal name: Like "HFGe" in the sibling, "wHVe" has no semantic meaning — consistent with auto-generated or randomized build artifact names used by repackagers. ^[exiftool.json:40]
• JPEG vs PNG swap: The image payload changed from game-sprite PNGs (transparent backgrounds, small sizes) to full JPEG photographs (opaque, large sizes). This may reflect different build configurations or a different source of image assets, but the underlying application logic is unchanged. ^[terminal:JPEG/PNG scans]
• Double-extension masquerade: .pdf.exe is a classic Windows "Hide extensions" bypass — the victim sees Purchase_Order.pdf. ^[metadata.json:5]
• No FLOSS output: floss invocation failed with argument parsing error (--no flag collision) ^[floss.txt:1-6] — pipeline issue, not sample behavior.
• Entry point: Standard _CorExeMain in mscoree.dll — the CLR bootstrap thunk, not a custom unpacker ^[pefile.txt:255].

How To Mess With It (Homelab Replication)

This is a benign WinForms application. To reproduce the build fingerprint:

1. Open Visual Studio, create a new C# Windows Forms App (.NET Framework 4.0).
2. Design an MDI parent form with MenuStrip, ToolStrip, StatusStrip.
3. Add a child form with TextBox, ComboBox, RadioButton, CheckBox, NumericUpDown, DateTimePicker for character attributes.
4. Set AssemblyInfo.cs to match the observed metadata (Company: Microsoft Corporation, Product: Thumbnail Handler, etc.).
5. Build in Release mode.
6. Rename output to Purchase_Order.pdf.exe.
7. Run capa — expect T1620/T1083 false positives from standard .NET JIT and IO paths.

What you'll learn: How trivial it is for threat actors to repackage benign .NET apps with themed filenames and fabricated version info to evade casual triage. The presence of a two-sample sibling cluster confirms this is not a one-off.

Deployable Signatures

YARA Rule

rule UnclassifiedDotNet_SpanishRPG_Masquerade
{
    meta:
        description = "Spanish RPG character generator .NET app with purchase-order masquerade"
        author = "PacketPursuit"
        date = "2026-07-02"
        hash = "644892e9fe96231990ad8095237bafee16d1fb77aadde35cd20105cef5f4b922"
        confidence = "medium"
    strings:
        $ns1 = "ejemplo.Personaje" ascii wide
        $ns2 = "ejemplo.FormPrincipal" ascii wide
        $ns3 = "ejemplo.MDIParent1" ascii wide
        $ns4 = "ejemplo.Vampiro" ascii wide
        $ns5 = "ejemplo.Elfo" ascii wide
        $ns6 = "ejemplo.Humano" ascii wide
        $str1 = "btnGenerarPersonaje" ascii wide
        $str2 = "ckbMagia" ascii wide
        $str3 = "get_Magia" ascii wide
        $str4 = "get_Raza" ascii wide
        $str5 = "wHVe.exe" ascii wide
        $str6 = "Thumbnail Handler" ascii wide
        $str7 = "get_account_1" ascii wide
        $str8 = "CalculateIntermediate2" ascii wide
        $clr = { 48 00 00 00 02 00 05 00 }  // COR20 header signature
    condition:
        uint16(0) == 0x5A4D and
        $clr at (pe.data_directories[14].virtual_address - pe.sections[0].virtual_address + pe.sections[0].raw_address) and
        4 of ($ns*) and
        3 of ($str*)
}

Behavioral Hunt Query (KQL / Microsoft Defender)

DeviceFileEvents
| where FileName contains "PO" and FileName endswith ".exe"
| where FolderPath matches regex @"(?i)(purchase.?order|invoice|payment|shipping|hawb|quote)"
| join kind=inner (DeviceProcessEvents
    | where ProcessCommandLine contains "Purchase_Order"
    or (ProcessCommandLine contains "wHVe" and ProcessCommandLine contains "Thumbnail")
    ) on DeviceId, Timestamp
| where ProcessCommandLine !contains "devenv" and ProcessCommandLine !contains "msbuild"

IOC List

Behavioral Fingerprint

This binary is a .NET Framework 4.0 PE32 with 3 sections, no packing, and standard CLR metadata. It loads mscoree.dll._CorExeMain and JIT-compiles CIL from the .text section. It contains four embedded JPEG images and standard .resources files. At runtime, it displays a Spanish-language WinForms MDI application for generating RPG characters (Elf, Human, Vampire races). It does not make network connections, write to the registry, spawn child processes, or load additional assemblies dynamically. The version-info metadata claims "Microsoft Corporation / Thumbnail Handler" which is inconsistent with the actual application behavior. Confirmed sibling to ad301389 (same codebase, different internal name and embedded images).

Detection Signatures

• CAPA (static): Reflective Code Loading [T1620] — FALSE POSITIVE (standard CLR bootstrap)
• CAPA (static): File and Directory Discovery [T1083] — FALSE POSITIVE (System.IO.Path / FileDialog)
• YARA: PE_File_Generic — trivial match, not actionable ^[yara.txt:1]

References

• Artifact ID: 93537ae7-7baa-41fc-90f3-9da99d33c593 ^[metadata.json:2]
• Source: OpenCTI / MalwareBazaar (tag: exe, malware-bazaar) ^[triage.json:7-10]
• Related wiki pages:
  • unclassified-dotnet — umbrella entity for unattributed .NET binaries
  • version-info-masquerade — concept page for fabricated VS_VERSIONINFO abuse
  • social-engineering-filename-lure — concept page for themed filename distribution
  • double-extension-masquerade — concept page for .pdf.exe extension abuse

Provenance

• file.txt — file(1) output, PE32 Mono/.Net assembly
• exiftool.json — ExifTool v12.76, VS_VERSIONINFO and PE metadata
• pefile.txt — pefile.py DOS/NT headers, sections, directories, version info, imports
• strings.txt — strings extraction (2165 lines), Spanish UI strings and .NET metadata
• rabin2-info.txt — radare2 binary summary, arch=cil, subsys=dotnet
• capa.txt — Mandiant capa v7, static analysis, dotnet format
• binwalk.txt — embedded file carving (PE, microcode, XML manifest)
• triage.json — triage pipeline metadata
• metadata.json — artifact metadata from OpenCTI
• dynamic-analysis.md — CAPE skipped (no Windows guest)
• Custom Python scripts — manual .NET metadata parsing via struct, JPEG/PNG signature scans

All capa ATT&CK flags are assessed as false positives for this sample. The binary exhibits no malicious runtime behavior beyond the social-engineering masquerade.