> Analysis · 6a53c56172ce_

~/packetpursuit $ cat /intel/analyses/6a53c56172ce.../report.md

typeanalysisfamilyunclassified-dotnetconfidencehigh
SHA-256: 6a53c56172ce6e29d1ab7e14cbd2ad20069637828cbb8a12d240addcf96dd5bc

Executive Summary

.NET Framework 4.0 WinForms Spanish-language educational app (PrimeraVentana namespace, TZic.exe) repackaged with a LUA Client / Microsoft Corporation. VS_VERSIONINFO masquerade and distributed as 20240920060544041.exe. No packing, no obfuscation, no network APIs, no persistence, no payload. Threat is purely social-engineering masquerade. Sixth confirmed sibling in the PrimeraVentana educational-app cluster.

What It Is

Attribute Value
SHA-256 6a53c56172ce6e29d1ab7e14cbd2ad20069637828cbb8a12d240addcf96dd5bc
Filename 20240920060544041.exe
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, 3 sections ^[file.txt]
Size 902,656 bytes
Timestamp 2067-01-23 12:34:30 UTC (future-dated, fabricated) ^[rabin2-info.txt]
PDB TZic.pdb ^[rabin2-info.txt]
Signed No ^[rabin2-info.txt]
YARA PE_File_Generic only ^[yara.txt]

Build / RE

Toolchain: .NET Framework 4.0, C# WinForms, unobfuscated CIL. ^[file.txt] ^[triage.json]

Version-info masquerade: FileDescription: LUA Client, CompanyName: Microsoft Corporation., ProductName: LUA Client, OriginalFilename: TZic.exe, FileVersion: 1.0.0.0. ^[exiftool.json] Same pattern as sibling a42443c8 which masqueraded as "LUA Client" / "Microsoft Corporation." with internal name Djxu.exe.

Packing / obfuscation: None. No packer, no native code, no control-flow flattening. Standard CIL with Debug build attributes. ^[capa.txt]

Anti-analysis: None observed. Future-dated timestamp is fabrication, not a time-bomb. capa flags T1620 (Reflective Code Loading), C0021.003 (Pseudo-random), and B0013.001 (Analysis Tool Discovery) are false positives from standard .NET Assembly.Load/CreateInstance, System.Random, and DebuggerBrowsableState/DebuggableAttribute in Debug-configuration builds — identical to siblings a42443c8, c4ee3a31, and cae7ac1dc419. ^[capa.txt]

Embedded resources: PNG icons (32×32, 584×584), Zlib-compressed .resources blob, XML UAC manifest. ^[binwalk.txt]

Notable classes / functions:

  • PrimeraVentana namespace with forms frmClasePersona, VentanaPrincipal, frmPrincipal ^[strings.txt:24-26]
  • Data-model properties: CodMarca, CantidadVendida, Capacidad, Nombre, Chocolate, Material, Origen, AnioNacimiento, TipoDocumento, NumeroDocumento, TiempoEnElPais, CodArtVendidos, Estatus ^[strings.txt:18-55]
  • UI controls: btnMostrarPersona, rbTurista, rbNacional, txtNombre, cbChocolate, dtpAnioNacimiento, txtNumeroDocumento, nudAniosEnElPais ^[strings.txt:25-257]
  • Trif32 utility class (line 15) — Caesar-shift-23 string decoder shared with the PrimeraVentana cluster (a42443c8, c4ee3a31, cae7ac1dc419, 61c10411) and ABMProductos inventory app (99e5d5d8). ^[strings.txt:15]
  • Standard .NET CreateInstance reflection (line 58) — not malicious reflective loading. ^[strings.txt:58]

Deploy / ATT&CK

No malicious TTPs. Static-only inference (CAPE unavailable — no Windows guest).

ATT&CK Technique Assessment Source
T1620 Reflective Code Loading False positive — standard .NET Assembly.Load + CreateInstance in Debug build ^[capa.txt]
C0021.003 Generate Pseudo-random Sequence False positive — System.Random in educational number-guessing or UI logic ^[capa.txt]
B0013.001 Analysis Tool Discovery False positive — DebuggableAttribute / DebuggerBrowsableState ^[capa.txt]

No persistence, no C2, no lateral movement, no exfil, no impact. Absence of System.Net, System.Security, System.Diagnostics.Process, Registry, cmd.exe, powershell, rundll32, regsvr32, or injection APIs confirmed by exhaustive string search. ^[strings.txt]

Siblings & Clustering

Sixth confirmed sibling in the PrimeraVentana Spanish educational-app cluster:

  • a42443c8 — PrimeraVentana / Djxu.exe, "LUA Client" / "Microsoft Corporation." masquerade, University__of_Bahrain-_Project_FMD20240342.exe ^[/intel/analyses/a42443c84fc9ec4a4f00c4363eee5074e94cfbb286a48fcbd33496dbbf0f5455.html]
  • c4ee3a31 — PrimeraVentana / InXv.exe, stolen Simon Tatham certificate, HAWB_#4532222.exe ^[/intel/analyses/c4ee3a31081db5feff937ed7a716fd805b467dacc6c1d679c4508e5b51ba8895.html]
  • cae7ac1dc419 — PrimeraVentana / WVmY.exe, same stolen Tatham certificate, TRANSACTION_ERROR.PDF.exe ^[/intel/analyses/cae7ac1dc4191db8041bca77127910f900f9effbe1b9e87492ba49549de14676.html]
  • 61c10411 — GoldenCity / qAdT.exe, shares Trif32 decoder and Adobe Reader masquerade ^[/intel/analyses/61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd.html]
  • 99e5d5d8 — ABMProductos inventory app, shares Trif32 / CustomDecode decoder ^[/intel/analyses/99e5d5d8e7e04fa65d12f184c7dc0c5ceb012125e00d99eb5c10fad33f3c87ff.html]

Attribution: None. Benign educational coursework repackaged for social-engineering distribution. No crimeware family linkage.