unclassified-dotnet: 6bc4e16d — MyPaint Editor with "Purchase Order" masquerade

Executive Summary

A .NET Framework 4.0 WinForms vector-drawing application (MyPaint.Editor namespace) repackaged with a purchase-order social-engineering filename (PURCHASE_ORDER-6350.exe). No malicious payload, no network APIs, no persistence, no anti-analysis. Capa-detected T1620 and T1083 are false positives from standard .NET resource loading and file-dialog usage. Static-only analysis (no CAPE Windows guest).

What It Is

The binary is a C# WinForms paint program with three PE sections (.text entropy 7.83, .rsrc entropy 4.09, .reloc entropy 0.10), a minimal IAT importing only mscoree.dll!_CorExeMain, and a ~5.8 KB .rsrc section containing toolbar PNG icons, a 509×509 application icon, and a standard UAC manifest. ^[pefile.txt] ^[binwalk.txt]

How It Works

The application is a basic 2D vector-drawing editor with the following surface:

• Drawing canvas (pictureBoxPaint) with mouse event handlers for MouseDown, MouseMove, MouseUp, and Paint events ^[strings.txt]
• Shape tools — line, rectangle, square, circle, ellipse — selectable via RadioButton controls in a GroupBox (groupBoxShapes) ^[strings.txt]
• Origin/Ending pickers — two Panel controls (panelOriginPicker, panelEndingPicker) for setting stroke endpoints via click-and-drag ^[strings.txt]
• Console text box (tbConsole) — a multiline read-only text area for status messages and shape metadata ^[strings.txt]
• Menu bar — standard WinForms MenuStrip with File (Open, Save, Save As, New, Exit), Edit (Undo, Redo, Cut, Copy, Paste, Select All), Tools, Help, and About items ^[strings.txt]
• Image I/O — OpenFileDialog / SaveFileDialog with Bitmap / ImageFormat saving and JSON serialization (SaveInJsonFormat, OpenDrawingFromJson) ^[strings.txt]
• Undo/Redo stack — managed via a List<Shape> backing field (_shapes) with Add, Remove, RemoveAll, and DrawAll methods ^[strings.txt]

No malicious behavior: Zero references to System.Net, System.Security, System.Diagnostics.Process, Microsoft.Win32.Registry, or any P/Invoke DllImport signatures. The #Blob metadata stream contains no native API names. ^[strings.txt] ^[pefile.txt]

The Trif32 class name appears at line 19 of strings.txt — a shared Caesar-shift-23 decoder utility also observed in the PrimeraVentana educational-app cluster (a42443c8, c4ee3a31081d, cae7ac1dc419, 6a53c56172ce) and the GoldenCity game cluster (61c10411, 92de8242). This confirms a shared coursework template or instructor-provided helper class across otherwise unrelated student projects. ^[strings.txt]

Decompiled Behavior

Entry point is standard .NET CIL: _CorExeMain → CLR bootstrap → Program.Main → Application.EnableVisualStyles → Application.Run(new MainForm()) → MainForm..ctor → InitializeComponent. ^[strings.txt]

Notable methods in the call tree:

• InitializeComponent — WinForms designer-generated UI layout (ToolStrip, MenuStrip, PictureBox, Panel, GroupBox, TextBox, RadioButton, OpenFileDialog, SaveFileDialog) ^[strings.txt]
• pictureBoxPaint_MouseDown / MouseMove / MouseUp — drag-to-draw shape creation with isDragging / isDrawing state flags ^[strings.txt]
• panelOriginPicker_MouseDown / MouseMove / MouseUp — endpoint selection for line/rectangle primitives ^[strings.txt]
• panelEndingPicker_MouseDown / MouseMove / MouseUp — second endpoint selection ^[strings.txt]
• MainForm_KeyDown — keyboard shortcuts via KeyEventArgs.KeyCode ^[strings.txt]
• CreateNewShape / SetLastShape — factory methods for Point2D, Line, Rectangle, Circle, Ellipse instances ^[strings.txt]
• DrawLine / DrawRectangle / DrawEllipse — GDI+ rendering via Graphics.DrawLine / DrawRectangle / DrawEllipse ^[strings.txt]
• SaveDrawingAsBitmap / ProcessBitmap / DrawToBitmap — raster export to System.Drawing.Bitmap ^[strings.txt]
• SaveInJsonFormat / OpenDrawingFromJson — vector serialization via JSON (likely System.Web.Script.Serialization or custom serializer) ^[strings.txt]
• undoToolStripMenuItem1_Click / redoToolStripMenuItem1_Click — stack manipulation for undo/redo ^[strings.txt]
• openImageToolStripMenuItem_Click / bitmapToolStripMenuItem_Click — file I/O via standard dialog boxes ^[strings.txt]
• MainForm_Resize — responsive canvas scaling on window resize ^[strings.txt]
• Trif32 — utility class with Caesar-shift-23 string decoder (shared with PrimeraVentana/GoldenCity clusters) ^[strings.txt]

Capa flags T1620 Reflective Code Loading from Assembly.Load and MethodBase.Invoke — these are standard .NET ResourceManager and designer-generated event-wireup patterns, not payload injection. ^[capa.txt]

Capa flags T1083 File and Directory Discovery from GetFolderPath and file-dialog usage — standard OpenFileDialog / SaveFileDialog directory enumeration. ^[capa.txt]

C2 Infrastructure

None. No network APIs, no hardcoded URLs, no DNS resolution, no socket creation. The binary is entirely offline.

Interesting Tidbits

• Filename social engineering: PURCHASE_ORDER-6350.exe — classic procurement-themed lure with numeric padding to suggest legitimacy. Bare .exe extension (no double-extension masquerade), relying on Windows "Hide extensions for known file types" default. ^[metadata.json]
• VS_VERSIONINFO masquerade: The legitimate app metadata (MyPaint Editor / AwrU.exe / v1.0.0.0) is preserved, but the distribution filename contradicts it entirely. Unlike siblings that fabricate Adobe Reader or Microsoft Corporation branding, this one retains the original developer metadata, suggesting either a lazier repackager or a different distribution pipeline. ^[pefile.txt]
• Trif32 cluster linkage: The presence of Trif32 ties this sample to at least six other analyses in the corpus (PrimeraVentana Spanish educational apps and GoldenCity games). This is strong evidence that the repackager is sourcing from a common pool of student coursework or open-source tutorial projects. ^[strings.txt]
• PDB path: AwrU.pdb — nonsense four-character prefix matching the internal name, consistent with auto-generated names by a repackager tool or Visual Studio's default project-naming behavior. ^[pefile.txt]
• Resource structure: Binwalk found eight 16×16 PNG toolbar icons (likely newToolStripMenuItem, openToolStripMenuItem, saveToolStripMenuItem, etc.), one 131×131 bitmap (application icon), one 509×509 PNG (splash or about-dialog image), and a standard UAC manifest requesting asInvoker execution level. No encrypted payload, no manifest resource decryption. ^[binwalk.txt]
• Debug build: DebuggableAttribute with DebuggingModes.Default and DebuggerNonUserCodeAttribute on designer-generated methods trigger capa T1620 false positives. ^[strings.txt]
• MyPaint.Bussiness namespace: The misspelling of "Business" as "Bussiness" (two s's) is a strong indicator of non-native English speaker authorship — consistent with the PrimeraVentana (Spanish) and GoldenCity (Russian/Cyrillic) clusters. ^[strings.txt]

How To Mess With It (Homelab Replication)

Toolchain: Visual Studio 2019/2022, .NET Framework 4.0 Targeting Pack, C# WinForms Application template.

Steps:

1. Create a new WinForms project targeting .NET Framework 4.0.
2. Add a PictureBox (pictureBoxPaint) with PictureBoxSizeMode.Normal for the drawing canvas.
3. Add two Panel controls (panelOriginPicker, panelEndingPicker) with BackColor set to distinct colors for endpoint visualization.
4. Add a GroupBox (groupBoxShapes) with RadioButton controls for line, rectangle, square, circle, and ellipse.
5. Add a TextBox (tbConsole) with Multiline=true, ReadOnly=true, and ScrollBars=Vertical.
6. Add a MenuStrip with standard File/Edit/Tools/Help items and ToolStripSeparator dividers.
7. Implement mouse event handlers (MouseDown, MouseMove, MouseUp) on the canvas to create Point2D origin/ending pairs and instantiate shape objects.
8. Override OnPaint to render shapes via Graphics.DrawLine, DrawRectangle, DrawEllipse.
9. Add OpenFileDialog / SaveFileDialog with Filter set to bitmap and JSON formats.
10. Add a Trif32 utility class with a Caesar-shift-23 decoder:

    public static string Decode(string input) {
        return new string(input.Select(c => char.IsLetter(c) ? 
            (char)((c - (char.IsUpper(c)?'A':'a') + 23) % 26 + (char.IsUpper(c)?'A':'a')) : c).ToArray());
    }
    

11. Embed PNG toolbar icons (16×16) and a 509×509 splash image as .resources via Project → Properties → Resources.
12. Build in Debug configuration to reproduce the capa false-positive fingerprint.

Verification: Run capa on the output. Expect T1620 (from Assembly.Load in resource manager) and T1083 (from GetFolderPath in dialog boxes). Compare to this sample's capa.txt.

What you'll learn: How a benign .NET paint program acquires a malware-like static fingerprint through standard framework APIs, how capa heuristics can be fooled by Debug-build compiler attributes, and how the Trif32 Caesar-shift decoder has become a cluster-wide marker for repackaged student coursework.

Deployable Signatures

YARA Rule

rule UnclassifiedDotnet_MyPaintEditor_Masquerade
{
    meta:
        description = "MyPaint Editor .NET WinForms paint program with social-engineering masquerade"
        author = "pp-hermes"
        date = "2026-07-04"
        sha256 = "6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b"
        reference = "/intel/analyses/6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b.html"

    strings:
        $namespace1 = "MyPaint.Editor" ascii wide
        $namespace2 = "MyPaint.Bussiness" ascii wide
        $class1 = "MainForm" ascii wide
        $class2 = "GraphicTool" ascii wide
        $class3 = "Point2D" ascii wide
        $class4 = "FileManager" ascii wide
        $trif32 = "Trif32" ascii wide
        $ui1 = "pictureBoxPaint" ascii wide
        $ui2 = "panelOriginPicker" ascii wide
        $ui3 = "panelEndingPicker" ascii wide
        $ui4 = "tbConsole" ascii wide
        $ui5 = "tbShapesKeys" ascii wide
        $ui6 = "rbCircle" ascii wide
        $ui7 = "rbRectangle" ascii wide
        $ui8 = "rbLine" ascii wide
        $ui9 = "rbSquare" ascii wide
        $menu1 = "undoToolStripMenuItem1" ascii wide
        $menu2 = "openImageToolStripMenuItem" ascii wide
        $menu3 = "clearConsoleToolStripMenuItem" ascii wide
        $menu4 = "saveToolStripMenuItem" ascii wide
        $menu5 = "openDrawingToolStripMenuItem" ascii wide
        $menu6 = "bitmapToolStripMenuItem" ascii wide
        $method1 = "SaveInJsonFormat" ascii wide
        $method2 = "OpenDrawingFromJson" ascii wide
        $method3 = "SaveDrawingAsBitmap" ascii wide
        $method4 = "ProcessBitmap" ascii wide
        $method5 = "CreateNewShape" ascii wide
        $method6 = "SetLastShape" ascii wide
        $version1 = "MyPaint Editor" ascii wide
        $version2 = "AwrU.exe" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        pe.is_dotnet and
        ($namespace1 or $namespace2) and
        $class1 and
        ($trif32 or 2 of ($class*)) and
        3 of ($ui*) and
        3 of ($menu*) and
        2 of ($method*)
}

Behavioral Fingerprint Statement

This binary is a .NET Framework 4.0 WinForms GUI executable with a three-section PE layout (.text, .rsrc, .reloc), minimal IAT (mscoree.dll only), and a ~5.8 KB embedded .rsrc section containing 16×16 PNG toolbar icons, a 131×131 bitmap, a 509×509 PNG splash image, and a standard UAC manifest. It instantiates a MainForm with PictureBox, Panel, GroupBox, TextBox, RadioButton, MenuStrip, OpenFileDialog, and SaveFileDialog controls, wires mouse event handlers for drag-to-draw shape creation, and renders primitives via GDI+ Graphics.DrawLine / DrawRectangle / DrawEllipse. It supports undo/redo via a List<Shape> backing field and exports drawings to bitmap and JSON formats. No network APIs, no registry access, no process manipulation, and no P/Invoke imports are present. The DebuggableAttribute and DebuggerNonUserCodeAttribute compiler-generated attributes cause capa to flag T1620 falsely. The GetFolderPath and file-dialog usage triggers T1083.

IOC List

Detection Signatures

References

• Artifact ID: 0b3c7669-1eee-4508-87cb-4912b91fb5c8 ^[metadata.json]
• Source: OpenCTI / MalwareBazaar
• Related wiki pages:
  • unclassified-dotnet — umbrella entity for unattributed .NET samples
  • version-info-masquerade — VS_VERSIONINFO falsification technique
  • social-engineering-filename-lure — filename-based social engineering
  • social-engineering-purchase-order-masquerade — purchase-order themed lure pattern
• Sibling analyses sharing Trif32 decoder:
  • 61c10411 — GoldenCity Wild West game with "Accessibility shortcut" masquerade ^[/intel/analyses/61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd.html]
  • 92de8242 — GoldenCity sibling with Adobe Reader masquerade ^[/intel/analyses/92de82423ad9fbbae32673ebf26710b8fbfae04b09bcf678d46ff8bf0512ae6a.html]
  • a42443c8 — PrimeraVentana Spanish educational app ^[/intel/analyses/a42443c84fc9ec4a4f00c4363eee5074e94cfbb286a48fcbd33496dbbf0f5455.html]
  • 6a53c56172ce — PrimeraVentana sibling with LUA Client masquerade ^[/intel/analyses/6a53c56172ce6e29d1ab7e14cbd2ad20069637828cbb8a12d240addcf96dd5bc.html]

Provenance

• file.txt — file v5.44
• exiftool.json — ExifTool v12.76
• pefile.txt — pefile (Python) + custom script
• strings.txt — strings v2.39
• floss.txt — flare-floss v3.1.1 (errored on invocation — invalid CLI argument order)
• capa.txt — flare-capa v7.1.0 (static analysis, OS: any)
• binwalk.txt — binwalk v2.3.4
• rabin2-info.txt — radare2 v5.9.6
• metadata.json — triage pipeline schema v1
• .NET metadata — custom Python script using pefile + struct
• dynamic-analysis.md — CAPE skipped (no Windows guest)