unclassified-dotnet: 6d114209 — Ivanov_WF_Paint WinForms editor with Trif32 decoder

Executive Summary

A .NET Framework 4.0 WinForms vector-drawing application (Ivanov_WF_Paint namespace, internal name fiwi.exe) repackaged with the social-engineering filename New_order.exe. Contains the Trif32 character-pair lookup decoder shared with the PrimeraVentana/GoldenCity/MyPaint.Editor clusters. No packing, no obfuscation, no network APIs, no persistence, and no malicious payload. Capa T1620/B0013.001 flags are false positives from Debug-build compiler attributes. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

How It Works

The binary is an unobfuscated CIL assembly with a single-namespace WinForms paint/drawing editor (Ivanov_WF_Paint). Classes include Form1 (main canvas), CustomButton, ToggleButton, Layer, BitmapLayers, Picture, FillModeSettings, TextSettings, and About. The UI supports GDI+ shape primitives (line, rectangle, ellipse, triangle), pen/eraser tools, layer management, colour picker, fill-mode settings, and XML/JSON export.

No System.Net, System.Security, Registry, Process, or cryptographic namespaces are referenced. The only suspicious artefact is the Trif32 string at offset ~0x5C0 in .text ^[strings.txt:25], which matches the character-pair lookup decoder observed in the PrimeraVentana (a42443c8, 6a53c56172ce), GoldenCity (61c10411, 92de8242), and MyPaint.Editor (6bc4e16d) clusters. In those samples the decoder is used for trivial embedded-string decoding (likely a shared coursework utility). Here it appears in the same form but its exact call site is not exercised by the visible UI surface.

Decompiled Behavior

radare2 analysis (level 2) found 314 functions, all standard .NET method stubs for WinForms event handlers and GDI+ calls. ^[r2:analysis] Entry point resolves to _CorExeMain via mscoree.dll. No native API imports, no reflection.Emit, no P/Invoke, no AMSI bypass. The .text section entropy is 7.84 — expected for a JIT-compiled CIL image with embedded resources. The .rsrc section (3.45 entropy) contains RT_VERSION and RT_MANIFEST entries plus five embedded .resources files for localized UI strings and bitmap data.

C2 Infrastructure

None observed. No hardcoded IPs, domains, URLs, mutexes, named pipes, or registry keys. The binary contains zero networking artefacts.

Interesting Tidbits

• Future-dated PE timestamp (2062) and fabricated VS_VERSIONINFO masquerading as a Microsoft "Script Host" utility — same pattern as the PrimeraVentana cluster. ^[pefile.txt:34] ^[exiftool.json:37-44]
• Trif32 decoder recurrence — this is at least the eighth sample in the corpus sharing this decoder. The shared artefact suggests a common coursework source or developer toolchain, not a crimeware builder. ^[strings.txt:25]
• Embedded PNG artefacts — binwalk found a 126×125×32 BMP and a 510×510 RGBA PNG icon/splash inside .rsrc. ^[binwalk.txt]
• No anti-analysis — no VM detection, no debugger checks, no sandbox gates, no delay loops.
• No CAPE detonation — skipped because no Windows guest is available. Dynamic behaviour would be indistinguishable from a benign paint program.

How To Mess With It (Homelab Replication)

1. Build a comparable .NET WinForms app in C# with GDI+ primitives, layer management, and XML export.
2. Compile with Visual Studio 2019+ in Debug configuration, target .NET Framework 4.0.
3. Add a trivial character-pair lookup decoder named Trif32 to match the static fingerprint.
4. Verify: capa reproducer.exe should hit the same false-positive T1620 (reflective loading) and B0013.001 (process detection) from compiler-generated attributes.

Deployable Signatures

YARA

rule UnclassifiedDotNet_IvanovPaint_Trif32
{
    meta:
        description = "Ivanov_WF_Paint WinForms editor with Trif32 decoder — benign false-positive cluster"
        author = "SOC"
        date = "2026-07-04"
        hash = "6d1142097d69b5d05cb3774ad591d53ab7759222ed8b563042121321b84db577"
    strings:
        $ns1 = "Ivanov_WF_Paint" ascii wide
        $ns2 = "fiwi.exe" ascii wide
        $ns3 = "fiwi.pdb" ascii
        $dec = "Trif32" ascii wide
        $res1 = "Ivanov_WF_Paint.Form1.resources" ascii wide
        $res2 = "Ivanov_WF_Paint.Properties.Resources.resources" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        (2 of ($ns*) or $dec) and
        any of ($res*)
}

IOC List

Behavioral Fingerprint

This binary is a .NET Framework 4.0 PE32 with a single WinForms namespace (Ivanov_WF_Paint), no networking imports, no cryptographic imports, no registry or process APIs, and a benign GDI+ paint-canvas UI. The only distinguishing static artefact is the Trif32 character-pair decoder shared with the PrimeraVentana/GoldenCity/MyPaint.Editor benign-application cluster. When executed it displays a standard Windows Forms drawing editor with toolbars for shapes, colours, layers, and export to XML/JPEG. No C2, no persistence, and no payload delivery behaviour is expected at runtime.

Detection Signatures

References

• unclassified-dotnet — Umbrella entity for unattributed .NET Framework binaries; this sample is a confirmed sibling in the PrimeraVentana/GoldenCity/MyPaint.Editor benign-application cluster.
• MalwareBazaar entry for SHA-256 6d1142097d69b5d05cb3774ad591d53ab7759222ed8b563042121321b84db577

Provenance

Static artefacts gathered by triage-fast: file v5.44, exiftool v12.76, pefile (Python), strings, ssdeep, tlsh, yara (generic rules only), floss (errored on invocation), capa v7, binwalk v2.3.4, radare2 v5.9.8 (CIL analysis). No CAPE detonation available. Analysis completed 2026-07-04.