unclassified-dotnet: 724d94aa — AdvWinProgHW2 calculator with stolen Simon Tatham certificate

Executive Summary

A .NET Framework 4.0 WinForms calculator application (AdvWinProgHW2 namespace, internal name pKDK.exe) repackaged with the social-engineering filename uZdFE99gyouWC1t.exe. Signed with the same stolen Simon Tatham (PuTTY developer) COMODO RSA Code Signing CA certificate observed in five prior corpus siblings. VS_VERSIONINFO masquerades as Adobe Reader / Microsoft PDF Document. Contains the Trif32 Caesar-shift-23 decoder shared with the PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint clusters. No packing, no obfuscation, no network APIs, no persistence, and no malicious payload. Capa anti-analysis flag is a false positive from Debug-build compiler attributes. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

How It Works

This binary is a repackaged student coursework project — an Advanced Windows Programming homework assignment (namespace AdvWinProgHW2) — distributed with a random-noise filename and a stolen Authenticode certificate to lend false legitimacy.

The application is a multi-form WinForms calculator with intermediate-result computation, colour-picker dialogs, login dialog, preferences dialog, about dialog (typoed AboutDisalog), and an oath/pledge form (OathForm). ^[strings.txt:133-255] Standard WinForms event handlers (button1_Click through button17_Click, BaseForm_MouseMove, colorToolStripMenuItem_Click) populate the string table. ^[strings.txt:148-167]

Certificate: The PE carries a valid WIN_CERTIFICATE at offset 0xC9600 (length 13,832 bytes, type 2 = PKCS#7). ^[pefile.txt] The embedded certificate chain validates through COMODO RSA Certification Authority → COMODO RSA Code Signing CA → end-entity CN=Simon Tatham (Cambridgeshire, GB). This is the same stolen certificate used by eea0dcbc, c4ee3a31081d, cae7ac1dc419, a1e6dc7a, and b4814a17. ^[/intel/analyses/eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a.html] The embedded URL https://www.chiark.greenend.org.uk/~sgtatham/putty/ confirms the certificate origin. ^[strings.txt:1923]

VS_VERSIONINFO masquerade: FileDescription: Microsoft PDF Document, CompanyName: Adobe Reader, ProductName: Adobe Reader, OriginalFilename: pKDK.exe, Comments: PDF document. ^[pefile.txt:233-243] This is the standard Adobe Reader masquerade observed in the GoldenCity/PrimeraVentana cluster siblings (92de8242, 61c10411).

Trif32 decoder: The Trif32 class name appears at line 23 of strings.txt — a shared Caesar-shift-23 string decoder also observed in the PrimeraVentana educational-app cluster (a42443c8, c4ee3a31081d, cae7ac1dc419, 6a53c56172ce), the GoldenCity game cluster (61c10411, 92de8242), the MyPaint.Editor vector-drawing app (6bc4e16d), and the Ivanov_WF_Paint editor (6d114209). ^[strings.txt:23] This confirms a shared coursework template or instructor-provided helper class.

Embedded resources: Six .resources files (Calculator.Form1.resources, AdvWinProgHW2.LoginDialog.resources, AdvWinProgHW2.PreferencesDialog.resources, AdvWinProgHW2.AboutDisalog.resources, AdvWinProgHW2.OathForm.resources, AdvWinProgHW2.Properties.Resources.resources) plus multiple PNG/JPEG icons and bitmaps extracted by binwalk (256×256, 512×512, 16×16, 32×32). ^[binwalk.txt] One PNG contains an Inkscape watermark (www.inkscape.org). ^[strings.txt]

No threat logic: Absence of System.Net, System.Security.Cryptography, System.Diagnostics.Process, System.IO.FileSystemWatcher, registry, or native API P/Invoke references. The only "cryptographic" reference is GetXorByte/xorByte inside the calculator's colour/theme logic, not payload encryption. ^[strings.txt:111]

Decompiled Behavior

No Ghidra/pyghidra analysis was performed — the binary is a standard .NET Framework CIL assembly with no native code. radare2 confirms cil language, signed: true, overlay: true (the certificate overlay), and 33 standard .NET method stubs. ^[rabin2-info.txt]

Entry point is _CorExeMain via mscoree.dll import, standard for .NET PE32. ^[pefile.txt:255]

C2 Infrastructure

None. No hardcoded IPs, domains, URLs, mutexes, named pipes, or registry keys related to C2. All HTTP references are certificate-chain CRL/OCSP URLs (http://crl.comodoca.com, http://ocsp.comodoca.com, http://www.usertrust.com). ^[strings.txt:1887-1926]

Interesting Tidbits

• Misspelled dialog class: AboutDisalog instead of AboutDialog — a human typo in the original coursework, preserved through repackaging. ^[strings.txt:138]
• get_pKJV typo: Property name get_pKJV in the string table suggests the internal name was originally pKJV.exe and later changed to pKDK.exe, or vice versa — a repackager editing the VS_VERSIONINFO but missing metadata strings. ^[strings.txt:48]
• Inkscape provenance: One embedded PNG contains www.inkscape.org — the UI assets were likely designed or edited in Inkscape, consistent with a student project. ^[strings.txt]
• Capa false positive: The sole "anti-analysis" hit (reference analysis tools strings) is triggered by DebuggerNonUserCodeAttribute and DebuggableAttribute present in Debug-configuration builds. ^[capa.txt] The MBC B0013.001 (Process detection) is similarly a false positive from standard .NET JIT/debug metadata.
• Random-noise filename: Unlike themed lures (PAYMENT_CANCELLED, PO-000002168, HAWB_#4532222), this distribution uses a random-noise basename (uZdFE99gyouWC1t.exe) — possibly an automated repackager or download-manager rename.

How To Mess With It (Homelab Replication)

Toolchain: Visual Studio 2019/2022, .NET Framework 4.0, C# WinForms Application template.

Build steps:

1. Create a new C# WinForms App (.NET Framework 4.0).
2. Add multiple forms: MainForm (calculator), LoginDialog, PreferencesDialog, AboutDialog, OathForm.
3. Add Trif32 utility class with Caesar-shift-23 decoder:

   public class Trif32 {
       public static string Decode(string input) {
           char[] buf = new char[input.Length];
           for (int i = 0; i < input.Length; i++) buf[i] = (char)(input[i] - 23);
           return new string(buf);
       }
   }
   

4. Build in Debug configuration to reproduce the capa false-positive fingerprint.
5. Sign with a self-signed certificate (or observe the unsigned-vs-signed delta in triage).

Verification: Run capa <reproducer.exe> — should hit the same three capabilities (anti-analysis/reference analysis tools strings, executable/resource/access .NET resource, runtime/dotnet/compiled to .NET platform). ^[capa.txt]

What you'll learn: How a benign .NET homework assignment acquires a malware-like static fingerprint through standard framework APIs and Debug-build compiler attributes, and how the Trif32 Caesar-shift decoder has become a cluster-wide marker for repackaged student coursework.

Deployable Signatures

YARA Rule

rule unclassified_dotnet_stolen_tatham_cert : dotnet masquerade {
    meta:
        description = "Detects .NET PE32 signed with stolen Simon Tatham COMODO RSA cert and Adobe Reader VS_VERSIONINFO masquerade"
        author      = "triage"
        date        = "2026-07-05"
        sha256      = "724d94aa2eb7c09cdd8eca00e68017b430fe332c68a2201b5e308fe04715c545"
    strings:
        $tatham_url = "https://www.chiark.greenend.org.uk/~sgtatham/putty/" ascii wide
        $adobe_desc = "Microsoft PDF Document" ascii wide
        $adobe_prod = "Adobe Reader" ascii wide
        $trif32     = "Trif32" ascii wide
        $advwin     = "AdvWinProgHW2" ascii wide
        $comodo_crl = "crl.comodoca.com/COMODORSACodeSigningCA" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        ($tatham_url or $comodo_crl) and
        (2 of ($adobe_desc, $adobe_prod, $trif32, $advwin))
}

Sigma Rule

title: Stolen Simon Tatham Certificate Adobe Reader Masquerade Execution
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        - OriginalFileName|contains:
            - 'pKDK.exe'
            - 'pKJV.exe'
        - Company|contains: 'Adobe Reader'
        - Description|contains: 'Microsoft PDF Document'
    condition: selection
falsepositives:
    - None expected; Adobe Reader is never distributed as .exe named pKDK.exe
level: high

IOC List

Behavioral Fingerprint Statement

This binary is a .NET Framework 4.0 WinForms PE32 with no packing, no obfuscation, and no malicious APIs. It loads mscoree.dll!_CorExeMain, presents standard WinForms UI event handlers, embeds PNG/JPEG resources, and carries a stolen Authenticode certificate with Adobe Reader version-info masquerade. No network, process, registry, or crypto operations are observable statically. The threat is purely social-engineering masquerade leveraging a trusted certificate to bypass "Unknown Publisher" warnings.

Detection Signatures

References

• unclassified-dotnet — Umbrella entity for unattributed .NET Framework PE32/PE32+ binaries
• stolen-certificate-signing — Concept page for stolen Authenticode certificate abuse
• Sibling analyses sharing stolen Tatham certificate: eea0dcbc, c4ee3a31081d, cae7ac1dc419, a1e6dc7a, b4814a17
• Sibling analyses sharing Trif32 decoder: a42443c8, c4ee3a31081d, cae7ac1dc419, 6a53c56172ce, 61c10411, 92de8242, 6bc4e16d, 6d114209

Provenance

• file.txt — file(1) v5.44
• pefile.txt — pefile v2023.2.7 + custom dump script
• strings.txt — strings(1) from binutils, 6-byte minimum
• floss.txt — flare-floss v3.1.1 (errored on invocation; no decoded strings recovered)
• capa.txt — flare-capa v7.4.0, static analysis mode
• binwalk.txt — binwalk v2.3.4
• rabin2-info.txt — radare2 v5.9.2
• exiftool.json — ExifTool v12.76
• Certificate parsed manually with openssl pkcs7 + x509
• No CAPE dynamic analysis available (no Windows guest)