unclassified-dotnet: 7b3ef687 — Brazilian pizza-shop POS/CRM (products-list.exe)

Executive Summary .NET Framework 4.0 WinForms point-of-sale / customer-relationship-management application for a Brazilian pizza restaurant (Pizzaria_Management_VIEW). Standard SQL Server backend via System.Data.SqlClient, embedded PNG menu icons, and a trivial Trif32 character-pair decoder shared with the PrimeraVentana/GoldenCity coursework cluster. No network APIs, no persistence, no anti-analysis, no payload. capa T1213 / T1620 flags are false positives from benign System.Data and System.Reflection patterns. Assessed as benign application — false-positive MalwareBazaar ingestion or social-engineering masquerade.

What It Is

How It Works

This is a standard .NET Framework 4.0 Windows Forms GUI application implementing a pizza-restaurant management system. The namespace Pizzaria_Management_VIEW contains forms for customer registration (CadCliente, GerenciamentoCadastro), order management (CadPedido, GerenciamentoPedido), product/stock control (CadProduto, GerenciamentoEstoque), and employee management (CadFuncionario). ^[strings.txt:53-125]

Database layer: ClienteDAL (Data Access Layer) under DAL.Model namespace exposes BuscarClientePorID, ListarClientes, InserirCliente, AtualizarCliente, ExcluirCliente using System.Data.SqlClient (SqlConnection, SqlCommand, SqlDataReader, SqlParameter). ^[strings.txt:54-56] ^[strings.txt:78-80] ^[strings.txt:251-253] ^[strings.txt:288-290]

UI layer: Full WinForms MDI application with TabControl, MenuStrip, DataGridView, PictureBox, DateTimePicker, MaskedTextBox, and ComboBox controls. ^[strings.txt:12-50] Portuguese-language menu items (pedido, produto, estoque, login, funcionário, cadastro, gerenciamento, data). ^[strings.txt:163-200]

Embedded resources: Multiple .resources blobs for each form (Pizzaria_Management_VIEW.CadCliente.resources, etc.) plus a Properties.Resources.resources icon/data bundle. ^[strings.txt:274-283] Binwalk confirms four embedded PNG images (256×256, 400×226, 256×256, 508×508) — likely menu/category icons and a splash/logo. ^[binwalk.txt]

String decoder: The Trif32 method (line 27 of strings.txt) is a trivial character-pair lookup decoder shared across the PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint coursework cluster. In this sample it likely decodes an embedded SQL connection string or localized UI string block. No cryptographic sophistication. ^[strings.txt:27]

Decompiled Behavior

Ghidra not run (no .NET decompiler backend available in current tooling). radare2 analysis completed at level 3, yielding 193 functions — all standard .NET method stubs and compiler-generated attributes. ^[r2:analysis.log] The only import is mscoree.dll!_CorExeMain (standard .NET bootstrap). ^[r2:imports] No P/Invoke signatures, no native API calls, no DllImport attributes.

No suspicious control-flow patterns, no anti-debug checks, no VM detection, no time-bombs. Code quality is consistent with a Visual Studio WinForms designer-generated application.

C2 Infrastructure

None. Zero network, socket, HTTP, FTP, or email APIs. No hardcoded URLs, IPs, domains, or C2 infrastructure in static analysis. No System.Net namespace references. ^[strings.txt]

Interesting Tidbits

• Linguistic clues: Portuguese-language UI strings (pedido, produto, funcionário, cadastro, gerenciamento, data, asdasd placeholder menu item) strongly indicate Brazilian origin. ^[strings.txt:163-200]
• Business name: Valey Silicone appears as the legal-trademarks field — likely the actual company or developer name, not an obfuscation artifact. ^[exiftool.json:42]
• No PDB path: Unlike many student/coursework samples, this binary lacks a PDB path reference, suggesting it was built in Release configuration or the PDB was stripped before distribution.
• capa false positives: T1213 (Data from Information Repositories) triggered by System.Data.SqlClient references in a database-querying CRM. T1620 (Reflective Code Loading) triggered by System.Reflection.Assembly metadata tokens and InvokeMember compiler-generated code. B0013.001 (Analysis Tool Discovery — Process detection) is a generic .NET runtime match. ^[capa.txt]
• No malicious payload: After exhaustive static inspection (strings, floss, capa, binwalk, radare2, Python byte-scan), no credential-theft APIs, no network APIs, no persistence mechanisms, no anti-analysis, and no payload delivery logic were found.

How To Mess With It (Homelab Replication)

Toolchain: Visual Studio 2019/2022 Community, .NET Framework 4.0, C# WinForms Application template.

Steps:

1. Create a new C# Windows Forms App (.NET Framework 4.0).
2. Add System.Data.SqlClient via NuGet or reference.
3. Build MDI parent form (Main), child forms for CRUD operations (CadCliente, CadPedido, CadProduto, etc.).
4. Add MenuStrip with Portuguese menu items.
5. Add DataGridView bound to SqlDataReader output.
6. Embed PNG resources via Project > Properties > Resources.
7. Build in Debug or Release. Resulting PE will match the capa fingerprint of this sample (T1213 + T1620 false positives from System.Data + System.Reflection).

Verification: Run capa on the reproducer. Expect hits on collection/database/sql, load-code/dotnet, runtime/dotnet — identical to this sample's capa.txt.

Deployable Signatures

YARA rule

rule PizzariaVIEW_Benign_DotNet
{
    meta:
        description = "Brazilian pizza-shop POS/CRM .NET WinForms application (benign, false-positive prone)"
        author = "PacketPursuit"
        hash = "7b3ef6871b0c4d64dd7fd96937c190763fae58bd560131b96dbc9ef860c75e54"
        date = "2026-07-07"

    strings:
        $ns1 = "Pizzaria_Management_VIEW" ascii wide
        $ns2 = "ClienteDAL" ascii wide
        $ns3 = "BuscarClientePorID" ascii wide
        $ns4 = "CadCliente" ascii wide
        $ns5 = "CadPedido" ascii wide
        $ns6 = "CadProduto" ascii wide
        $ns7 = "GerenciamentoCadastro" ascii wide
        $ns8 = "GerenciamentoPedido" ascii wide
        $ns9 = "GerenciamentoEstoque" ascii wide
        $vi1 = "Pizzaria VIEW" ascii wide
        $vi2 = "Valey Silicone" ascii wide
        $vi3 = "DzAz.exe" ascii wide
        $trif = "Trif32" ascii wide
        $dotnet = "v4.0.30319" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        ($dotnet or $trif) and
        (2 of ($ns*) or $vi1 or $vi2)
}

Behavioral fingerprint

A 750 KB PE32 .NET Framework 4.0 GUI assembly launches a WinForms MDI application with pizza-restaurant menu tabs (customer, order, product, stock). It initializes a System.Data.SqlClient connection on form load, populates DataGridView controls from SQL query results, and displays embedded PNG icons. No network sockets, no registry persistence, no process injection, no anti-debug checks. The binary is benign; any capa T1620 / T1213 hits are false positives from standard .NET runtime metadata.

IOC list

Detection Signatures

capa → MITRE ATT&CK mapping (with false-positive annotations)

References

• Artifact ID: 22a979ea-1e76-4f59-a3e3-42ed0726feac ^[metadata.json]
• Source: OpenCTI / MalwareBazaar
• Related wiki: unclassified-dotnet
• Related concept: social-engineering-filename-lure

Provenance

Analysis produced from:

• file.txt, exiftool.json, pefile.txt, strings.txt, ssdeep.txt, tlsh.txt, yara.txt, metadata.json, triage.json — automated triage pipeline (May 2026)
• floss.txt — FireEye flare-floss (failed on argument parsing, no decoded strings extracted)
• capa.txt — Mandiant flare-capa static analysis
• binwalk.txt — embedded artefact scan
• rabin2-info.txt — radare2 binary header summary
• dynamic-analysis.md — CAPE skipped (no Windows guest available)
• radare2 level-3 analysis (193 functions, 1 import, no suspicious patterns)
• Python byte-scan for network indicators, Base64 blocks, and P/Invoke signatures (negative)