unclassified-dotnet: 8d4d4300 — Node-graph WinForms editor, no payload

Executive Summary

.NET Framework 4.0 WinForms node-graph editor (visual drag/drop canvas with nodes, connectors, and event-driven UI) distributed with a random-noise filename (xrxMWJpak7E4F5Z.exe). No packing, no obfuscation, no network APIs, no persistence, and no anti-analysis. Capa failed on corrupted CLR metadata; floss invocation errored. Static assessment: benign application, likely false-positive MalwareBazaar ingestion.

What It Is

The binary is an unobfuscated CIL assembly compiled for .NET Framework 4.0. The namespace Graph and GraphNodes contain a full WinForms node-graph editor: draggable nodes, input/output connectors, connection lines, selection dialogs, text editors, and a grid background. The only "threat" is the random-noise filename under which it was uploaded to MalwareBazaar.

How It Works

The application is a standard .NET WinForms program with the following architecture:

• Main form: GraphNodes.ExampleForm — hosts the GraphControl canvas ^[strings.txt:54] ^[strings.txt:370]
• Selection dialog: Graph.SelectionForm — modal UI for selecting node types ^[strings.txt:371]
• Text editor: Graph.TextEditForm — inline text editing for node labels ^[strings.txt:372]
• Node types: NodeItem, NodeImageItem, NodeTitleItem, NodeLabelItem, NodeDropDownItem, NodeNumericSliderItem, NodeSliderItem, NodeColorItem, NodeTextBoxItem, NodeCheckboxItem ^[strings.txt:348-366]
• Connection system: NodeConnection, NodeConnector, NodeInputConnector, NodeOutputConnector with ICompatibilityStrategy (AlwaysCompatible, NeverCompatible, Incompatible) ^[strings.txt:404] ^[strings.txt:481-484] ^[strings.txt:713-715]
• Event surface: OnMouseClick, OnMouseUp, OnMouseMove, OnDrag, OnDoubleClick, OnConnectionAdded, OnConnectionRemoved, OnConnectionAdding, OnConnectionRemoving, OnShowLabelsChanged, OnShowElementMenu, OnImgClicked, OnColClicked ^[strings.txt:8-16] ^[strings.txt:54] ^[strings.txt:61-98]
• Rendering: System.Drawing.Drawing2D with GraphicsPath, DrawLine, DrawRectangle, DrawEllipse, DrawString, DrawImage, FillRectangle, FillEllipse, FillPath, FillPolygon ^[strings.txt:36] ^[strings.txt:186-193] ^[strings.txt:305-312]
• Resources: Embedded GraphNodes.ExampleForm.resources, Graph.SelectionForm.resources, Graph.TextEditForm.resources, Graph.Properties.Resources.resources ^[strings.txt:500-503]
• Grid rendering: SmallGridPen, LargeGridPen, BorderPen with configurable step sizes and colors ^[strings.txt:374-378] ^[strings.txt:735-739]

No malicious behavior observed. No System.Net, System.IO beyond UI resources, System.Security, System.Management, or System.Diagnostics.Process. No native API imports. No persistence. No anti-analysis.

Embedded Artifacts

Binwalk found three notable embedded objects ^[binwalk.txt]:

• PNG image: 523×523, 8-bit RGBA at offset 0x137FF — likely a UI icon or splash image
• Zlib compressed data: at offset 0x1384D — likely the .resources blob for the WinForms designer
• XML manifest: at offset 0xB71C3 — standard UAC asInvoker manifest ^[strings.txt:1941-1947]

Decompiled Behavior

radare2 analysis (level 2) found 95 functions, all standard .NET method stubs for the Graph namespace. No anti-debug, no suspicious imports, no packed payload stub. ^[rabin2-info.txt]

CIL bytecode at 0x2008 (CLR metadata RVA) shows normal WinForms event-handler patterns — property getters/setters, event add/remove, and UI redraw logic. No obfuscation, no control-flow flattening, no string encryption. ^[rabin2-info.txt:7]

Capa crashed with an assertion error because dnfile could not parse the CLR metadata header (invalid signature at 0xED10 — expected 0x424A5342, got 0x1030). ^[capa.txt:1-8] This is likely a Debug-build artifact or minor PE corruption, not deliberate anti-analysis.

Floss invocation failed due to a command-line argument error (the --no flag was passed the sample path). ^[floss.txt:1-6] No decoded strings were recovered.

C2 Infrastructure

None observed. No network APIs, no hardcoded URLs, no DNS resolution, no socket creation. Static-only analysis; CAPE skipped due to no Windows guest available. ^[dynamic-analysis.md:1-3]

Interesting Tidbits

• PDB path: tCsX.pdb — suggests the original project name was tCsX (possibly short for "tools" or a student/coursework abbreviation) ^[strings.txt:1910]
• Random filename: xrxMWJpak7E4F5Z.exe has no semantic content — unlike the banking/invoice lures typical of social-engineering droppers. This suggests automated upload, bundled packaging, or a test submission rather than deliberate masquerade.
• CLR metadata parse failure: The 0xED10 RVA points into .text data, not a valid metadata header. pefile also flagged AddressOfEntryPoint (0xCD8C6) as outside the file and reported corrupt import/resource/debug directories. ^[pefile.txt:1-24] These are typical for CIL assemblies where the PE header is a bootstrap stub and the real entry point is managed by the CLR.
• No VS_VERSIONINFO: Unlike most unclassified-dotnet siblings, this sample has no visible version-info resource masquerade. The absence of social-engineering metadata supports the "benign false-positive" assessment.
• .rsrc and .reloc are effectively empty: Entropy 0.000000, MD5 d41d8cd98f00b204e9800998ecf8427e (null). ^[pefile.txt:136-140] ^[pefile.txt:155-159] The PNG and Zlib data live in .text overlay, not in the PE resource directory.

How To Mess With It (Homelab Replication)

This is a legitimate UI pattern — building a node-graph editor in C# WinForms is a common coursework or indie-game dev exercise.

• Toolchain: Visual Studio 2019+ with .NET Framework 4.0 targeting x86
• Libraries: System.Windows.Forms, System.Drawing, System.Drawing.Drawing2D
• Pattern: Custom UserControl canvas → MouseDown/MouseMove/MouseUp drag handling → Graphics drawing in OnPaint → Node/Connection model classes with INotifyPropertyChanged
• Verification: Compile a simple node-graph demo, run file and strings — you will see the same namespace patterns (Graph.NodeItem, NodeConnection, GraphControl, add_NodeAdded, etc.)
• What you'll learn: How .NET WinForms custom controls work, and how easily benign developer tools get swept into malware corpora when filenames are random.

Deployable Signatures

YARA Rule

rule dotnet_nodegraph_editor_benign
{
    meta:
        description = "Benign .NET WinForms node-graph editor — high false-positive risk if used as malware detection"
        author = "Titus"
        date = "2026-06-30"
        sha256 = "8d4d4300ccd2a35176ae855d35ad12cf1b4962b3c5ae0464c7bdd03ddd96b7a5"
        confidence = "low"
    strings:
        $ns1 = "Graph.NodeItem" ascii wide
        $ns2 = "Graph.NodeConnection" ascii wide
        $ns3 = "Graph.GraphControl" ascii wide
        $ns4 = "GraphNodes.ExampleForm" ascii wide
        $ns5 = "Graph.SelectionForm" ascii wide
        $ns6 = "Graph.TextEditForm" ascii wide
        $ns7 = "NodeInputConnector" ascii wide
        $ns8 = "NodeOutputConnector" ascii wide
        $ns9 = "ICompatibilityStrategy" ascii wide
        $ns10 = "OnConnectionAdded" ascii wide
        $ns11 = "OnConnectionRemoved" ascii wide
        $ns12 = "add_NodeAdded" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        6 of them
}

Note: This rule is provided for cluster-tracking purposes only. It will fire on benign node-graph editors and game-dev tools. Do NOT deploy as a blocking signature.

Sigma Rule

Not applicable — no runtime malicious behavior observed.

IOC List

Behavioral Fingerprint

A 774 KB .NET Framework 4.0 x86 PE with no packing, no network APIs, no persistence, and no anti-analysis. On launch it presents a WinForms window with a draggable node-graph canvas (nodes with input/output connectors, connection lines, selection dialogs, and grid background). No outbound network connections, no registry modifications, no file writes beyond normal .NET JIT temp files. The application is functionally a visual node editor, not malware.

Detection Signatures

Capa's failure is a tooling limitation, not an anti-analysis measure. The PE header is structured as a standard CIL bootstrap stub where the entry point RVA lies outside the file (the CLR loads metadata from the .text overlay).

References

• unclassified-dotnet — Umbrella entity for unattributed .NET Framework PE32/PE32+ binaries
• MalwareBazaar artifact: 8d4d4300ccd2a35176ae855d35ad12cf1b4962b3c5ae0464c7bdd03ddd96b7a5

Provenance

• file.txt — file(1) output
• pefile.txt — pefile parser (corrupt-header warnings are normal for CIL bootstrap stubs)
• exiftool.json — ExifTool PE metadata
• rabin2-info.txt — radare2 binary info (lang=cil, subsys=dotnet, signed=false)
• strings.txt — strings(1) output (1948 lines, unobfuscated CIL type/method names)
• capa.txt — Mandiant capa v7+ (dnfile parse failure)
• floss.txt — FireEye flare-floss (invocation error)
• binwalk.txt — Binwalk embedded-artifact scan (PNG + Zlib + XML manifest)
• yara.txt — YARA scan (PE_File_Generic only)
• radare2 analysis: r2 -A -a x86 /tmp/...bin, aa level 2, 95 functions identified