92de8242 — GoldenCity .NET WinForms game masquerading as purchase-order PDF

Build / RE

• Binary type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, 3 sections ^[file.txt] ^[dynamic-analysis.md]
• Runtime: .NET Framework v4.0.30319 ^[pefile.txt]
• Compiler / toolchain: Microsoft C# compiler (Roslyn/csc), standard WinForms designer-generated code. CLR metadata header GoldenCity namespace with game-themed classes: Form1, Models.Bandits, Models.Building, Models.GameSetting, Models.Maps ^[strings.txt:1228-1240] ^[rabin2-info.txt]
• Packing / obfuscation: None. No packer, no obfuscator, no native stub. Three standard PE sections (.text, .rsrc, .reloc) ^[pefile.txt]
• Anti-analysis: None. No debugger checks, no VM detection, no sandbox evasion, no anti-disassembly ^[capa.txt]
• Signing: Unsigned. rabin2 signed: true is a false positive from the Authenticode certificate directory entry (empty/zero-length) ^[rabin2-info.txt]
• Embedded resources: Standard .NET .rsrc section with UAC manifest, PNG game assets, and Zlib-compressed .resources blob. No encrypted overlay or steganography ^[binwalk.txt]
• Version-info masquerade: VS_VERSIONINFO fields cloned from Adobe Reader: FileDescription: Adobe Reader, CompanyName: Microsoft Corporation., ProductName: Microsoft PDF Document, OriginalFilename: AcroRd32.exe ^[exiftool.json] ^[strings.txt:1255-1270]
• Notable functions: GoldenCity.Program.Main at 0x004031ec is the CLR entry point ^[r2:entry0]. get_Oqtf and get_yt6 are standard WinForms Properties.Resources accessors; decompilation shows only x86 garbage from CIL-to-native disassembly mismatch ^[ghidra:get_Oqtf-00403288]. Form1.Trif32 is a game UI event handler, not encryption logic ^[ghidra:Trif32-004031b4]

Deploy / ATT&CK

• T1036.005 (Masquerade File or Task) — Distribution filename PO-000002168.pdf.exe (double-extension masquerade) and Adobe Reader VS_VERSIONINFO masquerade ^[triage.json] ^[exiftool.json]
• T1204.001 (User Execution: Malicious Link) — Social-engineering lure: purchase-order PDF themed filename designed to induce execution ^[triage.json]
• Persistence: None observed. No registry writes, no scheduled tasks, no startup-folder copies ^[strings.txt]
• C2 / network: None observed. No System.Net, WebClient, HttpWebRequest, Socket, Mail, or Process.Start references in imports or strings ^[imports] ^[strings.txt:1201-1600]
• Lateral movement: None observed
• Payload / malicious logic: None found. The GoldenCity namespace contains a benign WinForms city-building game with Spanish UI strings (Ciudad, Edificios, Bandidos) ^[strings.txt:1228-1235]

Attribution / Context

This sample is a confirmed sibling of 61c1041120dd (PrimeraVentana / GqA.exe, distributed as University__of_Bahrain-_Project_FMD20240342.exe) in the unclassified-dotnet social-engineering masquerade cluster. Both samples share identical VS_VERSIONINFO masquerade (Adobe Reader / Microsoft PDF Document / AcroRd32.exe) and identical benign .NET WinForms educational-app internals ^[exiftool.json:61c10411]. The threat is purely the social-engineering-filename-lure + version-info-masquerade; the payload is benign.

Assessment

Benign .NET WinForms game masquerading as a purchase-order PDF. No malicious behavior observed statically. No CAPE dynamic analysis available (no Windows guest). Capa T1620 (reflective code loading) and C0021.003 (encryption/decryption) are false positives from standard .NET JIT metadata and WinForms resource accessors. The sample belongs in the unclassified-dotnet umbrella as another instance of student-project hijacking for social-engineering distribution.