Deep Analysis — 99e5d5d8e7e04fa65d12f184c7dc0c5ceb012125e00d99eb5c10fad33f3c87ff

Verdict: Benign .NET Windows Forms inventory-management application (false-positive MalwareBazaar ingestion). No malicious capabilities identified.

1. Build / RE

Toolchain & Framework

• .NET Framework PE32 compiled to CIL (PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections) ^[file.txt].
• CLR header v2.5, metadata version v4.0.30319 (Visual Studio 2019 / .NET Framework 4.8 compatible) ^[rabin2-info.txt].
• PDB debug file KdOzB.pdb (arbitrary developer string, not a known malware marker) ^[rabin2-info.txt:13].
• Compiled timestamp Mon Jun 22 08:46:39 2065 — future-dated, common in VMs or systems with incorrect clocks; not an anomaly given the otherwise standard build layout.

Namespace & Architecture

• Namespace ABMProductos (Spanish: Alta-Baja-Modificación de Productos = Product CRUD) ^[extract_clr.py].
• 26 TypeDefs including: AccesoBd, Agregar, AgregarCategoria, frmAgregarMarca, Articulo, ArticuloGestion, Categoria, Detalle, Home, Imagen, ImagenGestion, ListadoCategorias, Listar, frmListarMarca, Marca, MarcaGestion, Modificar, Validaciones ^[extract_clr.py].
• 176 MethodDefs with standard WinForms event handlers (Form1_Load, btnGuardar_Click, txtBuscar_TextChanged, Dispose, InitializeComponent) ^[extract_clr.py].

Obfuscation

• No packer. No UPX, ConfuserEx, SmartAssembly, or native-AOT indicators. Standard 3-section PE (.text, .rsrc, .reloc).
• No anti-analysis. Greps for debug, sandbox, VM, processhacker, wireshark, x64dbg returned zero hits ^[strings.txt].
• Custom string encoding: Method CustomDecode (RVA 0x407268) implements a character-pair lookup decoder. CIL analysis shows it takes an input string, iterates in pairs, calls IndexOf on a lookup table, shifts the first index left by 4, and ORs with the second index to produce a byte array ^[r2:0x00407268]. This is a trivial custom obfuscation, not a commercial protector.
• Encoded block: A large encoded text block beginning with ENFKJ::D:::AE:::PPPP::LI:::::::E... is embedded in the .text section at file offset 0xaa813 ^[strings.txt:1657]. The CustomDecode / Trif32 methods (RVA 0x4072cc) are responsible for decoding this block at runtime. Trif32 constructs a 3-element byte array from arguments ^[r2:0x004072cc].
• Resource loading: get_ipVwR (RVA 0x40ae5c) retrieves a resource named "O" from Properties.Resources via GetObject and casts it to System.String ^[r2:0x0040ae5c].

Embedded Resources

• Standard .NET manifest resource section (.rsrc at file offset 0xc1e00) containing VS_VERSIONINFO with OriginalFilename: KdOzB.exe ^[terminal:rsrc-dump].
• No encrypted payload blobs, no bitmap steganography, no large unexplained binaries.
• binwalk identified 10 small PNG icons (256×256, 8-bit gray+alpha) at offsets ~0x1072B–0x18861, consistent with WinForms toolbar or menu image lists ^[binwalk.txt].

2. Deploy / ATT&CK

Static-only inference. CAPE skipped this sample because no Windows guest was available ^[dynamic-analysis.md]. All TTP claims below are inferred from static evidence only.

Capability Assessment

Network & C2

• No network IoCs. No URLs, IPs, domains, Telegram bots, Discord webhooks, SMTP servers, or raw socket APIs found in strings or decompiled CIL.
• WebRequestMethods appears in strings ^[strings.txt:372] but is part of the standard .NET BCL namespace and is not called in any network-capable method body.
• The get_ipVwR name might suggest IP retrieval, but its implementation loads a local resource string "O" and returns it ^[r2:0x0040ae5c]. No HTTP request is made.

Persistence

• None. No registry writes, no scheduled tasks, no Startup folder copies, no service creation.

Data Access / Collection

• SQL Server connectivity via System.Data.SqlClient (SqlConnection, SqlCommand, ExecuteReader, ExecuteNonQuery) ^[strings.txt:65,261–263,338,401,473].
• Methods: setQuery, ejecutarLectura, ejecutarAccion, setParametro, cerrarConexion ^[extract_clr.py].
• This is standard ADO.NET CRUD boilerplate for a local or LAN SQL Server backend.

Anti-Analysis

• None. No debug checks, no VM detection, no process enumeration, no timing loops.

Attribution

• Spanish-language UI (ABMProductos, Agregar, Detalle, Listar, Marca, Categoria, btnGuardar, txtBuscar, ValidarCodigo, validarCargaImagen) ^[extract_clr.py].
• No linguistic overlap with known threat-actor clusters. No code-reuse signatures. PDB name KdOzB is not a known malware marker.
• YARA match: generic PE_File_Generic only ^[yara.txt].

3. Summary

This sample is a benign .NET Framework 4.x Windows Forms inventory-management application written in Spanish. It provides CRUD operations for products, brands, and categories backed by a SQL Server database. The CustomDecode / Trif32 routines are a developer-implemented character-pair string decoder used to store a configuration block or UI text in a mildly obfuscated form — not adversary-grade protection. The KdOzB naming throughout (PDB, OriginalFilename) is an arbitrary developer choice and carries no threat-intelligence weight.

capa's ATT&CK mappings (T1027, T1620, T1213) are false positives arising from generic .NET runtime patterns: any .NET app that loads its own resources and uses SQL will trigger these rules.

Recommendation: Close as benign / false-positive MalwareBazaar ingestion. No IOCs, no TTPs of value, no further analysis required.