unclassified-dotnet: a1e6dc7a — Fourth stolen-Tatham-cert sibling, WinForms paint app masquerading as Adobe Reader

Executive Summary

A .NET Framework 4.0 PE32 GUI application compiled Aug 2024 and signed with the same stolen Simon Tatham (PuTTY) COMODO RSA Code Signing CA certificate observed in three prior siblings (eea0dcbc, c4ee3a31081d, cae7ac1dc419). The inner payload is a benign WinForms paint/drawing program; no malicious APIs, no C2, no persistence. Threat is purely social-engineering masquerade (Adobe Reader version-info + stolen Authenticode) to lower execution friction. Static-only analysis — CAPE skipped for lack of a Windows guest.

What It Is

Family ascription: Confirmed fourth sibling in the unclassified-dotnet stolen-Simon-Tatham-certificate cluster. Same certificate chain, same COMODO RSA Code Signing CA issuer, same benign-inner-payload pattern, different benign application (paint/drawing program vs. attendance tracker / Spanish educational apps in prior siblings).

How It Works

The binary is an unobfuscated .NET Framework 4.0 CIL assembly. The .text section is large (~812 KB, entropy 7.94) because it embeds multiple .NET resource blobs including System.Drawing.Bitmap objects (icons for the paint UI). ^[pefile.txt:80-96] ^[strings.txt:1100-1178]

There is no packing, no obfuscation, no anti-debug, no anti-VM, and no native API P/Invoke surface. The only imports are standard .NET Framework assemblies (mscorlib, System, System.Drawing, System.Windows.Forms, Microsoft.VisualBasic). ^[pefile.txt:255]

The threat model is:

1. Stolen certificate lends false legitimacy during SmartScreen / EDR triage.
2. VS_VERSIONINFO masquerade (Adobe Reader, Microsoft PDF Document) suggests a PDF utility to the victim.
3. Random-noise filename (62C0j88GAD91tR5.exe) differs from the themed lures (PAYMENT_CANCELLED_AND_RETURNED.PDF.exe, HAWB_#4532222.exe, TRANSACTION_ERROR.PDF.exe) used by prior siblings — possibly a different distribution channel or A/B testing.

On execution the program presents a WinForms paint/drawing interface (shape tools, color picker, brush/fill options, line width chooser, hatch styles). ^[strings.txt:1-500]

Decompiled Behavior

Ghidra imported successfully (/a1e6dc7a3172ae52663e446cb8286a8aeec8c92fe75eb97f290df80f2e1ac398.bin-38cb55, 205 functions, 0 instructions indexed at time of query). Code indexing was incomplete at query time; decompiled-pseudo-C analysis was therefore not obtainable. ^[ghidra:import]

Given the plain .NET CIL nature, dnSpy or ILSpy would provide full decompilation trivially. The entry point is the standard _CorExeMain via mscoree.dll. ^[pefile.txt:255] No custom entry-point obfuscation.

C2 Infrastructure

None. No hardcoded URLs, IP addresses, domain names, mutexes, named pipes, or registry keys. No networking APIs in the import surface. No C2 strings in the binary.

The only network-relevant strings are COMODO/USERTRUST certificate revocation URLs embedded in the Authenticode signature block: http://ocsp.comodoca.com, http://crl.comodoca.com, http://www.usertrust.com. ^[strings.txt:tail] These are standard CA infrastructure, not attacker C2.

Interesting Tidbits

• Same stolen certificate, fourth payload variant. Prior siblings carried: (1) a WPF attendance tracker (eea0dcbc), (2) a Spanish-language WinForms educational app (c4ee3a31081d), (3) another Spanish WinForms educational app (cae7ac1dc419). This sample carries a WinForms paint/drawing program — the cluster reuses the same certificate across unrelated benign payloads. ^[raw/analyses/eea0dcbc.../report.md] ^[raw/analyses/c4ee3a31081d.../report.md] ^[raw/analyses/cae7ac1dc419.../report.md]
• Random filename. Unlike the payment/shipping/transaction-themed filenames of siblings, this sample uses random alphanumeric noise. This may indicate a different distribution pipeline (spam attachment vs. drive-by download) or a test build.
• capa false positives. T1620 (reflective code loading) is triggered by standard .NET Assembly.Load / InvokeMember patterns used by the WinForms designer and event handlers. T1497.001 (analysis tool discovery) is triggered by DebuggerNonUserCodeAttribute and DebuggableAttribute in a Debug-configuration build. ^[capa.txt:15-16]
• No snakekeylogger co-label. Unlike prior siblings which were falsely co-labeled snakekeylogger by OpenCTI, this sample has no OpenCTI family label at all ("family": null).
• High-entropy .text is benign. The 7.94 entropy is from zlib-compressed PNG bitmap resources (Inkscape-authored icons, 256×256, 128×128, 48×48, etc.) embedded as System.Drawing.Bitmap objects. ^[binwalk.txt:6-32]

How To Mess With It (Homelab Replication)

This binary is trivial to replicate for certificate-masquerade research:

1. Build a benign .NET Framework 4.0 WinForms app in Visual Studio (any simple GUI — paint, calculator, etc.).
2. In AssemblyInfo.cs, set:

   [assembly: AssemblyTitle("Adobe Reader")]
   [assembly: AssemblyDescription("Microsoft PDF Document")]
   [assembly: AssemblyCompany("Adobe Reader")]
   [assembly: AssemblyProduct("Adobe Reader")]
   [assembly: AssemblyCopyright("Adobe Inc. All rights reserved")]
   [assembly: AssemblyFileVersion("2.0.0.781")]
   

3. Compile in Debug or Release (x86 preferred to match PE32).
4. Sign with any code-signing certificate (or self-signed for lab purposes).
5. Rename output to a random noise filename or a themed lure (*.PDF.exe).
6. Verify with sigcheck -a <file> and capa <file> — capa will likely flag T1620/T1497.001 from standard .NET metadata.

What you'll learn: How easily a benign .NET GUI app with falsified metadata and a stolen (or self-signed) certificate can bypass naive static triage, and why capa's .NET heuristics require analyst validation.

Deployable Signatures

YARA rule

rule StolenTathamCert_DotNet_Masquerade
{
    meta:
        description = "Detects .NET PE32 signed with stolen Simon Tatham (PuTTY) COMODO RSA cert"
        author = "PacketPursuit"
        reference = "raw/analyses/a1e6dc7a3172.../report.md"
        date = "2026-06-26"
        confidence = "high"

    strings:
        $tatham_cn = "CN = Simon Tatham" ascii wide
        $tatham_o  = "O = Simon Tatham" ascii wide
        $comodo_rsa_code = "COMODO RSA Code Signing CA" ascii wide
        $adobe_reader = "Adobe Reader" ascii wide
        $pdf_doc = "Microsoft PDF Document" ascii wide
        $dotnet_clr = "v4.0.30319" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        ($tatham_cn or $tatham_o) and
        $comodo_rsa_code and
        ($adobe_reader or $pdf_doc) and
        $dotnet_clr
}

Sigma rule

title: .NET PE32 with Stolen Simon Tatham Certificate Execution
status: experimental
description: Detects execution of .NET Framework binaries signed with the stolen Simon Tatham (PuTTY) COMODO RSA certificate, a recurring cluster in social-engineering campaigns.
author: PacketPursuit
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - ImageLoaded|contains:
            - 'gZUs.exe'
            - 'zOYY.exe'
            - 'InXv.exe'
            - 'WVmY.exe'
        - Hashes|contains:
            - 'SHA256=a1e6dc7a3172ae52663e446cb8286a8aeec8c92fe75eb97f290df80f2e1ac398'
            - 'SHA256=eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a'
            - 'SHA256=c4ee3a31081db5feff937ed7a716fd805b467dacc6c1d679c4508e5b51ba8895'
            - 'SHA256=cae7ac1dc4191db8041bca77127910f900f9effbe1b9e87492ba49549de14676'
    condition: selection
falsepositives:
    - None expected — the certificate is stolen and the inner payloads are benign repackaged apps, but legitimate PuTTY-signed binaries (if any still exist with this revoked cert) would trigger.
level: high

IOC list

Behavioral fingerprint statement

This binary is a .NET Framework 4.0 PE32 GUI executable with a falsified Adobe Reader VS_VERSIONINFO and a stolen Authenticode certificate (Simon Tatham / COMODO RSA Code Signing CA). On launch it initializes a standard WinForms paint/drawing interface with no network activity, no registry persistence, and no process injection. The threat is purely certificate-backed social engineering.

Detection Signatures

References

• Artifact ID: a3081634-18fa-4719-8de6-0bd83337dbd7
• Source: OpenCTI / MalwareBazaar
• Related wiki pages:
  • unclassified-dotnet — umbrella entity for stolen-Tatham-cert cluster
  • stolen-certificate-signing — concept page for certificate abuse
  • version-info-masquerade — falsified metadata technique
  • social-engineering-filename-lure — filename-based social engineering

Provenance

• file.txt — file(1) output
• exiftool.json — ExifTool 12.76 metadata extraction
• pefile.txt — pefile Python library PE header dump
• strings.txt — GNU strings + UTF-16LE extraction
• binwalk.txt — Binwalk v2.3.4 embedded file scan
• capa.txt — Mandiant capa v7.0.0 static capability detection
• rabin2-info.txt — radare2 rabin2 header summary
• Certificate chain extracted via openssl pkcs7 from DER blob at offset 0xC7A08 in the PE security directory
• Ghidra 12.1 import attempted; code indexing incomplete at time of query
• CAPE sandbox: skipped — no Windows guest available ^[dynamic-analysis.md]