unclassified-dotnet: a42443c8 — PrimeraVentana Spanish educational app repackaged as University-of-Bahrain project

Executive Summary

A .NET Framework 4.0 PE32 WinForms application built as a Spanish-language educational programming exercise (PrimeraVentana namespace), repackaged with the filename University__of_Bahrain-_Project_FMD20240342.exe. The binary is unobfuscated, contains no network APIs, no persistence mechanisms, and no malicious payload. Capa T1620 and T1497.001 flags are false positives from standard .NET Debug-build attributes. This is the fourth confirmed sibling in the PrimeraVentana Spanish-educational-app cluster within the unclassified-dotnet family.

What It Is

Build / RE

Toolchain

• Compiler: .NET Framework 4.0 C# compiler (csc.exe) with Visual Studio settings designer ^[strings.txt:320]
• Linker: MSVC linker v48.0 ^[pefile.txt:45]
• Build config: Debug build — DebuggableAttribute, DebuggerBrowsableAttribute, DebuggerNonUserCodeAttribute all present ^[strings.txt:89-98]
• Assembly: AssemblyVersion=1.0.0.0, AssemblyFileVersion=1.0.0.0 ^[strings.txt:313-314]

Version-Info Masquerade

The VS_VERSIONINFO block contains deliberate misattribution ^[pefile.txt:233-243]:

• CompanyName: "Microsoft Corporation."
• FileDescription: "LUA Client"
• ProductName: "LUA Client"
• OriginalFilename: "Djxu.exe"
• LegalCopyright: "Copyright © Microsoft Corporation. All rights reserved."

None of these match the actual application content (a Spanish WinForms educational app about products/tourism). The "LUA Client" description and "Microsoft Corporation" attribution are fabricated to lend false legitimacy.

Code Structure

The binary exposes a rich Spanish-language WinForms surface typical of an introductory C# programming exercise ^[strings.txt]:

• Namespace: PrimeraVentana (identical to siblings c4ee3a31 and cae7ac1d)
• Forms: frmClasePersona, VentanaPrincipal, frmPrincipal
• Classes: Botella (bottle), Producto (product)
• UI Controls: rbNacional, rbTurista, rbExtrangero (national/tourist/foreigner radio buttons), cbChocolate, txtNombre, txtNumero, txtTiempo
• Data model: Persona with AnioNacimiento, TipoDocumento, NumeroDocumento, CodigoClientes, TiempoEnElPais
• Bitmap resources: Embedded PNG icons (32×32, 523×523) and a PC bitmap (131×131×32) in .rsrc ^[binwalk.txt]

Anti-Analysis

None. No VM detection, no debugger checks, no sandbox gates, no obfuscation, no packing. Standard unobfuscated .NET assembly.

Notable Functions

Entry point is PrimeraVentana.Program.Main ^[r2:entry0]:

EnableVisualStyles()
SetCompatibleTextRenderingDefault(false)
Run(new VentanaPrincipal())

A standard WinForms bootstrap. No suspicious API calls, no network initialisation, no crypto setup.

Deploy / ATT&CK

No malicious TTPs observed. This is a benign application repackaged with a social-engineering filename.

Static-Only Inference (CAPE Skipped)

Dynamic analysis was skipped because no CAPE Windows guest is available ^[dynamic-analysis.md]. Static inference is sufficient given the complete lack of suspicious imports, network APIs, or obfuscation.

No Persistence

No registry keys, scheduled tasks, services, or startup folder references in strings or imports.

No C2

No System.Net, WinHTTP, WebClient, TcpClient, Socket, HttpWebRequest, or any other network API references. No hardcoded URLs, IPs, or domains.

No Payload

No embedded encrypted payloads (.rsrc entropy 3.45, well below encrypted-blob threshold). No AesManaged, TripleDES, CryptoStream, DeflateStream, or GZipStream references. No reflective loading beyond the standard .NET assembly bootstrap.

Capa False Positives

• T1620 Reflective Code Loading — triggered by standard .NET Assembly::Load and GetTypeFromHandle patterns used for WinForms resource initialisation ^[capa.txt]
• C0021.003 Generate Pseudo-random Sequence — triggered by System.Random usage likely for a number-guessing or lottery exercise in the educational app ^[capa.txt]
• B0013.001 Analysis Tool Discovery — triggered by DebuggerBrowsableState and DebuggableAttribute, which are compiler-generated in Debug builds ^[capa.txt]

Interesting Tidbits

• Fourth confirmed PrimeraVentana sibling: The namespace PrimeraVentana, class frmClasePersona, and the Spanish tourism/product inventory data model (Botella, Producto, rbNacional, rbTurista) are byte-identical to siblings c4ee3a31081d (InXv.exe) and cae7ac1dc419 (WVmY.exe). This appears to be the same educational coursework distributed under multiple filenames.
• Hardcoded "SHA256" literal: The string "SHA256" appears at offset 1366 ^[strings.txt:1366], but no 64-character hex hash follows it. Likely a UI label or a developer placeholder, not an integrity-check mechanism.
• "LUA Client" masquerade: The VS_VERSIONINFO claims the binary is a "LUA Client" by "Microsoft Corporation" — a bizarre combination that has nothing to do with the actual Spanish WinForms app.
• Future timestamp: The PE timestamp claims 2046, which is 20 years in the future. Fabricated or corrupted during repackaging.
• University lure theme: Unlike the payment/invoice/banking lures of prior siblings, this one uses an academic project theme (University__of_Bahrain-_Project_FMD20240342.exe), suggesting the distributor is targeting students or academic staff.

How To Mess With It (Homelab Replication)

This is a trivial .NET WinForms app. To replicate:

1. Open Visual Studio → New Project → Windows Forms App (.NET Framework 4.0)
2. Add forms: frmClasePersona, VentanaPrincipal, frmPrincipal
3. Add classes: Botella, Producto with properties (Nombre, CodigoArticulo, Precio, Material, CantidadVendida, etc.)
4. Add radio buttons: rbNacional, rbTurista, rbExtrangero
5. Build in Debug configuration
6. Run capa reproducer.exe — should hit the same false-positive T1620 and C0021.003

What you'll learn: How capa's static heuristics fire on benign .NET assemblies, and how to distinguish false positives from real TTPs by inspecting the actual API call sites.

Deployable Signatures

YARA Rule

rule UnclassifiedDotnet_PrimeraVentana_Spanish_Edu {
    meta:
        description = "Spanish-language PrimeraVentana WinForms educational app cluster"
        author = "Titus"
        date = "2026-06-27"
        hash = "a42443c84fc9ec4a4f00c4363eee5074e94cfbb286a48fcbd33496dbbf0f5455"
    strings:
        $ns1 = "PrimeraVentana" ascii wide
        $cls1 = "frmClasePersona" ascii wide
        $cls2 = "VentanaPrincipal" ascii wide
        $cls3 = "Botella" ascii wide
        $cls4 = "Producto" ascii wide
        $ui1 = "rbNacional" ascii wide
        $ui2 = "rbTurista" ascii wide
        $ui3 = "rbExtrangero" ascii wide
        $ui4 = "btnMostrarPersona" ascii wide
        $net = "mscorlib" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $net and
        4 of ($ns1, $cls1, $cls2, $cls3, $cls4) and
        2 of ($ui1, $ui2, $ui3, $ui4)
}

Sigma Rule

title: PrimeraVentana Spanish Educational App Execution
status: experimental
description: Detects execution of the PrimeraVentana Spanish WinForms educational app cluster, often repackaged with social-engineering filenames
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'University__of_Bahrain'
            - 'PrimeraVentana'
    condition: selection
falsepositives:
    - Legitimate execution of the original educational app
level: low

IOC List

Behavioral Fingerprint

This binary is a standard .NET Framework 4.0 WinForms PE32 with a single mscoree._CorExeMain import, no network APIs, no crypto APIs, and no persistence mechanisms. It boots into a Spanish-language WinForms GUI with classes named PrimeraVentana.VentanaPrincipal, Botella, and Producto. Execution is entirely local and benign; the threat is purely the social-engineering filename.

Detection Signatures

References

• unclassified-dotnet — Umbrella entity for unattributed .NET Framework binaries
• Sibling: c4ee3a31081d — PrimeraVentana / InXv.exe / HAWB_#4532222.exe (stolen Tatham cert) ^[/intel/analyses/c4ee3a31081db5feff937ed7a716fd805b467dacc6c1d679c4508e5b51ba8895.html]
• Sibling: cae7ac1dc419 — PrimeraVentana / WVmY.exe / TRANSACTION_ERROR.PDF.exe (stolen Tatham cert) ^[/intel/analyses/cae7ac1dc4191db8041bca77127910f900f9effbe1b9e87492ba49549de14676.html]
• Sibling: e7aaacbb — Vietnamese educational crypto lab / DHL_Shipping_Documents_&_BL.exe ^[/intel/analyses/e7aaacbb08fd0702c552169ce55065e51e1cfb55404509851592c3019fb15927.html]

Provenance

• file.txt — file(1) output
• pefile.txt — pefile.py dump
• exiftool.json — ExifTool metadata
• strings.txt — strings(1) output
• capa.txt — Mandiant capa v7 static analysis
• floss.txt — FireEye floss (failed due to incorrect CLI flags)
• binwalk.txt — binwalk embedded artifact scan
• rabin2-info.txt — radare2 binary header
• dynamic-analysis.md — CAPE sandbox status (skipped)
• r2:entry0 — radare2 decompiled entry point
• Tool versions: file 5.44, pefile 2024.8.26, ExifTool 12.76, capa 7.0.0, binwalk 2.3.4, radare2 5.9.9