unclassified-dotnet: ad301389 — Spanish RPG character generator masquerading as purchase order

Executive Summary

A .NET Framework 4.0 WinForms GUI application — a Spanish-language RPG character generator (ejemplo namespace) — distributed as PO82200287.exe with fabricated Microsoft Corporation version-info masquerade. No packing, no obfuscation, no network APIs, no persistence, and no payload beyond the WinForms surface. Threat is purely social-engineering masquerade. Static-only analysis (CAPE skipped: no Windows guest).

What It Is

Build / RE

Toolchain

• Runtime: .NET Framework 4.0 (CLR v4.0.30319) ^[exiftool.json:18] ^[pefile.txt:4]
• Architecture: PE32, x86, CIL ^[file.txt:1] ^[rabin2-info.txt:1,5,21]
• Linker: Microsoft linker v48.0 (Visual Studio / MSBuild) ^[exiftool.json:18]
• COM descriptor: RVA 0x2008, size 0x48 ^[pefile.txt:183-184]
• Entry point: Token 0x600004f (method in ejemplo.Program) ^[pefile.txt:50, exiftool.json:22]

Packing / Obfuscation

None. Plain PE32 with three standard sections (.text, .rsrc, .reloc). No packer, no obfuscator, no native API imports beyond mscoree.dll._CorExeMain ^[file.txt:1] ^[pefile.txt:255]. The .text section entropy is 7.68 — high because it contains the entire CIL bytecode and embedded resources, not because of encryption ^[pefile.txt:92].

Anti-Analysis

None. No debugger checks, no VM detection, no sandbox evasion, no time-bombs. Capa flags T1620 (Reflective Code Loading) and T1083 (File and Directory Discovery) — these are false positives from standard .NET JIT compilation and System.IO.Path/FileDialog usage in the WinForms designer-generated code ^[capa.txt:15-16].

Metadata Surface

TypeDefs (13): ^[parse_dotnet.py output]

• ejemplo.AboutBox1
• ejemplo.Elfo (Elf race)
• ejemplo.Form1
• ejemplo.FormPrincipal
• ejemplo.Humano (Human race)
• ejemplo.MDIParent1
• ejemplo.MDIParent2
• ejemplo.Personaje (Character)
• ejemplo.Program
• ejemplo.Vampiro (Vampire race)
• ejemplo.Properties.Resources
• ejemplo.Properties.Settings

TypeRefs (129): Pure WinForms / System.Drawing / System.IO surface. Notable references include:

• System.Windows.Forms.Form, .MenuStrip, .ToolStripMenuItem, .PictureBox, .Label, .TextBox, .Button, .ComboBox, .GroupBox, .RadioButton, .CheckBox, .NumericUpDown, .StatusStrip, .OpenFileDialog, .SaveFileDialog, .ToolTip ^[parse_typeref.py output]
• System.Drawing.Bitmap, .Image, .Icon, .Font, .Color, .Size, .Point ^[parse_typeref.py output]
• System.IO.Path ^[parse_typeref.py:65]
• System.Resources.ResourceManager ^[parse_typeref.py:56]
• System.Globalization.CultureInfo ^[parse_typeref.py:57]

No references to: System.Net.*, System.Security.Cryptography.*, System.Diagnostics.Process, System.Reflection.Assembly.Load, System.Runtime.InteropServices (beyond ComVisibleAttribute/GuidAttribute for COM interop decoration), System.Threading (beyond Synchronized).

Embedded Resources

• PNG images: 256×256 RGBA icon, 120×262 RGB icon, and ~40 small 16×16 toolbar icons ^[binwalk.txt:6-48]
• JPEG images: Three JFIF standard 1.01 images ^[binwalk.txt:51-53]
• XML manifest: Standard Windows UAC manifest ^[binwalk.txt:54]
• .resources files: ejemplo.Form1.resources, ejemplo.MDIParent1.resources, ejemplo.AboutBox1.resources, ejemplo.MDIParent2.resources, ejemplo.FormPrincipal.resources, ejemplo.Properties.Resources.resources ^[strings.txt:321-326]

Version Info Masquerade

Fabricated Microsoft Corporation metadata: ^[exiftool.json:37-44] ^[pefile.txt:235-243]

• CompanyName: Microsoft Corporation
• FileDescription: Thumbnail Handler
• InternalName: HFGe.exe
• OriginalFilename: HFGe.exe
• ProductName: Thumbnail Handler
• LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.

The internal name HFGe.exe and PDB HFGe.pdb match; HFGe may be a developer initials or project codename. The actual application is unrelated to thumbnails.

Deploy / ATT&CK

Static-only inference. CAPE detonation was skipped (no Windows guest) ^[dynamic-analysis.md:1-3].

Persistence: None observed. No registry references, no scheduled-task strings, no startup-folder paths.

C2 / exfiltration: None observed. No System.Net, WebClient, HttpWebRequest, Socket, Mail, or raw TCP/UDP references in TypeRefs or strings.

Lateral movement: None observed.

Attribution: No linguistic or infrastructure clues beyond the Spanish UI strings and ejemplo (Spanish "example") namespace. No hardcoded URLs, IPs, or wallet addresses. Low-confidence attribution: likely a repackaged Spanish educational / tutorial RPG game project.

Decompiled Behavior

The application is a classic WinForms MDI (Multiple Document Interface) RPG character generator with the following observed behavior:

1. Character creation form (Form1): Contains fields for name (Nombre), race (Raza — Elfo, Humano, Vampiro), origin (Origen), birth date (FechaNacimiento), magic type (Magia), magic enabled checkbox (ckbMagia), and territory count (Territorios) ^[strings.txt:36-60,94-99,181-189,230-249,275-284,344-349].

2. MDI parent windows (MDIParent1, MDIParent2): Standard WinForms MDI container with menu items for Cascade, Tile Vertical, Tile Horizontal, Arrange Icons, Close All ^[strings.txt:159-179,195-226].

3. Intermediate calculation methods: CalculateIntermediate2, CalculateIntermediate3, CalculateIntermediate4 — likely derive derived stats (HP, damage, etc.) from base character attributes ^[strings.txt:19-30].

4. Account/getter methods: get_account_1, get_account_2, get_account_3 — possibly auto-generated property accessors or game-account fields ^[strings.txt:6,18,24].

5. About box: Standard WinForms AboutBox with product name, version, copyright, company name labels ^[strings.txt:86-93,246-247,260-264,356-362].

6. File dialogs: OpenFileDialog and SaveFileDialog for saving/loading character files ^[strings.txt:151-156].

No encryption, no networking, no process injection, no registry manipulation.

C2 Infrastructure

None. No hardcoded IOCs. No network APIs. No C2 infrastructure observable statically.

Interesting Tidbits

• "Ejemplo" namespace: The namespace ejemplo means "example" in Spanish — typical of tutorial / educational programming exercises. Combined with the Spanish UI strings, this strongly suggests the binary is a repackaged student project or tutorial demo. ^[strings.txt:277,321-328]
• Race/class names in UI: Elfo (Elf), Humano (Human), Vampiro (Vampire), Magia (Magic), Raza (Race) — standard fantasy RPG terminology in Spanish. ^[strings.txt:39,42,275-279]
• Trif32 string: Found at strings.txt line 17. Possibly a project name, developer handle, or unrelated artifact. No other context.
• HPVd property: get_HPVd — possibly "Hit Points / Vida" (HP/Life in Spanish), another RPG stat. ^[strings.txt:45]
• No FLOSS output: floss invocation failed with argument parsing error (--no flag collision) ^[floss.txt:1-6] — pipeline issue, not sample behavior.
• Entry point: Standard _CorExeMain in mscoree.dll — the CLR bootstrap thunk, not a custom unpacker ^[pefile.txt:255].

How To Mess With It (Homelab Replication)

This is a benign WinForms application. To reproduce the build fingerprint:

1. Open Visual Studio, create a new C# Windows Forms App (.NET Framework 4.0).
2. Design an MDI parent form with MenuStrip, ToolStrip, StatusStrip.
3. Add a child form with TextBox, ComboBox, RadioButton, CheckBox, NumericUpDown, DateTimePicker for character attributes.
4. Set AssemblyInfo.cs to match the observed metadata (Company: Microsoft Corporation, Product: Thumbnail Handler, etc.).
5. Build in Release mode.
6. Rename output to PO82200287.exe.
7. Run capa — expect T1620/T1083 false positives from standard .NET JIT and IO paths.

What you'll learn: How trivial it is for threat actors to repackage benign .NET apps with themed filenames and fabricated version info to evade casual triage.

Deployable Signatures

YARA Rule

rule UnclassifiedDotNet_SpanishRPG_Masquerade
{
    meta:
        description = "Spanish RPG character generator .NET app with purchase-order masquerade"
        author = "PacketPursuit"
        date = "2026-06-28"
        hash = "ad301389152cb26900d3c06ea4f604dec119bf566b2f49dcdfdc21c658574420"
        confidence = "medium"
    strings:
        $ns1 = "ejemplo.Personaje" ascii wide
        $ns2 = "ejemplo.FormPrincipal" ascii wide
        $ns3 = "ejemplo.MDIParent1" ascii wide
        $ns4 = "ejemplo.Vampiro" ascii wide
        $ns5 = "ejemplo.Elfo" ascii wide
        $ns6 = "ejemplo.Humano" ascii wide
        $str1 = "btnGenerarPersonaje" ascii wide
        $str2 = "ckbMagia" ascii wide
        $str3 = "get_Magia" ascii wide
        $str4 = "get_Raza" ascii wide
        $str5 = "HFGe.exe" ascii wide
        $str6 = "Thumbnail Handler" ascii wide
        $str7 = "get_account_1" ascii wide
        $str8 = "CalculateIntermediate2" ascii wide
        $clr = { 48 00 00 00 02 00 05 00 }  // COR20 header signature
    condition:
        uint16(0) == 0x5A4D and
        $clr at (pe.data_directories[14].virtual_address - pe.sections[0].virtual_address + pe.sections[0].raw_address) and
        4 of ($ns*) and
        3 of ($str*)
}

Behavioral Hunt Query (KQL / Microsoft Defender)

DeviceFileEvents
| where FileName contains "PO" and FileName endswith ".exe"
| where FolderPath matches regex @"(?i)(purchase.?order|invoice|payment|shipping|hawb|quote)"
| join kind=inner (DeviceProcessEvents
    | where ProcessCommandLine contains "PO82200287"
    or (ProcessCommandLine contains "HFGe" and ProcessCommandLine contains "Thumbnail")
    ) on DeviceId, Timestamp
| where ProcessCommandLine !contains "devenv" and ProcessCommandLine !contains "msbuild"

IOC List

Behavioral Fingerprint

This binary is a .NET Framework 4.0 PE32 with 3 sections, no packing, and standard CLR metadata. It loads mscoree.dll._CorExeMain and JIT-compiles CIL from the .text section. It contains ~40 embedded PNG toolbar icons, 3 JPEG images, and 6 .resources files. At runtime, it displays a Spanish-language WinForms MDI application for generating RPG characters (Elf, Human, Vampire races). It does not make network connections, write to the registry, spawn child processes, or load additional assemblies dynamically. The version-info metadata claims "Microsoft Corporation / Thumbnail Handler" which is inconsistent with the actual application behavior.

Detection Signatures

• CAPA (static): Reflective Code Loading [T1620] — FALSE POSITIVE (standard CLR bootstrap)
• CAPA (static): File and Directory Discovery [T1083] — FALSE POSITIVE (System.IO.Path / FileDialog)
• CAPA (static): reference analysis tools strings — FALSE POSITIVE (standard DebuggerBrowsableState)
• YARA: PE_File_Generic — trivial match, not actionable ^[yara.txt:1]

References

• Artifact ID: 93c9f6f6-7b95-4243-8f81-c3cd63d559ad ^[metadata.json:2]
• Source: OpenCTI / MalwareBazaar (tag: exe, malware-bazaar) ^[triage.json:7-10]
• Related wiki pages:
  • unclassified-dotnet — umbrella entity for unattributed .NET binaries
  • version-info-masquerade — concept page for fabricated VS_VERSIONINFO abuse
  • social-engineering-filename-lure — concept page for themed filename distribution

Provenance

• file.txt — file(1) output, PE32 Mono/.Net assembly
• exiftool.json — ExifTool v12.76, VS_VERSIONINFO and PE metadata
• pefile.txt — pefile.py DOS/NT headers, sections, directories, version info, imports
• strings.txt — strings extraction (2165 lines), Spanish UI strings and .NET metadata
• rabin2-info.txt — radare2 binary summary, arch=cil, subsys=dotnet
• capa.txt — Mandiant capa v7, static analysis, dotnet format
• binwalk.txt — embedded file carving (PNG, JPEG, XML)
• triage.json — triage pipeline metadata
• metadata.json — artifact metadata from OpenCTI
• dynamic-analysis.md — CAPE skipped (no Windows guest)
• Custom Python scripts (parse_dotnet.py, parse_typeref.py, parse_cil.py) — manual .NET metadata parsing via pefile + struct

All capa ATT&CK flags are assessed as false positives for this sample. The binary exhibits no malicious runtime behavior beyond the social-engineering masquerade.