unclassified-dotnet: b094a2b6 — Indonesian payment-slip lure wrapping Brazilian WinForms C# coursework

Executive Summary

A .NET Framework v4.0.30319 PE32 WinForms assembly (Slip_Pembayaran.exe) distributed under an Indonesian banking-themed filename (slip pembayaran = payment slip). Static analysis reveals no malicious payload, no persistence, no C2, and no credential-theft APIs. The binary is a Brazilian Portuguese C# learning exercise (calculator, postal-code lookup, password form, JSON file database) compiled with Visual Studio and repackaged for social-engineering delivery. Capa ATT&CK T1620 and MBC C2-Communication hits are false positives arising from benign HttpWebRequest calls to the public Brazilian postal-code API viacep.com.br.

What It Is

The file is a standard .NET Framework CIL assembly with a three-section PE wrapper (.text, .rsrc, .reloc). The .text section entropy is 7.95 — high but expected for a compressed CIL image with embedded WinForms resources. No packer, no obfuscator, and no ConfuserEx/SmartAssembly/Xenocode signatures are present. The binary is not Native AOT (it carries full CLR metadata streams #~, #Strings, #US, #GUID, #Blob).

How It Works

Build / RE

The assembly was built from a Visual Studio WinForms project named TestesWindowsForms (Portuguese for "Windows Forms Tests"). The namespace structure is that of a typical C# programming-course assignment:

• TestesWindowsForms.Calculator — four-operation calculator with MouseEventArgs and KeyEventArgs handlers.
• TestesWindowsForms.Cadastro — registration form with Nome, CPF, Data, Email fields and masked input.
• TestesWindowsForms.FrmConsultaCep — Brazilian postal-code lookup via HttpWebRequest to https://viacep.com.br/ws/<CEP>/json/.
• TestesWindowsForms.Frm_Menu_Principal — MDI parent menu (Arquivos, Senha, Calculadora, Cadastro, Consulta CEP).
• TestesWindowsForms.Frm_Senha — password visibility toggle (Cbx_VerSenha).
• CursoWindowsFormsBiblioteca.Database.Connection — local JSON file I/O wrapper (ReadAllText, WriteAllText, CreateDirectory, GetFiles).
• WindowsFormsLibrary.AboutBox1 — standard Visual Studio About dialog template.
• FormsLibrary.Person / FormsLibrary.Utils / FormsLibrary.Properties.Resources — helper classes for data binding and resource management. ^[strings.txt:1646] ^[strings.txt:1745] ^[strings.txt:1802] ^[strings.txt:1984] ^[strings.txt:2004] ^[strings.txt:2051] ^[strings.txt:2075] ^[strings.txt:2186]

The developer's local path leaks in UTF-16LE: C:\Users\DanielRodriguesCarva\Documents\TesteDataBase. This is consistent with a Brazilian developer's machine (Daniel Rodrigues Carvalho — a common Portuguese name). The project uses ByteBank as the conceptual brand for the database demo. ^[strings.txt via strings -el]

Deploy / ATT&CK

No malicious deploy behavior was observed. The binary's runtime surface is limited to:

• T1083 — File and Directory Discovery (benign: Directory.GetFiles, File.Exists for local JSON database). ^[capa.txt]
• T1620 — Reflective Code Loading (false positive: standard .NET JIT and AssemblyResolve for resource-manager initialisation). ^[capa.txt]
• MBC C2 Communication / HTTP Create Request / Get Response / Send Request (false positive: single HttpWebRequest to public viacep.com.br API). ^[capa.txt]

There is no evidence of:

• persistence mechanisms,
• process injection or hollowing,
• AMSI bypass,
• credential harvesting,
• clipboard hijacking,
• wallet-address regex scanning,
• C2 beaconing,
• exfiltration,
• or anti-debug / anti-VM checks.

The threat is purely the social-engineering filename lure (Slip_Pembayaran.exe) paired with the VS_VERSIONINFO masquerade (Forms Library, RjOi.exe). ^[pefile.txt] ^[exiftool.json]

Decompiled Behavior

Radare2 analysis completed with 466 CIL functions identified, though radare2 emitted repeated No SN reg alias for 'cil' warnings indicating limited IL decompilation. ^[rabin2-info.txt] The class listing confirms the benign educational-app structure described above. ^[r2:classes] No methods referencing Assembly.Load(byte[]), Invoke, GetProcAddress, VirtualAlloc, CreateRemoteThread, NtWriteVirtualMemory, or RegSetValueEx were found in the metadata string table.

Ghidra was queued for import but .NET CIL analysis is best served by metadata inspection; the absence of native code obfuscation or P/Invoke means Ghidra pseudo-C adds little over string and metadata analysis.

C2 Infrastructure

None. The only network indicator is the legitimate Brazilian postal-code API:

• https://viacep.com.br/ws/ ^[strings.txt via strings -el]

This is a public, rate-limited REST API operated by ViaCEP (Brazilian postal service data). No attacker-controlled infrastructure is embedded.

Interesting Tidbits

• Cross-cultural mismatch: An Indonesian banking-themed filename (Slip_Pembayaran) wraps a Brazilian Portuguese C# coursework app (ByteBank, Consulta CEP, DanielRodriguesCarva). The actor either obtained a generic "coursework" binary from a Brazilian source and repackaged it for Indonesian targeting, or the victim corpus is global and the filename is auto-generated by a distributor. ^[strings.txt via strings -el] ^[triage.json]
• VS_VERSIONINFO fabrication: The version info claims FileDescription: Forms Library, InternalName: RjOi.exe, ProductName: Forms Library, Copyright © 2021. The build timestamp is Aug 2024, but the copyright is 2021 — a minor inconsistency typical of rapid repackaging. ^[exiftool.json] ^[pefile.txt]
• Empty CompanyName / LegalTrademarks: Both fields are blank in VS_VERSIONINFO, a common shortcut in repackaged binaries where the actor does not bother to fabricate a company. ^[exiftool.json]
• Standard .NET resource structure: The .rsrc section is only 0x600 bytes and contains only RT_VERSION and RT_MANIFEST — no encrypted payload blobs, no bitmap steganography, and no RT_RCDATA shellcode. ^[pefile.txt]
• No FLOSS decoded strings: FLOSS failed with a command-line argument error; even if it had run, the sample is unobfuscated CIL with no string encryption to decode. ^[floss.txt]

How To Mess With It (Homelab Replication)

This sample is a benign WinForms app; replication is trivial and safe.

1. Open Visual Studio 2022, create a Windows Forms App (.NET Framework) targeting .NET Framework 4.8.
2. Add forms: Calculator, Cadastro (registration), FrmConsultaCep (CEP lookup using HttpWebRequest to viacep.com.br), Frm_Senha (password toggle), Frm_Menu_Principal (MDI parent).
3. Add a Connection class under CursoWindowsFormsBiblioteca.Database that uses System.IO.File.WriteAllText / ReadAllText to persist objects as JSON in %USERPROFILE%\Documents\TesteDataBase.
4. Build in Release mode. The resulting PE will have a similar capa fingerprint (T1620 from JIT, T1083 from file I/O, MBC HTTP from the CEP API).
5. Rename the output to Slip_Pembayaran.exe and observe that VirusTotal or sandbox detonation yields the same false-positive ATT&CK mapping.

What you'll learn: How capa and sandbox scoring over-classify standard .NET WinForms behavior when the analyst does not inspect the API targets (public API vs. attacker C2).

Deployable Signatures

YARA rule

Because the binary is unobfuscated CIL, a surface YARA rule can match the exact class/namespace strings. This is fragile (recompilation changes the build) but useful for exact-file hunting.

rule BRAZILIAN_CSHARP_COURSEWARE_MASQUERADE {
    meta:
        description = "Brazilian C# WinForms coursework repackaged as payment-slip lure"
        author = "PacketPursuit"
        date = "2026-06-29"
        sha256 = "b094a2b61576904f86948cebe5b0d49198f0da3b6a851574f9fede93bef28285"
    strings:
        $ns1 = "TestesWindowsForms.Calculator" wide ascii
        $ns2 = "TestesWindowsForms.FrmConsultaCep" wide ascii
        $ns3 = "CursoWindowsFormsBiblioteca.Database.Connection" wide ascii
        $ns4 = "WindowsFormsLibrary.AboutBox1" wide ascii
        $cep  = "https://viacep.com.br/ws/" wide ascii
        $dev  = "DanielRodriguesCarva" wide ascii
        $bank = "ByteBank" wide ascii
    condition:
        uint16(0) == 0x5A4D and
        4 of them
}

Sigma rule

title: .NET WinForms Benign App With Banking Filename Masquerade
logsource:
    category: process_creation
    product: windows
detection:
    selection_pe:
        Image|endswith: '.exe'
        CommandLine|contains:
            - 'Slip_Pembayaran'
            - 'Slip_Pembayaran.exe'
    selection_dotnet:
        - Image|endswith: '.exe'
        - CommandLine|contains: '.exe'
    condition: selection_pe and selection_dotnet
falsepositives:
    - Legitimate Indonesian banking software named similarly
level: low

Note: This Sigma is intentionally low-confidence because the detection target is the filename lure, not runtime behavior. Elevate to medium/high only when paired with .NET JIT loading from an untrusted directory (Downloads, Temp, Public).

IOC list

Behavioral fingerprint

This binary is a standard .NET Framework 4.x WinForms GUI executable with only mscoree.dll in its import table. Upon launch it initialises an MDI parent menu (Frm_Menu_Principal) containing benign sub-forms (calculator, registration, postal-code lookup, password demo). It performs a single HTTPS GET to viacep.com.br only when the user triggers the CEP lookup form. No file drops outside the user's Documents folder, no registry writes, no network exfiltration, no process creation, and no cryptographic operations beyond what the .NET runtime uses for TLS. Any sandbox scoring it as malicious should be treated as a false positive unless additional second-stage payloads are observed at runtime.

Detection Signatures

References

• b094a2b61576904f86948cebe5b0d49198f0da3b6a851574f9fede93bef28285 — canonical analysis directory
• MalwareBazaar artifact ID 05bec389-4995-4dd3-ac87-ee81475f8316
• ViaCEP API documentation: https://viacep.com.br/ (legitimate public service)
• Related wiki: unclassified-dotnet (umbrella entity for benign .NET masquerade apps)
• Related wiki: social-engineering-filename-lure (concept page for themed-filename delivery)
• Related wiki: version-info-masquerade (concept page for fabricated VS_VERSIONINFO)

Provenance

Analysis derived from static artefacts only; CAPE detonation was skipped because no Windows guest is available. Tools: file (file-type), exiftool (metadata), pefile (PE structural analysis), radare2 v5.x (aa level 3, CIL analysis), strings (ASCII/UTF-16LE), capa v7.x (static capability detection), binwalk (embedded artefact scan). All claims are marked with ^[filename] or ^[filename:line] provenance markers.