unclassified-dotnet: b4814a17 — VD_Pacman + CalculatorWinForms, stolen Tatham cert

Executive Summary

A 751 KB .NET Framework 4.0 PE32 GUI assembly (INQUIRY.exe) signed with the stolen Simon Tatham (PuTTY developer) COMODO RSA Code Signing CA certificate. The binary masquerades as a Microsoft Windows system utility (lodctr, Microsoft Corporation, v99.99.99.99) but contains two unrelated benign student projects — a Pacman game (VD_Pacman namespace) and a WinForms calculator (CalculatorWinForms namespace) — merged into a single executable. No malicious payload, no network APIs, no persistence. This is the fifth confirmed sibling in the stolen-Tatham-cert .NET masquerade cluster. Static-only analysis; CAPE skipped due to no Windows guest.

What It Is

How It Works

Build Stack

Standard .NET Framework 4.0 CIL compilation with no packing, no obfuscation, and no anti-analysis. The assembly contains 8 TypeDefs, 65 MethodDefs, 84 TypeRefs, and 115 MemberRefs across 5 streams in the #~ metadata table. Heap sizes byte = 0x00, meaning all string/blob/guid indices are 16-bit — a small, simple assembly. ^[rabin2-info.txt:1-35]

Masquerade

VS_VERSIONINFO resource claims ^[pefile.txt:233-243] ^[exiftool.json]:

• FileDescription: lodctr (Windows Performance Monitor counter loader)
• CompanyName: Microsoft Corporation
• ProductName: Microsoft Windows Operating System
• FileVersion: 99.99.99.99
• InternalName / OriginalFilename: ieDD.exe

The distribution filename INQUIRY.exe uses a business-inquiry social-engineering lure. The internal name ieDD.exe and PDB ieDD.pdb suggest the developer's working title was "ieDD" — possibly a mashup of IE (Internet Explorer) and DD (developer initials) or simply a random string.

Dual-Namespace Payload

The binary contains two distinct .NET namespaces with no interaction between them:

Namespace 1: VD_Pacman ^[strings.txt:37-66] ^[strings.txt:163-180]

• Form1 — main game form with FlowLayoutPanel1, pictureBox1, timer tick handler
• Pacman — game entity class with posX, posY, speed, direction, foodImage, isMouthOpen properties
• DIRECTION — enum for movement directions
• Program — entry point (Main at RVA 0x2850)
• Properties.Resources — embedded PNG food images (get_food1, get_food2, get_CgkI)
• Properties.Settings — default application settings

Namespace 2: CalculatorWinForms ^[strings.txt:222-223] ^[strings.txt:239-248]

• Form1 — calculator UI with 20 buttons (button1 through button20), two labels, text box
• CheckNumberBehindComa — decimal-point validation
• flowRightToLeftBtn_CheckedChanged — layout toggle
• button1_Click through button20_Click — digit/operator handlers
• InitializeComponent — WinForms designer-generated setup

The CalculatorWinForms namespace was likely a separate student project that got merged into the same solution as the Pacman game, or the developer copy-pasted both projects into one assembly for portfolio purposes.

Certificate

Binwalk extracted the PKCS#7 signature block from .rsrc and identified the full certificate chain ^[binwalk.txt:17-26]:

• Root: COMODO RSA Certification Authority
• Intermediate: COMODO RSA Code Signing CA
• Leaf: CN = Simon Tatham, O = Simon Tatham, L = Cambridge, ST = Cambridgeshire, C = GB

This is the same stolen certificate observed on siblings eea0dcbc, c4ee3a31081d, cae7ac1dc419, and a1e6dc7a. The certificate's private key was compromised at some point and is being reused across multiple unrelated benign .NET applications to lend them false legitimacy.

Decompiled Behavior

Radare2 CIL analysis found 100 functions. No native code — all CIL. The entry point (entry0 at 0x402850) is VD_Pacman.Program.Main, which calls Application.EnableVisualStyles, Application.SetCompatibleTextRenderingDefault(false), and Application.Run(new Form1()). ^[rabin2-info.txt:1-35] ^[r2:entry0]

Sample button click handlers from CalculatorWinForms.Form1:

• button3_Click (0x402ed8): reads textBox1 text, concatenates with "utton16", calls InitializeComponent — likely a digit-entry handler that rebuilds the display string. ^[r2:method.CalculatorWinForms.Form1.button3_Click]
• button1_Click (0x405a68): checks if textBox1 text equals 0x30 ('0'), negates the value, converts to string, calls InitializeComponent. ^[r2:method.CalculatorWinForms.Form1.button1_Click]

These are standard WinForms event handlers with no suspicious API calls. The InitializeComponent calls after each button press are unusual — typically called once at form load — suggesting the developer may have wired button clicks to re-initialize the UI dynamically, or this is a quirk of the designer-generated code.

C2 Infrastructure

None. No network APIs, no hardcoded URLs, no DNS resolution, no socket creation. The binary is entirely offline.

Interesting Tidbits

• Fifth stolen-Tatham sibling: joins eea0dcbc (WpfUI attendance tracker), c4ee3a31081d (PrimeraVentana Spanish edu), cae7ac1dc419 (PrimeraVentana Spanish edu), and a1e6dc7a (paint/drawing program). ^[/intel/analyses/eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a.html] ^[/intel/analyses/c4ee3a31081db5feff937ed7a716fd805b467dacc6c1d679c4508e5b51ba8895.html] ^[/intel/analyses/cae7ac1dc4191db8041bca77127910f900f9effbe1b9e87492ba49549de14676.html] ^[/intel/analyses/a1e6dc7a3172ae52663e446cb8286a8aeec8c92fe75eb97f290df80f2e1ac398.html]
• Capa false positives: T1620 (Reflective Code Loading) from standard .NET assembly JIT loading; MBC B0013.001 from DebuggerBrowsableState and DebuggerNonUserCodeAttribute in Debug build. ^[capa.txt]
• No FLOSS output: flare-floss failed with argument-parsing error (--no flag collision with sample path). ^[floss.txt]
• Dual-purpose resource names: .rsrc contains both VD_Pacman.Form1.resources and CalculatorWinForms.Form1.resources, confirming both namespaces have designer-generated resource files. ^[strings.txt:209-211]
• PNG images embedded: Binwalk found multiple 248×248 and 520×520 PNG images in .rsrc — game sprites and calculator UI elements. ^[binwalk.txt:6-15]

How To Mess With It (Homelab Replication)

This is a benign app, but the masquerade technique is worth replicating for awareness:

1. Build a simple WinForms app in Visual Studio 2019+ (C#, .NET Framework 4.0).
2. Merge two unrelated projects into one solution.
3. Edit AssemblyInfo.cs to set:
   • AssemblyTitle("lodctr")
   • AssemblyCompany("Microsoft Corporation")
   • AssemblyProduct("Microsoft Windows Operating System")
   • AssemblyFileVersion("99.99.99.99")
4. Build in Release mode; observe the resulting PE has matching version-info fingerprints.
5. Sign with a test certificate and verify with osslsigncode verify.

What you'll learn: how trivial it is to make a benign app look like a Microsoft system binary, and why version-info alone is worthless for triage.

Deployable Signatures

YARA

rule StolenTatham_Cert_DotNet_Masquerade {
    meta:
        description = "Detects .NET PE signed with stolen Simon Tatham COMODO cert and Microsoft-themed version masquerade"
        author = "PacketPursuit"
        date = "2026-06-29"
        hash = "b4814a1725a288805097151348d07a8322d14ced20eb5137fbf368d245fe6c68"
    strings:
        $a = "COMODO RSA Code Signing CA" ascii
        $b = "Simon Tatham" ascii
        $c = "Microsoft Corporation" wide
        $d = "lodctr" wide
        $e = "99.99.99.99" wide
        $f = ".NETFramework,Version=v4.0" ascii
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C) + 0x88) == 0x2008 and
        $a and $b and
        2 of ($c, $d, $e) and
        $f
}

Sigma

title: Stolen Simon Tatham Cert .NET Masquerade
logsource:
    product: windows
    category: image_load
detection:
    selection:
        ImageLoaded|endswith: '.exe'
        SignatureStatus: 'Valid'
        SignerName|contains: 'Simon Tatham'
        ImageLoaded|contains:
            - 'Microsoft'
            - 'lodctr'
            - 'Windows'
    condition: selection
falsepositives:
    - None expected; legitimate PuTTY tools are not distributed as .NET PEs with Microsoft-themed version info
level: high

IOC List

Behavioral Fingerprint

This binary is a .NET Framework 4.0 PE32 GUI assembly with a single mscoree.dll import, no network APIs, no persistence mechanisms, and no process injection. It loads two unrelated WinForms namespaces (VD_Pacman and CalculatorWinForms) from embedded resources. The Authenticode signature chain includes a COMODO RSA Code Signing CA leaf certificate issued to Simon Tatham. Version-info resources masquerade as a Microsoft Windows system utility (lodctr). Capa flags T1620 and MBC B0013.001 are false positives from standard .NET JIT loading and Debug-build compiler attributes.

Detection Signatures

No true malicious ATT&CK techniques observed.

References

• unclassified-dotnet — umbrella entity for unattributed .NET Framework PEs
• stolen-certificate-signing — cross-family pattern
• version-info-masquerade — cross-family pattern
• social-engineering-filename-lure — cross-family pattern
• Sibling analyses: eea0dcbc, c4ee3a31081d, cae7ac1dc419, a1e6dc7a
• MalwareBazaar: https://bazaar.abuse.ch/sample/b4814a1725a288805097151348d07a8322d14ced20eb5137fbf368d245fe6c68/

Provenance

• file.txt — file(1) output
• pefile.txt — pefile.py dump
• strings.txt — strings(1) output
• capa.txt — Mandiant capa v7.0.0
• binwalk.txt — binwalk v2.3.4
• rabin2-info.txt — radare2 v5.9.8
• exiftool.json — ExifTool v12.76
• dynamic-analysis.md — CAPE sandbox (skipped, no Windows guest)
• Custom Python scripts for .NET metadata table parsing (CLI header, #~, #Strings, #US, MethodDef, TypeDef, AssemblyRef)