unclassified-dotnet: b760c6f2 — .NET WinForms file manager masquerading as purchase-order lure

Executive Summary

A .NET Framework 4.0 WinForms dual-pane file manager (FManagerApp) compiled Sep 2024 and distributed as PO-000001488.exe (purchase-order social-engineering lure). No malicious payload, no network APIs, no persistence, no anti-analysis. The threat is purely the masquerade — a benign utility wrapped in a business-document filename to lower suspicion. Static-only analysis (CAPE skipped; no Windows guest).

What It Is

The binary is a .NET Framework PE32 compiled with the IL linker (.NET Native toolchain), not JIT. It has only one import (mscoree.dll._CorExeMain) ^[pefile.txt:255] and a minimal resource directory containing just RT_VERSION and RT_MANIFEST ^[pefile.txt:266-328].

How It Works

The application is a standard WinForms dual-pane file manager with the following observable surface:

• Dual-pane tree/list views (LeftListView, RightListView, LeftDrivesPanel, RightDrivesPanel) with FileSystemWatcher observers for live refresh ^[strings.txt:296-299]
• File operations: Copy, Move, Delete, Rename — all via standard System.IO APIs (FileInfo, DirectoryInfo, FileStream, Path) ^[strings.txt:270-279]
• Assembly introspection: ShowAssemblyForm loads a selected assembly and reflects over its Types, MethodInfos, FieldInfos, ConstructorInfos, and PropertyInfos via System.Reflection ^[strings.txt:336-344]
• Font/settings dialog: FontSettingsForm with ColorDialog and FontDialog ^[strings.txt:160-161]
• Progress reporting: IProgress<T> / CancellationTokenSource async file-copy with per-file and overall progress bars ^[strings.txt:55-56,74]

No networking namespace (System.Net absent), no cryptography namespace (System.Security absent), no process injection, no registry writes, no persistence. The ShowAssemblyForm reflective loading is a benign developer feature (assembly inspection), not a T1620 payload — capa flags it because it hits the invoke .NET assembly method / load .NET assembly rules generically ^[capa.txt:45-46].

Decompiled Behavior

Ghidra / dnSpy not required — the CIL metadata is unobfuscated and the strings surface tells the full story. Key namespaces recovered from #Strings and resource names:

• FileManager — main namespace; Form1 is the primary dual-pane window
• FileManager.Forms — child dialogs (RenameForm, DeleteForm, MoveForm, CopyForm, FontSettingsForm, ShowAssemblyForm)
• FManagerApp.Properties — Resources and Settings designers
• FManagerApp.Properties.Resources.resources — embedded icons and image streams

The ShowAssemblyForm is notable only because it calls Assembly.LoadFrom, GetTypes, GetMethods, GetFields, and InvokeMember ^[strings.txt:214,236,270,279,285] — this is what triggers capa's T1620 reflective-code-loading flag, but in context it is a benign assembly-browser feature analogous to ILSpy or Reflector.

C2 Infrastructure

None. No hardcoded domains, IPs, URLs, mutexes, named pipes, or registry keys. No System.Net references. ^[strings.txt — absence confirmed by grep for System.Net, HttpWebRequest, Socket, TcpClient, WebClient]

Interesting Tidbits

• Internal / original filename mismatch: Internal name NvQw.exe and original filename NvQw.exe bear no relation to the distribution name PO-000001488.exe or the VS_VERSIONINFO product name Presentation Foundation Terminal ^[exiftool.json:40,43]. This is classic anti-triage noise — three unrelated identities for the same binary.
• VS_VERSIONINFO masquerade: Claims Microsoft Corporation. / Presentation Foundation Terminal / Copyright © Microsoft Corporation. All rights reserved. ^[exiftool.json:37-42]. The binary is unsigned, so the masquerade is purely social-engineering — no Authenticode validation to backstop it.
• PDB path is local: NvQw.pdb with no directory prefix suggests a Visual Studio default build on the author's machine, not a CI pipeline.
• High .text entropy (7.84): Standard for .NET Native / ILC compiled assemblies where the IL has been ahead-of-time compiled to native code and embedded in the PE. Not packing. ^[pefile.txt:92]
• No obfuscation: No SmartAssembly, ConfuserEx, Xenocode, or Dotfuscator signatures. Class and method names are human-readable (FileManager, CopyForm_Load, ConfigurateObservers).
• PNG resource embedded: Binwalk finds a 524×524 PNG at offset 0xB748 ^[binwalk.txt:6] — likely the application icon or splash image.

How To Mess With It (Homelab Replication)

This is a benign file manager; replicating it teaches WinForms dual-pane UI design and System.Reflection assembly browsing.

• Toolchain: Visual Studio 2022, .NET Framework 4.8, C# WinForms App template
• Key controls: TreeView (folder tree), ListView (file list with Name, Type, Size, Date columns), SplitContainer, ToolStrip, FileSystemWatcher
• Reflection feature: Load an assembly via Assembly.LoadFrom(path), iterate assembly.GetTypes(), display methods/fields/properties in a PropertyGrid or custom list
• Verification: Build, run capa <output.exe> — expect T1083 (file discovery) and T1620 (assembly loading) hits. Confirm they are false positives by reviewing the actual call sites.

Deployable Signatures

YARA rule

rule Unclassified_DotNet_FileManager_Masquerade
{
    meta:
        description = "Detects .NET Native file manager with NvQw.exe internal name and PO lure masquerade"
        author = "pp-hermes"
        date = "2026-06-30"
        hash = "b760c6f2383e05037e5a71b4a39e2e333504d37f81d15116a2bed45eac537feb"
    strings:
        $s1 = "NvQw.exe" ascii wide
        $s2 = "Presentation Foundation Terminal" ascii wide
        $s3 = "FileManager.Forms.ShowAssemblyForm" ascii wide
        $s4 = "FManagerApp.Properties.Resources" ascii wide
        $s5 = "ConfigurateObservers" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.is_dotnet and
        3 of ($s*)
}

Behavioral fingerprint

A .NET Framework PE32 with IL linker v48.0, internal name NvQw.exe, VS_VERSIONINFO claiming Presentation Foundation Terminal by Microsoft Corporation., and no System.Net or System.Security imports. Opens as a standard GUI file manager with dual-pane layout, FileSystemWatcher-driven live refresh, and an assembly-reflection browser feature. No network, no crypto, no persistence.

IOC list

Detection Signatures

References

• Artifact ID: e4c1539b-6aa6-402b-9938-1a4756ade21b
• MalwareBazaar: PO-000001488.exe (tagged exe)
• Family entity: unclassified-dotnet
• Concept: social-engineering-filename-lure
• Concept: version-info-masquerade

Provenance

Analysis based on static triage artifacts generated by the pp-hermes pipeline: file (file-type), exiftool (metadata), pefile (PE structure), strings (ASCII/Unicode), capa (Mandiant capability detection), binwalk (embedded file carving), rabin2 -I (radare2 binary info). No dynamic execution available (CAPE skipped: no Windows guest). FLOSS not run successfully on .NET assembly. No Ghidra decompilation performed — CIL metadata is unobfuscated and sufficient for attribution.