unclassified-dotnet: c4ee3a31081d — Spanish WinForms educational app, stolen PuTTY-dev cert, HAWB logistics lure

Executive Summary

A benign .NET Framework 4.0 WinForms GUI application (PrimeraVentana, Spanish-language programming class exercise) repackaged with a stolen Authenticode certificate belonging to Simon Tatham (PuTTY developer, COMODO RSA Code Signing CA chain) and distributed as HAWB_#4532222.exe. No malicious payload, no network APIs, no persistence, no keylogging. The snakekeylogger family label from OpenCTI is a false positive. Threat is purely social-engineering masquerade + stolen certificate lending false legitimacy. Sibling to eea0dcbc (attendance tracker, same cert chain, same build toolchain). ^[triage.json] ^[exiftool.json]

What It Is

How It Works

The binary is a standard .NET Framework 4.0 WinForms application with no packing, no obfuscation, and no native API P/Invoke. All classes are GUI-related:

• PrimeraVentana.frmClasePersona — person data entry form
• PrimeraVentana.VentanaPrincipal — main window
• PrimeraVentana.frmPrincipal — another form
• PrimeraVentana.Properties.Resources — embedded resources (icons, bitmaps)
• Program — standard Application.Run() entry point

The namespace PrimeraVentana and control names (btnMostrarPersona, txtNombre, rbNacional, rbTurista, cbChocolate, dtpAnioNacimiento, nudAniosEnElPais, LbFelicitacion, lbFechaNacimiento) are unmistakably from a Spanish-language programming class exercise — a typical "Persona" / "Producto" / "Botella" object-oriented lab assignment. ^[strings.txt:8-306]

There are no references to:

• SetWindowsHookEx, GetAsyncKeyState, WH_KEYBOARD (keylogging)
• Clipboard, GetText, SetText (clipboard hijacking)
• System.Net.WebClient, HttpWebRequest, TcpClient, Socket (network C2)
• Registry.SetValue, Run key modification (persistence)
• Process.Start with suspicious arguments, ProcessHollowing, CreateRemoteThread (injection)
• SmtpClient, MailMessage, SendMail (SMTP exfil)

The capa T1620 "Reflective Code Loading" hit is a false positive from standard .NET Assembly.Load / CreateInstance patterns used by the WinForms resource manager. ^[capa.txt]

Decompiled Behavior

Ghidra import succeeded (c4ee3a31081db5feff937ed7a716fd805b467dacc6c1d679c4508e5b51ba8895.bin-a85815). Analysis shows 74 functions, 233 symbols, 936 data types — all consistent with a standard .NET WinForms app with no suspicious API imports. No native DLL imports beyond mscoree.dll._CorExeMain. No obfuscated or encrypted strings. ^[ghidra:metadata]

C2 Infrastructure

None. No network APIs, no hardcoded URLs, no IP addresses, no domain names, no SMTP servers, no Telegram bot tokens, no Discord webhooks. C2 is not applicable.

Interesting Tidbits

• Stolen certificate sibling: The exact same COMODO RSA Code Signing CA chain (CN=Simon Tatham, serial range, CRL/OCSP endpoints) was observed on eea0dcbc (attendance tracker / WpfUI / PAYMENT_CANCELLED_AND_RETURNED.PDF.exe). Both samples share the same fraudulent certificate but contain completely different benign payloads. This suggests a bulk certificate-theft operation where the same stolen key is reused across multiple unrelated repackaged binaries. ^[strings.txt:1121-1248] ^[/intel/analyses/eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a.html]
• HAWB logistics lure: HAWB_#4532222.exe masquerades as a House Air Way Bill (air freight tracking document). This is a standard logistics/shipping social-engineering theme, sibling to DHL, airway-bill, and payment-advice lures observed elsewhere in the corpus. ^[metadata.json]
• Version-info word salad: FileDescription: pdf, ProductName: exel, LegalTrademarks: zip, Comments: file — nonsensical VS_VERSIONINFO fields, identical style to other benign-repackaged samples in the unclassified-dotnet cluster. ^[exiftool.json]
• Fabricated timestamp: 2095-05-27 is impossible, indicating the build was not from a legitimate pipeline. ^[pefile.txt]
• SnakeKeyLogger false positive: OpenCTI's snakekeylogger tag is likely based on filename heuristics or community mislabeling. Zero static evidence supports this family assignment.

How To Mess With It (Homelab Replication)

1. Build a benign .NET WinForms app in C# (VS 2013 or later, .NET Framework 4.0 target).
2. Create a simple form with Spanish labels (Nombre, Apellido, Fecha de Nacimiento, Nacionalidad, Turista) and standard controls (TextBox, ComboBox, DateTimePicker, RadioButton, Button).
3. Compile with csc.exe or Visual Studio; note the AssemblyVersion, FileVersion, and OriginalFilename in AssemblyInfo.cs.
4. Observe capa: Run capa on the output. You will likely get the same T1620 false positive from Assembly.Load and CreateInstance calls used by the resource manager.
5. Lesson learned: Capa T1620 on .NET binaries without additional network/persistence indicators is not sufficient for malware attribution. Always verify with strings, imports, and decompilation.

Deployable Signatures

YARA Rule

rule UnclassifiedDotNet_BenignCarrier_StolenTathamCert
{
    meta:
        description = "Benign .NET app repackaged with stolen Simon Tatham (PuTTY) Authenticode certificate"
        author = "PacketPursuit"
        date = "2026-06-22"
        reference_sha256 = "c4ee3a31081db5feff937ed7a716fd805b467dacc6c1d679c4508e5b51ba8895"
    strings:
        $dotnet = ".NETFramework,Version=v4.0" ascii wide
        $tatham1 = "Simon Tatham" ascii wide
        $tatham2 = "COMODO RSA Code Signing CA" ascii wide
        $tatham3 = "https://www.chiark.greenend.org.uk/~sgtatham/putty/" ascii wide
        $tatham4 = "SSH, Telnet and Rlogin client" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $dotnet and
        2 of ($tatham*)
}

Sigma Rule

title: Stolen Simon Tatham Certificate Execution
logsource:
    product: windows
    category: image_load
detection:
    selection:
        ImageLoaded|endswith: '.exe'
        Signature: 'Simon Tatham'
        Signed: 'true'
    filter_legitimate:
        ImageLoaded|contains:
            - 'putty.exe'
            - 'pscp.exe'
            - 'psftp.exe'
            - 'pageant.exe'
            - 'plink.exe'
    condition: selection and not filter_legitimate
falsepositives:
    - Legitimate PuTTY tools (if the certificate was not revoked)
level: high

IOC List

Behavioral Fingerprint

This binary is a standard .NET Framework 4.0 WinForms GUI application with no network imports, no registry persistence, no process injection, and no keylogging APIs. It launches via mscoree.dll._CorExeMain, initializes a Form1-style window with Spanish-language UI controls, and exits normally. The only threat indicator is the stolen Authenticode signature and the social-engineering filename. Any detection should focus on the certificate anomaly rather than runtime behavior.

Detection Signatures

References

• Artifact ID: f6dfd5f1-9ddc-49ae-8902-2bc2b2b5b27f
• Source: OpenCTI / MalwareBazaar (abuse.ch)
• Related wiki pages: unclassified-dotnet, social-engineering-filename-lure, stolen-certificate-signing
• Sibling analysis: eea0dcbc (attendance tracker with same stolen cert) — /intel/analyses/eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a.html

Provenance

Analysis based on:

• file.txt (file(1) output)
• exiftool.json (EXIFTool 12.76 PE metadata)
• pefile.txt (pefile.py PE header dump)
• strings.txt (raw strings, 1248 lines)
• capa.txt (Mandiant capa v7 static analysis)
• binwalk.txt (Binwalk embedded artifact scan)
• rabin2-info.txt (radare2 binary header summary)
• triage.json (corpus triage metadata)
• metadata.json (OpenCTI artifact metadata)
• Ghidra 12.1 decompilation (imported, 74 functions, 233 symbols)

No dynamic analysis available (CAPE skipped — no Windows guest). All behavioral claims are static-only and marked accordingly.