unclassified-dotnet: cae7ac1dc419 — Stolen Simon Tatham cert, Spanish WinForms edu-app repackaged as TRANSACTION_ERROR.PDF.exe

Executive Summary

A .NET Framework 4.0 WinForms educational application (PrimeraVentana) repackaged with a stolen Simon Tatham (PuTTY developer) Authenticode certificate (COMODO RSA Code Signing CA chain) and distributed under the filename TRANSACTION_ERROR.PDF.exe. The binary is functionally identical to benign Spanish-language coursework (PrimeraVentana) observed in sample c4ee3a31081d; threat is purely social-engineering masquerade + stolen-certificate lending false legitimacy. Third confirmed sibling in the stolen-Tatham-cert cluster.

What It Is

• SHA-256: cae7ac1dc4191db8041bca77127910f900f9effbe1b9e87492ba49549de14676
• File: TRANSACTION_ERROR.PDF.exe (double-extension masquerade via .PDF.exe) ^[triage.json]
• Type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, 3 sections ^[file.txt]
• Size: 721,928 bytes (705 KB) ^[triage.json]
• Compiler: .NET Framework v4.0.30319 (C#), VS 2010-era project structure ^[strings.txt:5] ^[strings.txt:315]
• Timestamp: 0x8D4D7B0F → Tue Feb 14 06:07:11 2045 UTC (fabricated / future-dated) ^[pefile.txt:34]
• PDB: WVmY.pdb at GUID D0E1C231-9C89-4A7A-8461-CB5E07557173 ^[pefile.txt:345-353]
• Authenticode: Valid, signed with stolen certificate CN=Simon Tatham, O=Simon Tatham, L=Cambridge, ST=Cambridgeshire, C=GB; issuer CN=COMODO RSA Code Signing CA, root CN=COMODO RSA Certification Authority ^[exiftool.json] ^[pefile.txt:708-715]
• Capa hits: reference analysis tools strings (anti-analysis), generate random numbers in .NET, access .NET resource, load .NET assembly, compiled to the .NET platform ^[capa.txt]
• ATT&CK: T1620 (Reflective Code Loading — false positive from standard .NET assembly loading) ^[capa.txt]
• CAPE: Skipped — no Windows guest available for .NET platform ^[dynamic-analysis.md]

How It Works

The binary is a standard .NET Framework 4.0 CIL assembly with a WinForms GUI. Class namespace PrimeraVentana contains:

• Botella (bottle — capacity/material demo)
• frmClasePersona (person-class form)
• VentanaPrincipal (main window — number-guessing game, "Juego de Azar")
• frmPrincipal (secondary form)
• Perro (dog), Persona (person), Producto (product), Venta (sale) — plain OOP coursework classes ^[strings.txt:24-27] ^[strings.txt:138-149]

All UI strings are Spanish (e.g., Introduce un numero del 1 al 100, veamos si tienes suerte, Felicidades, Intenta otra vez, Cargar informacion, Mostrar Persona) ^[strings.txt:500-560].

The .rsrc section contains four embedded PNG icons (32×32, 524×524, plus a PC bitmap 131×131) and standard WinForms .resources streams ^[binwalk.txt:6-11]. No encrypted payload, no shellcode, no reflective injection logic.

Decompiled Behavior

Ghidra and radare2 both treat the binary as CIL; analysis completes successfully but the entry point is the standard .NET CLR shim (_CorExeMain → mscoree.dll). ^[rabin2-info.txt] ^[ghidra:imports]

Radare2 enumerates classes and methods (126 functions total) but decompilation is CIL-assembly, not meaningful pseudo-C. Notable methods:

• PrimeraVentana.VentanaPrincipal.InitializeComponent — standard WinForms designer-generated layout code ^[r2:method.PrimeraVentana.VentanaPrincipal.InitializeComponent]
• PrimeraVentana.VentanaPrincipal.BtnVerificar_Click — number-guessing game logic ^[r2:method.PrimeraVentana.VentanaPrincipal.BtnVerificar_Click]
• PrimeraVentana.frmClasePersona.btnMostrarPersona_Click — display person data ^[r2:method.PrimeraVentana.frmClasePersona.btnMostrarPersona_Click]

No native API imports beyond mscoree.dll!_CorExeMain. No LoadLibrary, VirtualAlloc, CreateProcess, WinHTTP, WSAStartup, or socket APIs. ^[pefile.txt:255] ^[rabin2-info.txt:29]

C2 Infrastructure

None. No hardcoded IPs, domains, URLs, mutexes, named pipes, or registry keys beyond standard .NET Framework defaults. All URLs in the binary are certificate CRL/OCSP endpoints:

• http://crl.comodoca.com/COMODORSACertificationAuthority.crl
• http://crl.comodoca.com/COMODORSACodeSigningCA.crl
• http://ocsp.comodoca.com
• http://crt.comodoca.com/COMODORSAAddTrustCA.crt
• http://crt.comodoca.com/COMODORSACodeSigningCA.crt ^[strings.txt] ^[exiftool.json]

Interesting Tidbits

• Stolen certificate sibling #3: Same Simon Tatham (PuTTY) COMODO RSA Code Signing CA chain as eea0dcbc (PAYMENT_CANCELLED) and c4ee3a31081d (HAWB shipping doc). This is the third distinct benign payload observed under this stolen cert. ^[exiftool.json] ^[pefile.txt]
• Version info masquerade: Claims CompanyName: Microsoft Corporation., FileDescription: LUA Client, ProductName: LUA Client, InternalName: WVmY.exe — none of which match the actual PrimeraVentana content or the distribution filename. ^[exiftool.json] ^[pefile.txt:235-243]
• Project origin: Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 16.10.0.0 and System.Resources.Tools.StronglyTypedResourceBuilder 16.0.0.0 suggest VS 2019/2022 rebuild of a VS 2010-era project. ^[strings.txt:319-320]
• Assembly GUID: $511bc5f3-f16b-4cdc-a551-e5fcb710aff8 ^[strings.txt:313] — same GUID prefix pattern as other .NET coursework samples.
• Resource entropy: .text entropy 7.85 (expected for CIL bytecode), .rsrc entropy 3.44 (icons + manifest — low, expected). ^[pefile.txt:92] ^[pefile.txt:112]
• No obfuscation: Plain method names, no ConfuserEx/SmartAssembly/Xenocode signatures. dnfile-capable tools would parse metadata trivially.

How To Mess With It (Homelab Replication)

Build a benign .NET WinForms app in C#, embed a few PNG icons, compile with VS 2019+ targeting .NET Framework 4.0, and sign with a stolen or test Authenticode certificate. Capa will flag T1620 and C0021.003 from Random.Next() used in a number-guessing game and standard Assembly.Load calls — demonstrating how capa on unobfuscated .NET often produces false-positive ATT&CK mappings.

Verification: capa <reproducer.exe> should hit the same five capabilities as this sample.

Deployable Signatures

YARA rule

rule UnclassifiedDotnet_StolenSimonTathamCert
{
    meta:
        description = ".NET Framework PE32 signed with stolen Simon Tatham (PuTTY) COMODO RSA Code Signing CA certificate"
        author = "titus"
        date = "2026-06-23"
        sha256 = "cae7ac1dc4191db8041bca77127910f900f9effbe1b9e87492ba49549de14676"
    strings:
        $a = "PrimeraVentana" ascii wide
        $b = "Simon Tatham" ascii wide
        $c = "COMODO RSA Code Signing CA" ascii wide
        $d = "Microsoft Corporation." ascii wide
        $e = "LUA Client" ascii wide
        $f = { 4D 5A } // PE header
        $g = ".NETFramework,Version=v4.0" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $f at 0 and
        $g and
        ($b and $c) or
        ($a and $d and $e)
}

Sigma rule

title: .NET WinForms Educational App with Stolen Authenticode Cert
logsource:
    product: windows
    category: image_load
detection:
    selection:
        - ImageLoaded|endswith:
            - 'TRANSACTION_ERROR.PDF.exe'
            - 'WVmY.exe'
        - Hashes|contains:
            - 'cae7ac1dc4191db8041bca77127910f900f9effbe1b9e87492ba49549de14676'
    cert_filter:
        - Signer|contains: 'Simon Tatham'
          Subject|contains: 'Cambridge'
    condition: selection and cert_filter
falsepositives:
    - Legitimate PuTTY developer builds (extremely unlikely for non-putty binaries)
level: high

IOC list

Behavioral fingerprint

This binary loads only mscoree.dll, executes standard CLR startup, and performs no native API calls, network connections, registry modifications, or process spawning. Capa flags T1620 (Reflective Code Loading) and C0021.003 (Use API for pseudo-random numbers) — both are false positives arising from standard .NET assembly-loading and System.Random usage in a number-guessing game. The actual threat is social-engineering filename masquerade (TRANSACTION_ERROR.PDF.exe) combined with a stolen Authenticode certificate that would display as "Verified Publisher: Simon Tatham" in Windows SmartScreen.

Detection Signatures

• Capa: reference analysis tools strings (anti-analysis), generate random numbers in .NET (data-manipulation/prng), access .NET resource (executable/resource), load .NET assembly (load-code/dotnet), compiled to the .NET platform (runtime/dotnet) ^[capa.txt]
• MITRE ATT&CK: T1620 (Reflective Code Loading) — false positive from legitimate .NET assembly loading behavior ^[capa.txt]
• YARA: Only PE_File_Generic hit ^[yara.txt]

References

• unclassified-dotnet — umbrella entity for unattributed .NET Framework PE32/PE32+ binaries
• stolen-certificate-signing — cross-family concept: malware signed with stolen legitimate certificates
• social-engineering-filename-lure — cross-family concept: payment/transaction-themed filenames
• Sample eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a — sibling #1 (PAYMENT_CANCELLED, WpfUI)
• Sample c4ee3a31081db5feff937ed7a716fd805b467dacc6c1d679c4508e5b51ba8895 — sibling #2 (HAWB shipping doc, PrimeraVentana)
• MalwareBazaar entry (via artifact_id 6f8760e7-45e0-41f6-8cd2-8383221f9cfb) — exe label only, no family attribution ^[triage.json]

Provenance

• file.txt — file(1) output
• exiftool.json — ExifTool 12.76 metadata extraction
• pefile.txt — pefile 2023.x DOS/NT header, section, import, resource, debug, and security directory dump
• strings.txt — GNU strings -n 8 on the raw binary
• capa.txt — Mandiant capa v7.x static analysis (dotnet ruleset)
• binwalk.txt — binwalk v2.3.x embedded file carving
• rabin2-info.txt — radare2 5.x binary info (rabin2 -I)
• dynamic-analysis.md — CAPE sandbox status (skipped, no Windows guest)
• triage.json — internal triage pipeline metadata
• Ghidra analysis via pyghidra MCP — completed, 126 functions enumerated, imports: mscoree.dll!_CorExeMain
• radare2 analysis via r2mcp — completed, CIL class/method enumeration