typeanalysisfamilyunclassified-dotnetconfidencelowdotnetpecompilerresearch-target

SHA-256: e816172fe4d4ab5c0e0b22c3c6dc7b022a7987c87f47a0cc27843c1f93527179

unclassified-dotnet: e816172f — TimeToRun C# snippet compiler, benign developer tool

Executive Summary

PE32 .NET Framework 4.0 GUI executable "TimeToRun" v1.3.1.0 by TTR. A C# snippet compiler/executor using CSharpCodeProvider + AppDomain.CreateInstanceAndUnwrap. No packing, no obfuscation, no network APIs, no persistence. Capa T1027.004/T1620 flags are false positives from legitimate compile-and-run behavior. Likely benign developer tool uploaded to MalwareBazaar in error. Static-only.

What It Is

SHA-256: e816172fe4d4ab5c0e0b22c3c6dc7b022a7987c87f47a0cc27843c1f93527179
Type: PE32 .NET Framework 4.0 GUI, 3 sections, 570 KB ^[file.txt]
Compiled: 2024-07-22 02:22:33 UTC ^[rabin2-info.txt]
Version: 1.3.1.0, Company "TTR", InternalName "KTubL.exe" ^[exiftool.json]
Imports: mscoree.dll!_CorExeMain only ^[r2]

How It Works

User enters C# into InputTextBox. CompileButton_Click -> TTRCompiler.Compile() -> CSharpCodeProvider.CompileAssemblyFromSource() builds a temp assembly ^[strings.txt:60] ^[r2:sym.TTR.Code.TTRCompiler.Compile]. RunButton_Click -> AssemblyLoader.LoadAssembly() -> AppDomain.CreateInstanceAndUnwrap() executes in-memory ^[strings.txt:284] ^[r2:method.TTR.Loader.AssemblyLoader.LoadAssembly]. Results to OutputTextBox ^[strings.txt:434]. Bundles JCDCustomStyle skinning library ^[strings.txt:85].

C2 Infrastructure

None. No System.Net APIs. Strictly offline.

Interesting Tidbits

Resource ddrVv — likely embedded PNG icon ^[r2:TTR.Properties.Resources.get_ddrVv] ^[binwalk.txt]
BinaryFormatter referenced — probably serializes snippet state ^[strings.txt:314]
floss.txt absent due to invocation error ^[floss.txt]

Deployable Signatures

YARA

rule timetorun_benign_compiler {
    meta:
        description = "TimeToRun .NET C# snippet compiler"
        hash = "e816172fe4d4ab5c0e0b22c3c6dc7b022a7987c87f47a0cc27843c1f93527179"
    strings:
        $a = "TimeToRun" ascii wide
        $b = "KTubL.exe" ascii wide
        $c = "CompileAssemblyFromSource" ascii wide
        $d = "TTR.Loader.AssemblyLoader" ascii wide
    condition:
        uint16(0) == 0x5A4D and pe.imports("mscoree.dll", "_CorExeMain") and 3 of them
}

Sigma

title: .NET Runtime Assembly Compilation
logsource: {category: process_creation, product: windows}
detection:
    selection:
        CommandLine|contains: 'CompileAssemblyFromSource'
        ParentImage|endswith: '\KTubL.exe'
    condition: selection
falsepositives: [Legitimate snippet runners]
level: medium

IOC: SHA-256 e816172f..., filename KTubL.exe, product TimeToRun, company TTR, GUID {62bb30f5-a1cc-45e5-a625-e9a7e1bd3605}.

Detection Signatures

T1027.004 (Compile After Delivery) — false positive ^[capa.txt]
T1620 (Reflective Code Loading) — false positive ^[capa.txt]
T1083 (File and Directory Discovery) — via .NET file APIs ^[capa.txt]

References

MalwareBazaar 46150647.exe. Entity: unclassified-dotnet

Provenance

file, exiftool 12.76, pefile, radare2, capa v7, binwalk, strings. floss.txt invocation failed. Ghidra import queued.

> Analysis · e816172fe4d4_