unclassified-dotnet: f7c4caea — ReichUI WinForms library repackaged as purchase-order lure

Executive Summary

A benign .NET Framework WinForms custom UI library (ReichUI, v1.0.3.0) repackaged with the filename Purchase_Order_24-0266.exe. No packing, no obfuscation, no native API imports, no network APIs, no persistence, and no payload beyond the WinForms surface. Threat is purely social-engineering masquerade — the binary presents itself as a purchase-order document but is in fact a developer UI toolkit. CAPE skipped due to no Windows guest; static analysis is sufficient to determine benign intent. The capa T1620 and thread-management hits are false positives from standard WinForms UI-animation and drag-handling code.

What It Is

• SHA-256: f7c4caea463a11d2b95355d4bd9b81b01833da9b3ecfca69fcaf0564d52f46f2
• Filename: Purchase_Order_24-0266.exe (social-engineering lure)
• Internal name: eajv.exe ^[pefile.txt:238]
• Size: 745,472 bytes (728 KB)
• File type: PE32 executable (GUI) Intel 80386 Mono/.NET assembly ^[file.txt:1]
• Compiled: Fri Jul 26 02:30:10 2024 UTC ^[pefile.txt:34]
• Runtime: .NET Framework v4.0.30319 ^[metadata.json]
• Linker: MSVC 8.0 / .NET 4.0 ^[pefile.txt:45]
• Sections: 3 — .text (code, entropy 7.857), .rsrc (RT_VERSION + RT_MANIFEST only), .reloc ^[pefile.txt:78]
• Signed: No (checksum 0x00000000) ^[pefile.txt:65]
• CAPE: Skipped — no Windows guest available ^[dynamic-analysis.md:3]

Version-info masquerade is light: ProductName: Reich UI, FileDescription: Reich UI, Comments: C# WindowsForms Custom UI & Controls, LegalCopyright: Copyright © 2017. The mismatch between internal name (eajv.exe) and distribution filename is the only deception layer. ^[exiftool.json:36]

How It Works

The binary is a compiled .NET Framework assembly containing ~1,572 CIL methods across the ReichUI namespace. The codebase is a full WinForms custom-control library:

• ReichUI.Forms.ReichForm — custom form with gradient background, rounded edges, draggable chrome-less title bar, resize grip, and custom cursor support. ^[r2:ReichUI.Forms.ReichForm]
• ReichUI.Controls.ReichButton — animated gradient button with hover state, hand-cursor, and directional arrow support. ^[r2:ReichUI.Controls.ReichButton]
• ReichUI.Controls.ReichCheckBox / ReichCheckBoxQuiz — custom checkbox with image-based state rendering, keyboard handling, and quiz-style multi-option validation. ^[r2:ReichUI.Controls.ReichCheckBox]
• ReichUI.Controls.ReichTitleBar / ReichControlBox / ReichGradientPanel — chrome-less window chrome with minimize/maximize/close glyphs and drag support. ^[r2:ReichUI.Controls.ReichTitleBar]

The ReichUI.Tests.Forms.Form1 class is the application entry point (Main → new Form1() → InitializeComponent). Form1.Trif32 is a tiny 58-byte method with a 5-branch switch dispatch — likely a stub event handler or placeholder for a quiz-validation callback. ^[r2:ReichUI.Tests.Forms.Form1.Trif32]

No malicious behavior observed

The HwnF and CEPZ675RR7FP7GQ7DEZY8H strings visible in the binary are resource property names and GUID-style resource identifiers used by the .NET ResourceManager for embedded cursor and bitmap assets — not C2 markers. ^[strings.txt:1]

Decompiled Behavior

Entry point (entry0 at 0x004079e0): ^[r2:entry0]

push 0x00008828
push loc0
nop
// initialise NoEnumerationAttribute static ctor
push 0
// initialise RegexPatternAttribute static ctor
nop
// create Form1 instance
push new ReichUI.Tests.Forms.Form1..ctor()
// show/execute application
return

This is standard WinForms bootstrap: initialise static fields, instantiate the main form, and hand control to the Windows message loop.

Form1.InitializeComponent (RVA 0x7a18, 101 bytes): ^[r2:ReichUI.Tests.Forms.Form1.InitializeComponent]

A larger method with an 8-branch switch — typical of designer-generated WinForms initialisation code that sets properties, wires event handlers, and configures layout based on design-time state flags. No network, file, or registry operations.

Trif32 (RVA 0x8a34, 58 bytes): ^[r2:ReichUI.Tests.Forms.Form1.Trif32]

ldarg.1
stloc.2
ldarg.2
switch (5 branches)  // branch targets omitted
// ... small arithmetic / field stores
ret

This is a simple dispatch stub. No external calls, no reflection, no suspicious APIs.

C2 Infrastructure

None. No URLs, IPs, domains, mutex names, named pipes, or registry keys associated with C2. The binary does not contain any networking code.

Interesting Tidbits

• Heavy JetBrains/ReSharper annotation surface — the assembly embeds the full ReichUI.Annotations namespace with 40+ attribute classes (CanBeNullAttribute, AspMvcActionAttribute, RazorLayoutAttribute, etc.). This is a common artefact of C# projects that include the JetBrains.Annotations NuGet package; it inflates the method count and string surface, which can trigger capa false positives. ^[r2:ReichUI.Annotations]
• GUID resource token — bbfbc33f-9a46-4b13-a230-a7a7a6530e81 appears in the #US stream and is referenced by the ResourceManager constructor. This is a standard .NET resource GUID, not a campaign ID. ^[strings.txt:1]
• No obfuscation, no packing — the IL is completely unobfuscated. dnSpy/ILSpy would open this immediately. The high .text entropy (7.857) is explained by the large volume of compiled CIL and embedded string literals (1,572 methods × average method overhead), not encryption.
• Purchase-order lure pattern — the filename Purchase_Order_24-0266.exe follows the exact template seen in other social-engineering campaigns (PO-1512024-pdf.exe, Purchase_Order.exe, Bank_Payment_Advice20396.exe) but here the underlying payload is genuinely benign. The threat is entirely the filename.

How To Mess With It (Homelab Replication)

Reproduce a comparable capa fingerprint:

1. Create a new C# WinForms project in Visual Studio targeting .NET Framework 4.8.
2. Add the JetBrains.Annotations NuGet package.
3. Create a custom UserControl with animated hover states (timer-based OnMouseEnter/OnMouseLeave).
4. Add a Form with DoubleBuffered, custom OnPaint gradient fill, and MouseMove drag handling.
5. Build as Release | x86.
6. Run capa <output.exe>.

Expected capa overlap:

• create thread — from System.Windows.Forms.Timer or System.Threading.Thread used for UI animation.
• suspend thread — from WinForms internal message-pump synchronization.
• invoke .NET assembly method / load .NET assembly — standard CLR startup.
• unmanaged call — from the JIT-compiled native stubs for GDI+ / USER32.

Verification: The capa fingerprint will look nearly identical to this sample, confirming the hits are benign surface artefacts.

Deployable Signatures

YARA rule

rule ReichUI_PurchaseOrder_Lure {
    meta:
        description = "Detects ReichUI WinForms library repackaged with purchase-order lure filenames"
        author = "PacketPursuit"
        date = "2026-06-21"
        sha256 = "f7c4caea463a11d2b95355d4bd9b81b01833da9b3ecfca69fcaf0564d52f46f2"
    strings:
        $a1 = "ReichUI.Properties.Resources" wide
        $a2 = "ReichUI.Forms.ReichForm" wide
        $a3 = "ReichUI.Controls.ReichButton" wide
        $a4 = "C# WindowsForms Custom UI & Controls" wide
        $a5 = "Reich UI" wide
        $b1 = "bbfbc33f-9a46-4b13-a230-a7a7a6530e81" wide
    condition:
        uint16(0) == 0x5A4D and
        3 of ($a*) and $b1
}

Behavioral fingerprint

This binary is a .NET Framework PE32 with no packing, no native imports beyond mscoree.dll, and no network APIs. The threat is entirely the social-engineering filename (Purchase_Order_*.exe). Static triage can safely rule out malware if:

• mscoree.dll is the sole import,
• No P/Invoke signatures exist in the metadata,
• No HTTP/WinSock strings are present in #US or #Strings heaps,
• The internal name (eajv.exe) does not match the distribution filename.

IOC list

Detection Signatures

Note on T1620: The capa reflective code loading hit is a false positive. In .NET assemblies, the CLR itself performs reflective loading of mscorlib and framework assemblies at startup. The sample contains no user-code reflection (Assembly.Load, Activator.CreateInstance, MethodInfo.Invoke) targeting external payloads. ^[capa.txt:15]

Note on C0038/C0055: Thread creation and suspension hits arise from standard WinForms infrastructure (System.Windows.Forms.Timer, drag-event message-pump synchronization, and cursor-animation threads). No malicious thread injection is present.

References

• Artifact ID: 872fb13f-1471-4391-a582-cc2a1fe5eed3 (OpenCTI)
• Source: MalwareBazaar / OpenCTI urlhaus-recent-payloads connector
• Related entity: unclassified-dotnet — umbrella for unattributed .NET binaries, including other benign samples repackaged with social-engineering filenames
• Related concept: version-info-masquerade — altering VS_VERSIONINFO to masquerade as legitimate software

Provenance

Analysis based on:

• file.txt — file v5.44
• pefile.txt — pefile Python library
• exiftool.json — ExifTool v12.76
• strings.txt — strings -n 8
• rabin2-info.txt — radare2 v5.9.8
• capa.txt — FLARE capa v7.4.0 (static analysis, dotnet format, i386 arch)
• binwalk.txt — Binwalk v2.3.4
• yara.txt — YARA v4.5.1 (PE_File_Generic rule)
• Radare2 IL decompilation via mcp_radare2 (1085 functions discovered, CIL backend)
• Manual .NET metadata parsing (BSJB header, #~, #US, #Strings, #Blob streams)
• No dynamic analysis performed (CAPE skipped due to no Windows guest).

Report generated 2026-06-21. Static-only analysis. Confidence: high (benign intent).