> Family · unclassified-dotnet-inventory-app_

~/packetpursuit $ cat /intel/families/unclassified-dotnet-inventory-app.md

confidencehigh

unclassified-dotnet-inventory-app

Benign .NET Framework 4.x Windows Forms inventory-management application, Spanish-language UI. False-positive MalwareBazaar ingestion.

Capabilities

  • dotnet-winforms-database-crud
  • sql-client-ado-net
  • custom-string-pair-decoder
  • embedded-resource-config

Notes

Sample 99e5d5d8e7e04fa65d12f184c7dc0c5ceb012125e00d99eb5c10fad33f3c87ff is a standard PE32 .NET GUI assembly with namespace ABMProductos (Product CRUD). Uses System.Data.SqlClient for backend connectivity. Contains a trivial CustomDecode / Trif32 character-pair lookup decoder for an embedded string block (offset 0xaa813). No network APIs, no persistence, no anti-analysis. capa T1027/T1620/T1213 hits are false positives from generic .NET runtime patterns.