> Family · unclassified-dotnet_

~/packetpursuit $ cat /intel/families/unclassified-dotnet.md

typeentitycreated2026-06-18updated2026-07-18dotnetpemalware-familyunclassifiedevasionresearch-target

unclassified-dotnet

Umbrella label for .NET Framework PE32/PE32+ binaries that lack clear family attribution, crimeware builder fingerprints, or known packer/obfuscator signatures. Samples in this bucket are typically unobfuscated CIL assemblies where the threat logic (if any) is either absent or so generic that static analysis cannot confidently assign a named family.

Notable Analyses

  • bc38233e — .NET Framework 4.0 PE32+ x64 AES-CBC overlay loader (PO1.exe, future-dated timestamp 2040). Hardcoded 16-byte AES key LsFnDsm0WGBtR7C. 2.5 MB encrypted overlay (entropy 8.0) with PAPADDINGXX suffix. Keyboard-layout anti-VM (InputLanguageCollection, KeyboardLayoutId) flagged by capa T1497.001. Registry fingerprinting (RegistryKey, OpenSubKey). CIL bootstrap decrypts overlay → reflective execution via Assembly.Load/MethodBase.Invoke. No hardcoded C2 in outer layer. Purchase-order social-engineering lure. VS_VERSIONINFO masquerade with nonsense word-salad (Uxekobufi, Egemerevozulobehasa). Second confirmed sibling in unclassified-dotnet-crypter-loader family. Static-only (no CAPE Windows guest). ^[/intel/analyses/bc38233e18628256407420a857d1a1999974331cac7c5beb4368550d1d15f91d.html]

  • b760c6f2 — .NET Framework 4.0 WinForms dual-pane file manager (FManagerApp / NvQw.exe, Sep 2024 build) compiled with IL linker v48.0 (.NET Native/ILC). Distributed as PO-000001488.exe (purchase-order lure). Contains ShowAssemblyForm with benign Assembly.LoadFrom + InvokeMember reflection — capa flags T1620 falsely. No System.Net, no System.Security, no persistence, no anti-analysis, no packing. Unsigned. VS_VERSIONINFO masquerades as Presentation Foundation Terminal / Microsoft Corporation. Threat is purely social-engineering masquerade. Static-only analysis. ^[/intel/analyses/b760c6f2383e05037e5a71b4a39e2e333504d37f81d15116a2bed45eac537feb.html]

  • e816172f — .NET Framework 4.0 WinForms C# snippet compiler/executor "TimeToRun" (TTR). No packing, no obfuscation, no network APIs, no persistence. Capa T1027.004/T1620 flags are false positives from legitimate compile-and-run behavior. Likely benign developer tool. ^[/intel/analyses/e816172fe4d4ab5c0e0b22c3c6dc7b022a7987c87f47a0cc27843c1f93527179.html]

  • e7aaacbb — .NET Framework v4.0.30319 WinForms educational cryptography/networking lab (Caesar/Vigenère/RSA + TCP chat) repackaged with a DHL_Shipping_Documents_&_BL.exe social-engineering filename. No packing, no persistence, no C2. Vietnamese academic coursework identifiers (Lab06_Bai01, Bai03_Client, GIẢI MÃ). Threat is purely the masquerade; payload is benign. ^[/intel/analyses/e7aaacbb08fd0702c552169ce55065e51e1cfb55404509851592c3019fb15927.html]

eea0dcbc — .NET Framework 4.0 WPF/WinForms attendance tracker (WpfUI / zOYY.exe / AttendanceTracker) signed with a stolen Authenticode certificate belonging to Simon Tatham (PuTTY developer, COMODO RSA Code Signing CA chain). Distributed as PAYMENT_CANCELLED_AND_RETURNED.PDF.exe. No malicious payload, no C2, no persistence. Threat is purely the social-engineering masquerade + stolen certificate lending false legitimacy. ^[/intel/analyses/eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a.html]

  • f3bc22f6 — .NET Framework PE32 masquerading as the legitimate TransMock BizTalk utility (Copyright TransMock 2017, v1.3.0.0) with purchase-order lure PO-1512024-pdf.exe. Embeds malicious classes CrewPickupSM (WinHTTP downloader), EncryptionHelper (decryption), and ScopeFpgaI2c (staging) under the same namespace. Delegate-chain reflective execution, scheduled-task persistence (capa-inferred), runtime-resolved HTTPS C2. Not benign — this is an active loader. ^[/intel/analyses/f3bc22f69502ed934da8dea7940437e820e1c778016e330a28b1103b6ca247b1.html]

  • f7c4caea — .NET Framework v4.0.30319 WinForms custom UI library (ReichUI, v1.0.3.0) repackaged with the filename Purchase_Order_24-0266.exe. No packing, no obfuscation, no native API imports, no network APIs, no persistence, and no payload beyond the WinForms surface. Threat is purely social-engineering masquerade. Capa T1620 and thread-management hits are false positives from standard WinForms UI-animation and drag-handling code. ^[/intel/analyses/f7c4caea463a11d2b95355d4bd9b81b01833da9b3ecfca69fcaf0564d52f46f2.html]

  • f9a1fc01 — .NET Framework v4.0.30319 WinForms color-picker demo (ComboBoxBind, v1.0.9011.19466, internal mSmo.exe) distributed as Investec_-_Proof_of_payment_from_Phluid.bat.exe. Double extension masquerade (.bat.exe) with banking lure. No packing, no obfuscation, no network APIs, no persistence, no payload. The binary is benign; the threat is purely social engineering. ^[/intel/analyses/f9a1fc01119ed1cc7a5464cc4df2d3f0dea09f8227c6ba101c77c73f6c379214.html]

  • c4ee3a31081d — .NET Framework 4.0 WinForms Spanish-language educational app (PrimeraVentana, InXv.exe) repackaged with a stolen Simon Tatham (PuTTY) Authenticode certificate (COMODO RSA Code Signing CA chain) and distributed as HAWB_#4532222.exe. No malicious payload, no network APIs, no persistence. The snakekeylogger OpenCTI label is a false positive. Threat is purely social-engineering masquerade + stolen certificate. Sibling to eea0dcbc (same stolen cert, different benign payload). ^[/intel/analyses/c4ee3a31081db5feff937ed7a716fd805b467dacc6c1d679c4508e5b51ba8895.html]

  • cae7ac1dc419 — .NET Framework 4.0 WinForms Spanish-language educational app (PrimeraVentana, WVmY.exe) signed with the same stolen Simon Tatham (PuTTY) COMODO RSA Code Signing CA certificate as eea0dcbc and c4ee3a31081d. Distributed as TRANSACTION_ERROR.PDF.exe (double-extension masquerade). Third confirmed sibling in the stolen-Tatham-cert cluster. No malicious payload, no network APIs, no persistence. Capa T1620 and C0021.003 are false positives from standard .NET assembly loading and System.Random usage in a number-guessing game. ^[/intel/analyses/cae7ac1dc4191db8041bca77127910f900f9effbe1b9e87492ba49549de14676.html]

  • e04d46ff — .NET Framework 4.0 WinForms custom UI library (FSC UI by Fabian Schlüter, NZiU.exe, v1.0.0.0) repackaged with the filename QUOTE-2K240726-A-CCC.exe (business-document / quote lure). No packing, no obfuscation, no native APIs, no network APIs, no persistence. Contains a hardcoded SHA256 hash string (7d037a…) in #Strings metadata — purpose unknown. Capa T1620 and T1497.001 are false positives from Debug-build compiler-generated attributes. Threat is purely social-engineering masquerade. ^[/intel/analyses/e04d46ff3726afd45a2181347c64b088f9500d242eda127959a1462daa4db84e.html]

  • 9a40908c — Second confirmed FSC UI sibling. Same library (FSC UI by Fabian Schlüter, Zfio.exe, v1.0.0.0) repackaged as CV.pdf.exe (curriculum-vitae / resume lure, double-extension masquerade). 76 KB larger than e04d46ff (671 KB vs 595 KB), more embedded PNG icons, same hardcoded SHA256 hash string. Internal name and PDB changed to Zfio (nonsense string, likely auto-generated by repackager). Timestamp fabricated to 2097 (vs 2101 in first sibling). No malicious payload. Capa false positives identical to first sibling. Threat is purely social-engineering masquerade targeting HR/recruitment. Confirmed FSC UI open-source GitHub repository (Fabian2000/FSC-UI). Static-only analysis. ^[/intel/analyses/9a40908c3212dd34fd907ff66893537537adce8f136379baf98269158948a2e9.html]

  • a1e6dc7a — .NET Framework 4.0 WinForms paint/drawing program (gZUs.exe, v2.0.0.781) signed with the same stolen Simon Tatham (PuTTY) COMODO RSA Code Signing CA certificate as eea0dcbc, c4ee3a31081d, and cae7ac1dc419. Distributed as 62C0j88GAD91tR5.exe (random-noise filename, unlike themed lures of prior siblings). VS_VERSIONINFO masquerades as Adobe Reader / Microsoft PDF Document. No malicious payload, no network APIs, no persistence. Fourth confirmed sibling in the stolen-Tatham-cert cluster. Static-only analysis. ^[/intel/analyses/a1e6dc7a3172ae52663e446cb8286a8aeec8c92fe75eb97f290df80f2e1ac398.html]

  • a42443c8 — .NET Framework 4.0 WinForms Spanish-language educational app (PrimeraVentana namespace, Djxu.exe, v1.0.0.0) repackaged as University__of_Bahrain-_Project_FMD20240342.exe. VS_VERSIONINFO masquerades as "LUA Client" by "Microsoft Corporation." No packing, no obfuscation, no network APIs, no persistence. The SHA256 string at offset 1366 is a UI label, not an integrity hash. Capa T1620/C0021.003/B0013.001 are false positives from Debug-build attributes. Fourth confirmed PrimeraVentana sibling — identical namespace/class structure to c4ee3a31081d and cae7ac1dc419. Static-only analysis. ^[/intel/analyses/a42443c84fc9ec4a4f00c4363eee5074e94cfbb286a48fcbd33496dbbf0f5455.html]

  • 6a53c56172ce — .NET Framework 4.0 WinForms Spanish-language educational app (PrimeraVentana namespace, TZic.exe, v1.0.0.0) repackaged as 20240920060544041.exe. VS_VERSIONINFO masquerades as LUA Client / Microsoft Corporation. — same pattern as sibling a42443c8. No packing, no obfuscation, no network APIs, no persistence, no payload. Trif32 Caesar-shift-23 decoder present (shared with cluster). Capa T1620/C0021.003/B0013.001 are false positives. Sixth confirmed PrimeraVentana sibling. Static-only analysis. ^[/intel/analyses/6a53c56172ce6e29d1ab7e14cbd2ad20069637828cbb8a12d240addcf96dd5bc.html]

  • ad301389 — .NET Framework 4.0 WinForms Spanish RPG character generator (ejemplo namespace, HFGe.exe, v1.0.0.0) distributed as PO82200287.exe with fabricated Microsoft Corporation / Thumbnail Handler version-info masquerade. Contains ejemplo.Personaje, ejemplo.Elfo, ejemplo.Humano, ejemplo.Vampiro classes with MDI parent forms, Spanish UI strings (Nombre, Raza, Magia, FechaNacimiento, Territorios), and ~40 embedded PNG toolbar icons. No packing, no obfuscation, no network APIs, no persistence. Capa T1620/T1083 are false positives from standard .NET JIT and System.IO.Path usage. Threat is purely social-engineering masquerade. Static-only analysis. ^[/intel/analyses/ad301389152cb26900d3c06ea4f604dec119bf566b2f49dcdfdc21c658574420.html]

  • 644892e9 — Confirmed sibling of ad301389. Same Spanish RPG character generator (ejemplo namespace, identical class/method structure) but with internal name wHVe.exe, PDB wHVe.pdb, and distribution filename Purchase_Order.pdf.exe (double-extension masquerade). Size is +129 KB (982,528 vs 853,504 bytes) due to four embedded JPEG images replacing the ~40 PNG toolbar icons of the sibling. Same fabricated Microsoft Corporation / Thumbnail Handler version-info masquerade. Same false-positive capa T1620/T1083 flags. Threat is purely social-engineering masquerade. Static-only analysis. ^[/intel/analyses/644892e9fe96231990ad8095237bafee16d1fb77aadde35cd20105cef5f4b922.html]

  • 4cf48ffc — Third confirmed sibling of ad301389 / 644892e9. Same Spanish RPG character generator (ejemplo namespace, identical class/method structure) with internal name kUEo.exe, distribution filename invoice.exe. Size 931,328 bytes (between the two prior siblings). Reuses ~40 PNG toolbar icon pattern of ad301389. Same fabricated Microsoft Corporation / Thumbnail Handler version-info masquerade. Same Trif32 decoder. No malicious payload, no network APIs, no persistence. Capa produces only dnfile parser warnings (duplicate #Strings/#GUID/#Blob streams) with zero meaningful capability matches. Threat is purely social-engineering masquerade. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/4cf48ffc9f596563aeb6d774e5f222c8ef639f62df9dd87c99c7be32f71643c2.html]

  • a9b5e7469c35

b4814a17 — .NET Framework 4.0 dual-namespace PE32 (VD_Pacman + CalculatorWinForms) signed with the stolen Simon Tatham COMODO RSA Code Signing CA certificate, distributed as INQUIRY.exe. VS_VERSIONINFO masquerades as lodctr / Microsoft Corporation / 99.99.99.99. Contains two unrelated benign student projects (Pacman game + WinForms calculator) merged into one assembly. No malicious payload, no network APIs, no persistence. Fifth confirmed sibling in the stolen-Tatham-cert cluster. Static-only analysis. ^[/intel/analyses/b4814a1725a288805097151348d07a8322d14ced20eb5137fbf368d245fe6c68.html]

Capabilities

  • dotnet-native-ilc-file-manager-masquerade — .NET Native / ILC compiled WinForms dual-pane file manager (FManagerApp) with FileSystemWatcher live refresh, assembly-reflection browser (ShowAssemblyForm), and purchase-order lure distribution. No malicious payload. ^[/intel/analyses/b760c6f2383e05037e5a71b4a39e2e333504d37f81d15116a2bed45eac537feb.html]

  • dotnet-aes-csp-overlay-loader — AesCryptoServiceProvider + raw file overlay + reflective Assembly.Load + AMSI bypass. Fourth confirmed sibling in unclassified-dotnet-crypter-loader family (673e6738). ^[/intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html]

  • stolen-authenticode-certificate-signing — COMODO RSA Code Signing CA chain, CN=Simon Tatham (PuTTY developer) ^[/intel/analyses/eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a.html] ^[/intel/analyses/b4814a1725a288805097151348d07a8322d14ced20eb5137fbf368d245fe6c68.html]

  • version-info-masquerade — FileDescription: WpfUI, InternalName: zOYY.exe, ProductName: WpfUI vs distribution filename PAYMENT_CANCELLED_AND_RETURNED.PDF.exe ^[/intel/analyses/eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a.html] ^[/intel/analyses/b4814a1725a288805097151348d07a8322d14ced20eb5137fbf368d245fe6c68.html]

  • social-engineering-filename-lure — payment/invoice-themed filenames (DHL shipping, payment cancelled, bank advice, inquiry) ^[/intel/analyses/e7aaacbb08fd0702c552169ce55065e51e1cfb55404509851592c3019fb15927.html] ^[/intel/analyses/eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a.html] ^[/intel/analyses/b4814a1725a288805097151348d07a8322d14ced20eb5137fbf368d245fe6c68.html]

  • no-malicious-payload — benign application repackaged; no network, injection, or persistence APIs

  • winhttp-download-https — WinHTTP P/Invoke downloader with runtime-resolved URL ^[/intel/analyses/f3bc22f69502ed934da8dea7940437e820e1c778016e330a28b1103b6ca247b1.html]

  • reflective-assembly-delegate-execution — .NET delegate chain (JobDelegate.Invoke) to execute decrypted payload ^[/intel/analyses/f3bc22f69502ed934da8dea7940437e820e1c778016e330a28b1103b6ca247b1.html]

  • runtime-payload-decryption — EncryptionHelper.Decrypt on downloaded bytes with static-constructor key initialisation ^[/intel/analyses/f3bc22f69502ed934da8dea7940437e820e1c778016e330a28b1103b6ca247b1.html]

  • legitimate-library-masquerade — clones real open-source project identity (TransMock) including copyright, description, and version info ^[/intel/analyses/f3bc22f69502ed934da8dea7940437e820e1c778016e330a28b1103b6ca247b1.html]

  • semantic-jargon-class-name-camouflage — syntactically valid but meaningless class names (CrewPickupSM, ScopeFpgaI2c, ClimbParadise) to slow analyst review ^[/intel/analyses/f3bc22f69502ed934da8dea7940437e820e1c778016e330a28b1103b6ca247b1.html]

  • dotnet-nmodbus-embedded-ics-protocol — Full NModbus .NET library embedded for Modbus/TCP/RTU/ASCII industrial protocol communication; first ICS-capable .NET sample in corpus ^[/intel/analyses/c62e2921e5c70fe3d9ba453a1a622f18ec6dd9d449bfb0640e6332fba6a34f2e.html]

  • tripledeshmac-payload-decryption — TripleDESCryptoServiceProvider + Base64 embedded payload (232 bytes decoded); key likely runtime-derived ^[/intel/analyses/c62e2921e5c70fe3d9ba453a1a622f18ec6dd9d449bfb0640e6332fba6a34f2e.html]

  • embedded-sha256-integrity-hash — Hardcoded 64-character SHA256 hex string in #Strings metadata stream; purpose unknown (integrity check, license validation, or companion-payload hash). Shared across e04d46ff and 9a40908c (FSC UI siblings). ^[/intel/analyses/e04d46ff3726afd45a2181347c64b088f9500d242eda127959a1462daa4db84e.html] ^[/intel/analyses/9a40908c3212dd34fd907ff66893537537adce8f136379baf98269158948a2e9.html]

  • fsc-ui-winforms-library-masquerade — Fabian Schlüter's FSC UI custom WinForms themable control library (FSCButton, FSCToggle, FSCPanel, ThemeLoader, ThemeBuilder) repackaged with social-engineering filenames (QUOTE and CV lures). Internal names auto-generated as nonsense strings (NZiU, Zfio). Open-source origin confirmed on GitHub (Fabian2000/FSC-UI). Static-only analysis. ^[/intel/analyses/e04d46ff3726afd45a2181347c64b088f9500d242eda127959a1462daa4db84e.html] ^[/intel/analyses/9a40908c3212dd34fd907ff66893537537adce8f136379baf98269158948a2e9.html]

  • debug-build-compiler-attribute-false-positives — Capa T1620/T1497.001 flags from DebuggerBrowsableState/DebuggableAttribute in Debug-configuration .NET builds ^[/intel/analyses/e04d46ff3726afd45a2181347c64b088f9500d242eda127959a1462daa4db84e.html] ^[/intel/analyses/b4814a1725a288805097151348d07a8322d14ced20eb5137fbf368d245fe6c68.html]

  • spanish-educational-app-masquerade — PrimeraVentana namespace WinForms educational programming exercise repackaged with social-engineering filenames; identical class structure across siblings c4ee3a31081d, cae7ac1dc419, a42443c8 ^[/intel/analyses/a42443c84fc9ec4a4f00c4363eee5074e94cfbb286a48fcbd33496dbbf0f5455.html]

  • tcp-socket-server-mode — Capa-detected TCP server start + socket creation; possibly Modbus slave mode or reverse-listener C2 ^[/intel/analyses/c62e2921e5c70fe3d9ba453a1a622f18ec6dd9d449bfb0640e6332fba6a34f2e.html]

  • aes-managed-payload-decryption — AesManaged + CreateDecryptor with hardcoded or runtime-derived key ^[/intel/analyses/a9b5e7469c35f0cd7da326f9894d002a8bbe77377a11bbc03551dcbadab3b47a.html]

  • amsi-api-bypass — References to AmsiOpenSession and AmsiScanBuffer suggest AMSI patch/disable intent ^[/intel/analyses/a9b5e7469c35f0cd7da326f9894d002a8bbe77377a11bbc03551dcbadab3b47a.html]

  • clipboard-hijack-ole-com — Full IDataObject / GetText / SetText OLE COM interop surface for clipboard manipulation ^[/intel/analyses/a9b5e7469c35f0cd7da326f9894d002a8bbe77377a11bbc03551dcbadab3b47a.html]

  • console-hide-freeconsole — FreeConsole P/Invoke to detach from parent console window ^[/intel/analyses/a9b5e7469c35f0cd7da326f9894d002a8bbe77377a11bbc03551dcbadab3b47a.html]

  • spanish-rpg-character-generator-masquerade — ejemplo namespace WinForms RPG character generator (Elf/Human/Vampire races, MDI forms, Spanish UI) repackaged with purchase-order filename and fabricated Microsoft Corporation / Thumbnail Handler version info ^[/intel/analyses/ad301389152cb26900d3c06ea4f604dec119bf566b2f49dcdfdc21c658574420.html] ^[/intel/analyses/644892e9fe96231990ad8095237bafee16d1fb77aadde35cd20105cef5f4b922.html]

  • brazilian-csharp-courseware-masquerade — TestesWindowsForms namespace WinForms Brazilian C# coursework (calculator, CEP lookup, password form, JSON database) repackaged with Indonesian banking-themed filename Slip_Pembayaran.exe. No malicious payload. Capa T1620 / MBC HTTP false positives from benign HttpWebRequest to public viacep.com.br API. ^[/intel/analyses/b094a2b61576904f86948cebe5b0d49198f0da3b6a851574f9fede93bef28285.html]

  • golden-city-winforms-game-masquerade — .NET Framework 4.0 WinForms Spanish city-building game (GoldenCity namespace, Models.Bandits, Models.Building, Models.Maps) repackaged with purchase-order double-extension filename PO-000002168.pdf.exe. No malicious payload. Confirmed sibling to 61c10411 (PrimeraVentana) via identical Adobe Reader VS_VERSIONINFO masquerade. ^[/intel/analyses/92de82423ad9fbbae32673ebf26710b8fbfae04b09bcf678d46ff8bf0512ae6a.html]

  • adobe-reader-version-info-masquerade — Cloned Adobe Reader VS_VERSIONINFO: FileDescription: Adobe Reader, CompanyName: Microsoft Corporation., ProductName: Microsoft PDF Document, OriginalFilename: AcroRd32.exe. Observed in 92de8242 (GoldenCity game) and 61c10411 (PrimeraVentana educational app). ^[/intel/analyses/92de82423ad9fbbae32673ebf26710b8fbfae04b09bcf678d46ff8bf0512ae6a.html]

  • double-extension-masquerade — .pdf.exe filename extension abuse to bypass Windows "Hide extensions" default ^[/intel/analyses/92de82423ad9fbbae32673ebf26710b8fbfae04b09bcf678d46ff8bf0512ae6a.html]

  • dual-namespace-benign-merger — Two unrelated .NET projects (Pacman game + calculator) merged into a single assembly with no inter-namespace communication; suggests student portfolio or coursework mashup ^[/intel/analyses/b4814a1725a288805097151348d07a8322d14ced20eb5137fbf368d245fe6c68.html]

  • multiple-embedded-png-resources — Game sprites and UI elements stored as embedded PNG bitmap resources in .rsrc ^[/intel/analyses/b4814a1725a288805097151348d07a8322d14ced20eb5137fbf368d245fe6c68.html]

  • 8d4d4300 — .NET Framework 4.0 WinForms node-graph editor (visual drag/drop canvas with nodes, connectors, and grid rendering) distributed as xrxMWJpak7E4F5Z.exe with random-noise filename. No packing, no obfuscation, no network APIs, no persistence, no anti-analysis. Capa failed on CLR metadata parse (dnfile assertion); floss errored on invocation. Binwalk found embedded 523×523 PNG icon, Zlib .resources blob, and standard UAC manifest. PDB path tCsX.pdb. radare2 found 95 standard .NET method stubs. Assessed benign / false-positive MalwareBazaar ingestion. Static-only (no CAPE Windows guest). ^[/intel/analyses/8d4d4300ccd2a35176ae855d35ad12cf1b4962b3c5ae0464c7bdd03ddd96b7a5.html]

724d94aa — .NET Framework 4.0 WinForms calculator (AdvWinProgHW2 namespace, pKDK.exe, v2.0.0.781) repackaged as uZdFE99gyouWC1t.exe (random-noise filename). Signed with stolen Simon Tatham COMODO RSA certificate; VS_VERSIONINFO masquerades as Adobe Reader. Contains Trif32 decoder shared with PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint clusters. No malicious payload. Static-only. ^[/intel/analyses/724d94aa2eb7c09cdd8eca00e68017b430fe332c68a2201b5e308fe04715c545.html]

  • 72c4217f — .NET Framework 4.0 WinForms Croatian-language cryptography coursework GUI (ProjektOS namespace, tFQK.exe, v1.0.0.0) implementing AES symmetric encryption, RSA asymmetric encryption/digital signatures, and SHA256 hashing. Distributed as SSLOS2024070909.exe with Microsoft-themed version-info masquerade. No network APIs, no persistence, no anti-analysis. Capa T1140/T1027/T1620/T1083 flags are false positives from benign CryptoStream/OpenFileDialog usage. Assessed as benign student project repackaged for social-engineering distribution. Unsigned. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/72c4217f1a8af0b6fbaaaefb60783c78600019aab33c1f1ecae022fa995cff7e.html]

Notable Analyses (continued)

  • c62e2921 — .NET Framework PE32 (shipping_doc.exe, Aug 2024 build) with embedded NModbus ICS protocol library, TripleDESCryptoServiceProvider, 232-byte Base64 encrypted payload, and capa-detected reflective assembly loading. No hardcoded C2. First ICS-targeting .NET sample in corpus. Static-only analysis. ^[/intel/analyses/c62e2921e5c70fe3d9ba453a1a622f18ec6dd9d449bfb0640e6332fba6a34f2e.html]

  • c9db49c9 — Forty-second confirmed sibling. .NET Framework 4.0 WinForms phone/locker management simulation coursework app (datalock.exe internal name, DETAILED_INVOICES.exe distribution filename). VS_VERSIONINFO masquerades as datalock / Copyright 2024. Classes: PhoneUI, LockerSystem, LockerManager, CallLogger, ShoppingCart, School, Student, Pennington, Rueben, Morrow. Contains System.Security.Cryptography and System.Security.Permissions references from student cryptography exercise — no payload encryption layer. No System.Net, no P/Invoke, no persistence, no anti-analysis, no packing. Capa T1620/B0013.001 are false positives from Debug-build DebuggerNonUserCodeAttribute/DebuggableAttribute. Unsigned, future-dated PE timestamp 2060. IL linker v48.0 (.NET Native/ILC) compiler. FLOSS triage invocation failed on CLI argument error. Threat is purely social-engineering masquerade. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/c9db49c9cc19516d4a95548d1ce4ce1f36df8c40e690c14bcb547ddb1e789bb1.html]

  • 673e6738 — .NET Framework 4.0+ PE32+ x64 AES-CSP raw overlay loader (нова_поръчка_pdf.exe, compiled Jul 2024). ~2.1 MB encrypted overlay with 19-byte magic delimiter 5YHKDOtYsVE2kKl2Ok. AMSI bypass via Get_AmsiScanBuffer_Byte + ModifyMemory + VirtualProtect. Distinctive developer method names (Fatetpopet2, HolyDamn, FuckUpAgain, ToPutt, ComplementaryStrings). CompileToAssembly/CacheCode suggest compiled script payload rather than raw PE. No hardcoded C2. Fourth confirmed sibling in unclassified-dotnet-crypter-loader family. Static-only (no CAPE Windows guest). ^[/intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html]

  • bd60fe2a — .NET Framework 4.0 PE32 x86 assembly bundling three distinct projects: BinaryTutorial (binary-counting educational game), RemoteWget (SSH-based file-transfer utility using Renci.SshNet), and JSCombiner.Engine (JavaScript file combiner). Distributed as RFQ_PETROFAC_PM-C-24-4400.exe (industrial RFQ social-engineering lure). VS_VERSIONINFO masquerades as Toshiba / Remote Binary / Practice Binary. Internal name OdOg.exe. No packing, no obfuscation, no malicious payload. Capa T1620/T1059.001 are false positives from Debug-build compiler attributes and LateBinding dispatch. Static-only analysis. ^[/intel/analyses/bd60fe2a6da189779fb4bab503be814e0bcb503f20aee28ea4e989b156d8f08d.html]

  • 3c9f96db — .NET Framework 4.0 WinForms charting/student-evaluation app (Chart namespace, OkuZ.exe, v1.0.0.0) distributed as PO781000885.exe (purchase-order social-engineering lure). Contains Chart.Models.Student class with Id, Name, Age, MathPoint, PhysicalPoint, ChemistryPoint properties; Chart.DataSet1 typed dataset; Chart.frmMain and Chart.FrmStep forms; Chart.Properties.Resources.get_orhi resource accessor. Hardcoded 64-character SHA256 hex string (238824D56AFD56162E5F061ECB898DD852A546A6D203EE032C6C40F4B4770AE9) in #Strings metadata — purpose unknown, not self-referential, no corpus match. VS_VERSIONINFO masquerades as SUD Control / Microsoft Corporation / Copyright 2020. No System.Net, no System.Security, no P/Invoke, no persistence, no anti-analysis, no packing. Capa T1620/B0013.001 are false positives from Debug-build compiler-generated attributes. Threat is purely social-engineering masquerade. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/3c9f96db10be4b69eb71ed27ecea954f721347bee8a310fa25d9a0ee2a0c57dd.html]

  • 92de8242 — .NET Framework 4.0 WinForms GoldenCity game (bXyH.exe, v1.0.0.0) distributed as PO-000002168.pdf.exe (double-extension masquerade). VS_VERSIONINFO masquerades as Adobe Reader / Microsoft PDF Document / AcroRd32.exe. Contains Spanish UI strings (Ciudad, Edificios, Bandidos) and game classes (Models.Bandits, Models.Building, Models.Maps). Confirmed sibling to 61c10411 (same Adobe Reader VS_VERSIONINFO masquerade). No malicious payload, no network APIs, no persistence. Capa T1620/C0021.003 are false positives from standard .NET JIT and WinForms resource accessors. Unsigned. Static-only analysis. ^[/intel/analyses/92de82423ad9fbbae32673ebf26710b8fbfae04b09bcf678d46ff8bf0512ae6a.html]

  • 6bc4e16d — .NET Framework 4.0 WinForms vector-drawing application (MyPaint.Editor namespace, AwrU.exe, v1.0.0.0) repackaged as PURCHASE_ORDER-6350.exe. Contains Trif32 Caesar-shift-23 decoder (shared with PrimeraVentana/GoldenCity clusters), GraphicTool, Point2D, FileManager classes, and standard paint-canvas UI (pictureBoxPaint, panelOriginPicker, tbConsole). No malicious payload, no network APIs, no persistence. Capa T1620/T1083 are false positives from Debug-build compiler attributes and file-dialog usage. Threat is purely social-engineering masquerade. Unsigned. Static-only analysis. ^[/intel/analyses/6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b.html]

  • 37d7de16 — Second confirmed sibling of 6bc4e16d. Identical .NET Framework 4.0 WinForms vector-drawing application (MyPaint.Editor namespace, YvNg.exe, v1.0.0.0) repackaged as Quotation.exe. Same Trif32 Caesar-shift-23 decoder, same GraphicTool/Point2D/FileManager class hierarchy, same paint-canvas UI. Size +257 KB (930 KB vs 673 KB) due to larger 588×588 splash PNG replacing the 509×509 splash in the prior sibling. One additional CIL method (get_XPct). No malicious payload, no network APIs, no persistence. Capa T1620/T1083 are false positives. Unsigned. Static-only analysis. ^[/intel/analyses/37d7de1665e2b4fce2a0781f513037bd5aaa0bc0358e63df5bac07d13c302996.html]

  • 6d114209 — .NET Framework 4.0 WinForms paint editor (Ivanov_WF_Paint namespace, fiwi.exe, v1.0.0.0) repackaged as New_order.exe. Contains Trif32 decoder shared with PrimeraVentana/GoldenCity/MyPaint.Editor clusters. No malicious payload, no network APIs, no persistence. VS_VERSIONINFO masquerades as Microsoft Script Host. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated. ^[/intel/analyses/6d1142097d69b5d05cb3774ad591d53ab7759222ed8b563042121321b84db577.html]

  • 724d94aa — .NET Framework 4.0 WinForms calculator (AdvWinProgHW2 namespace, pKDK.exe, v2.0.0.781) repackaged as uZdFE99gyouWC1t.exe (random-noise filename). Signed with the same stolen Simon Tatham COMODO RSA Code Signing CA certificate as eea0dcbc/c4ee3a31081d/cae7ac1dc419/a1e6dc7a/b4814a17. VS_VERSIONINFO masquerades as Adobe Reader / Microsoft PDF Document / pKDK.exe. Contains Trif32 Caesar-shift-23 decoder shared with PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint clusters. Multi-form calculator with login dialog, preferences dialog, oath form, and colour picker. No malicious payload, no network APIs, no persistence. Capa T1620/B0013.001 false positives from Debug-build compiler attributes. Sixth confirmed sibling in the stolen-Tatham-cert cluster. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated. ^[/intel/analyses/724d94aa2eb7c09cdd8eca00e68017b430fe332c68a2201b5e308fe04715c545.html]

  • 72d8e3b2 — .NET Framework 4.0 WinForms k-means clustering visualization GUI (kmc namespace, HbxE.exe, v1.0.0.0) signed with the same stolen Simon Tatham COMODO RSA Code Signing CA certificate, distributed as RE_GOVT_OF_SHARJAH__UNIVERSITY_OF_SHARJAH_-_Project_0238.exe (government/university research project lure). Implements interactive Lloyd algorithm with parallel point assignment, random centroid initialization, and gradient visualization. No packing, no obfuscation, no network APIs, no persistence. Capa T1620/C0021.003/B0013.001 are false positives from Debug-build compiler attributes and System.Random/GetCurrentThread usage. Eighth confirmed sibling in the stolen-Tatham-cert cluster. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/72d8e3b25d5076a52640aca8d8e05fe629e8784d5fadbc533d4db50f0ae5aa70.html]

  • 7a310c85 — .NET Framework 4.0 WinForms karate-dojo CRM (KarateClubBusinessLayer / hovF.exe, v1.0.0.0) repackaged as Purchase_Order.exe. Full three-layer architecture (Presentation / Business / Data Access) with 20+ WinForms dialogs, SQL Server connectivity (SqlConnection, SqlCommand), member/subscription/payment/belt-rank management modules, and a 468×468 PNG application icon. No packing, no obfuscation, no network APIs, no persistence. Capa T1620/T1213/B0013.001 are false positives from standard .NET Debug-build attributes and System.Data.SqlClient references in a database-querying CRM. Unsigned. PDB hovF.pdb, future-dated timestamp 2044. Threat is purely social-engineering masquerade. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/7a310c85d3a3334c4e715402d09355dda340e0e32f784eab626e4ab1a7aff321.html]

  • 529fa495 — Second confirmed sibling of the Karate_Club CRM cluster. Same .NET Framework 4.0 WinForms karate-dojo management application (identical namespace/class hierarchy to 7a310c85) but with internal name VvDt.exe, no PDB, and distribution filename PO.366786-K0001388089465.xlsx.exe — a .xlsx.exe double-extension masquerade higher-fidelity than the prior sibling's plain .exe. Plausible timestamp 2024-07-10. No packing, no obfuscation, no network APIs, no persistence, no anti-analysis. Capa T1620/T1083 are false positives from standard .NET Reflection and System.IO patterns. Threat is purely social-engineering masquerade. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/529fa4957fea8e29e7f990cb261dbe876040b5c30ffb4b9d58288d146e67dfb4.html]

  • 7b3ef687 — .NET Framework 4.0 WinForms Brazilian pizza-shop POS/CRM (Pizzaria_Management_VIEW / DzAz.exe / products-list.exe, v6.0.0.0, Jul 2024 build). Standard System.Data.SqlClient SQL Server backend with ClienteDAL data-access layer. Portuguese-language UI (pedido, produto, funcionário, estoque, cadastro, gerenciamento). Embedded PNG menu icons. Trif32 trivial decoder shared with PrimeraVentana/GoldenCity cluster. No packing, no obfuscation, no network APIs, no persistence. Capa T1213/T1620/B0013.001 are false positives. Unsigned. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/7b3ef6871b0c4d64dd7fd96937c190763fae58bd560131b96dbc9ef860c75e54.html]

  • 5ea6b79d — Second confirmed sibling of 7b3ef687. Identical pizza-shop POS/CRM (Pizzaria_Management_VIEW namespace, Yhdk.exe internal name, 52oTaV20K4bWnvN.exe distribution filename, v2.0.0.781). Same Portuguese UI, ClienteDAL, Trif32 decoder, embedded PNG icons. Signed with stolen Simon Tatham (PuTTY) COMODO RSA Code Signing CA certificate — ninth confirmed sibling in the stolen-Tatham-cert cluster. VS_VERSIONINFO masquerades as Adobe Reader / Microsoft PDF Document. Same capa false-positive profile. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/5ea6b79d0efa5db5514fb0eb7f6307d35e504425a3af39bd226c22ac39121603.html]

  • 0a0a24fc — Tenth confirmed sibling in the stolen-Tatham-cert cluster. .NET Framework 4.0 WinForms Polish-language stock-charting / technical-analysis application (GAD_HW2 namespace, fCGm.exe internal name, payment_Slip.exe distribution filename). Candlestick/HiLoOpenClose plotting, CSV import, moving-average overlays, MojeOkienko custom window helper. Contains Trif32 Caesar-shift-23 decoder shared with PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint/AdvWinProgHW2/Paint/Lab4CSharp/Pizzaria/Checkers/Hadouken/OkuZ/Inheritance/JapaneseTrainer clusters. VS_VERSIONINFO masquerades as pdf / microsoft / exel / zip. No System.Net, no P/Invoke, no persistence, no anti-analysis. Capa T1620/B0013.001 false positives from Debug-build compiler attributes. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/0a0a24fc88ba87cd8c77b6a493547b2dc780f60df1838e7b0ddcc87bb1277680.html]

  • 5bf25358 — .NET Framework 4.0 WinForms Turkish-language Monopoly board game (MonopolyGame namespace, falD.exe, v1.0.0.0). Full Entity Framework MonopolyDB EDMX model with SQL Server LocalDB persistence, NetComm TCP multiplayer networking, Newtonsoft.Json serialization, Turkish UI strings (zar, tapu, piyon, oyuncu, hapisahenedeMi, ipotekliMi). Contains Trif32 Caesar-shift-23 decoder shared with PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint/AdvWinProgHW2/Paint/Lab4CSharp/Pizzaria/Checkers/Hadouken/OkuZ/Inheritance/JapaneseTrainer clusters. Distributed as SALES_ORDER.pdf.exe (.pdf.exe double-extension masquerade). No malicious payload, no external C2, no persistence, no anti-analysis. Capa zero meaningful matches (only dnfile parser structural warnings). Unsigned. Threat is purely social-engineering masquerade. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/5bf25358184f7ddd5da889cee29f7adb0f8db9aa9c130b8c83a93f616919fb9d.html]

  • 5e34f10a — .NET Framework 4.0 WinForms Spanish-language student-evaluation CRUD app (Evaluacion namespace, iAQe.exe, v1.0.0.0) with 16 WinForms .resources files, System.Data.SqlClient backend, hardcoded SQL Server connection string (Data Source=server;Initial Catalog=School; User ID=SalonAlba;Password=Salon360Ba), and plaintext password authentication (no hashing). Distributed as PO#82924A.exe (purchase-order social-engineering lure). No P/Invoke, no obfuscation, no network APIs, no persistence. Capa T1620 (Reflective Code Loading) and B0013.001 are false positives from DebuggerBrowsableAttribute and DebuggableAttribute in Debug-build metadata — same pattern as 20+ other samples in this cluster. Unsigned, fabricated future-dated timestamp 2043. Threat is purely social-engineering masquerade. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/5e34f10aad66da3d4137e4cc4ce01ac33922d427141666bfa4a6f8ec6d181bf5.html]

  • 0e9cc5f81798 — Second confirmed sibling of 5e34f10a. .NET Framework 4.0 WinForms Spanish-language student-evaluation CRUD app (Evaluacion namespace, SjbQ.exe internal name, SjbQ.pdb, v2.0.0.781) with 21 WinForms .resources files, System.Data.SqlClient backend, and standard CRUD operations (guardar, Limpiar, LlenarCbo, LlenarEst). Signed with stolen Simon Tatham (PuTTY) COMODO RSA Code Signing CA certificate — eleventh confirmed sibling in the stolen-Tatham-cert cluster. VS_VERSIONINFO masquerades as Adobe Reader / Microsoft PDF Document / SjbQ.exe. Distributed as NewXOrder_00200457.exe (purchase-order social-engineering lure). 46 KB larger than sibling 5e34f10a (812 KB vs 766 KB) due to five additional .resources files (GSeccion, LSeccion, MSeccion, LUsuario, MUsuario, MLogin). No System.Net, no P/Invoke, no persistence, no anti-analysis, no packing. Capa T1620/B0013.001 are false positives from Debug-build compiler attributes. Threat is purely social-engineering masquerade. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/0e9cc5f817989d3f415dbe505b11bc79e34cf32e98ed16e14e1bd40f35b0724d.html]

  • 4f79aee0

  • 5335da6d — .NET Framework 4.0 WinForms paint/drawing application (Paint namespace, wvIf.exe, internal name). Distributed as QUOTE-2K840322-A-CCC.exe (business-document quote lure). Contains Trif32 Caesar-shift-23 decoder shared with PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint/AdvWinProgHW2 clusters. Classes include MainForm, NewImageDialog, LineStyleChoicer, HatchChoicer, LineWidthChoicer, ColorChoicer, IShape, ShapeException, BufferedGraphics. GDI+ canvas with pen/line/rectangle/ellipse/fill/text tools, line-style/hatch/width/colour choosers, zoom, and BMP/JPEG/PNG/GIF save/load. No packing, no obfuscation, no network APIs, no persistence, no anti-analysis. Unsigned. Capa T1620/B0013.001 false positives from Debug-build compiler attributes. Threat is purely social-engineering masquerade. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/5335da6d96c3dbf74623c5ec6374b8bd7b95966e3a40a4d37347984a7c17d029.html]

  • 54956960 — .NET Framework 4.0 WinForms picture-viewer / basic image-editor lab (Lab4CSharp namespace, srza.exe, v8.4.1.1) distributed as CV_Forner_Eugenia.exe (curriculum-vitae social-engineering lure). VS_VERSIONINFO masquerades as LabSharp / PictureViewer. Contains Trif32 Caesar-shift-23 decoder shared with PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint/AdvWinProgHW2/Pizzaria/Checkers/Hadouken/Paint clusters. Standard WinForms toolbox surface (PictureBox, MenuStrip, ToolStrip, ColorDialog, OpenFileDialog, SaveFileDialog, Timer1). Drawing primitives (FillRectangle, DrawEllipse, FillPolygon). No packing, no obfuscation, no network APIs, no persistence. Capa T1620/T1083/C0021.003/B0013.001 false positives from Debug-build compiler attributes and standard .NET reflection/file-dialog usage. Threat is purely social-engineering masquerade. Unsigned. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/549569602f3994b3b7058689b193a28d568cff27d4bbdfcfd527c36890579884.html]

Capabilities (continued)

  • rfq-industrial-lure-masquerade — Request-for-Quotation themed filename targeting oilfield services (RFQ_PETROFAC_PM-C-24-4400.exe) ^[/intel/analyses/bd60fe2a6da189779fb4bab503be814e0bcb503f20aee28ea4e989b156d8f08d.html]

  • ssh-remote-wget-utility — Benign Renci.SshNet-based WinForms remote file-transfer tool with SshClient, PasswordAuthenticationMethod, RunCommand ^[/intel/analyses/bd60fe2a6da189779fb4bab503be814e0bcb503f20aee28ea4e989b156d8f08d.html]

  • js-combiner-engine — JavaScript file combiner/minifier with ReferenceGraph, IncludePath, CrawlDirectory, GrabAllReferenced ^[/intel/analyses/bd60fe2a6da189779fb4bab503be814e0bcb503f20aee28ea4e989b156d8f08d.html]

  • binary-tutorial-educational-game — WinForms binary-counting tutorial with practiceModeToolStripMenuItem, getNewRandomNumber, submitAnswer ^[/intel/analyses/bd60fe2a6da189779fb4bab503be814e0bcb503f20aee28ea4e989b156d8f08d.html]

  • debug-build-capa-false-positives — DebuggerNonUserCodeAttribute / DebuggableAttribute triggering T1620 and T1059.001 in capa ^[/intel/analyses/bd60fe2a6da189779fb4bab503be814e0bcb503f20aee28ea4e989b156d8f08d.html]

  • no-malicious-payload-multiproject-bundle — Three unrelated .NET projects merged into one assembly; no network APIs beyond SSH client library, no persistence, no anti-analysis ^[/intel/analyses/bd60fe2a6da189779fb4bab503be814e0bcb503f20aee28ea4e989b156d8f08d.html]

  • purchase-order-social-engineering-lure — Filename PURCHASE_ORDER-6350.exe targeting finance/procurement employees ^[/intel/analyses/6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b.html]

  • quotation-social-engineering-lure — Filename Quotation.exe targeting business-document recipients; sibling to purchase-order-social-engineering-lure with identical MyPaint.Editor payload ^[/intel/analyses/37d7de1665e2b4fce2a0781f513037bd5aaa0bc0358e63df5bac07d13c302996.html]

  • winforms-vector-drawing-editor — MyPaint.Editor / MyPaint.Bussiness namespaces with GDI+ shape primitives, undo/redo, JSON serialization ^[/intel/analyses/6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b.html]

  • trif32-caesar-shift-23-decoder — Shared benign coursework utility class with PrimeraVentana/GoldenCity clusters ^[/intel/analyses/6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b.html] ^[/intel/analyses/4cce5506593907c3db78282849ed41729ca7cf737e1d38cb82dc10e27d92ff16.html]

  • debug-build-capa-false-positives — DebuggerNonUserCodeAttribute / DebuggableAttribute triggering T1620 (reflective loading) and T1083 (file enumeration) ^[/intel/analyses/6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b.html] ^[/intel/analyses/4cce5506593907c3db78282849ed41729ca7cf737e1d38cb82dc10e27d92ff16.html]

  • no-malicious-payload — Zero network/process/registry/crypto APIs; benign application repackaged for social engineering ^[/intel/analyses/6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b.html] ^[/intel/analyses/4cce5506593907c3db78282849ed41729ca7cf737e1d38cb82dc10e27d92ff16.html]

  • resource-embedded-png-toolbar-icons — Eight 16×16 PNG toolbar icons, 131×131 bitmap, 509×509 splash image in .rsrc ^[/intel/analyses/6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b.html]

  • json-serialization-drawing-export — SaveInJsonFormat / OpenDrawingFromJson vector serialization ^[/intel/analyses/6bc4e16d2deeb49df52531f835be8c1d89e2b8f7c347b44409b6d1c9826ced2b.html]

  • ivanov-wf-paint-winforms-editor — Ivanov_WF_Paint namespace with GDI+ shape primitives, layer management, XML/JPEG export, and Trif32 decoder ^[/intel/analyses/6d1142097d69b5d05cb3774ad591d53ab7759222ed8b563042121321b84db577.html]

  • microsoft-script-host-version-info-masquerade — FileDescription: Script Host, CompanyName: Microsoft Corporation., InternalName: fiwi.exe ^[/intel/analyses/6d1142097d69b5d05cb3774ad591d53ab7759222ed8b563042121321b84db577.html]

  • advwinprog-calculator-masquerade — .NET Framework 4.0 WinForms calculator (AdvWinProgHW2 namespace, pKDK.exe, v2.0.0.781) with login dialog, preferences dialog, oath form, colour picker, and Trif32 decoder. Signed with stolen Simon Tatham COMODO RSA certificate, VS_VERSIONINFO masquerades as Adobe Reader / Microsoft PDF Document. No malicious payload. ^[/intel/analyses/724d94aa2eb7c09cdd8eca00e68017b430fe332c68a2201b5e308fe04715c545.html]

  • croatian-cryptography-coursework-gui — .NET Framework 4.0 WinForms AES/RSA/SHA256 GUI (ProjektOS namespace, tFQK.exe, v1.0.0.0) with Croatian UI strings (Dekriptiraj, Enkriptiraj, DigitalniPotpis, NovaDatoteka). Distributed as SSLOS2024070909.exe with Microsoft-themed version-info masquerade. No malicious payload. ^[/intel/analyses/72c4217f1a8af0b6fbaaaefb60783c78600019aab33c1f1ecae022fa995cff7e.html]

  • kmeans-clustering-winforms-gui-masquerade — .NET Framework 4.0 WinForms k-means clustering visualization (kmc namespace, HbxE.exe, v1.0.0.0) with Lloyd algorithm, parallel point assignment, centroid gradient rendering. No malicious payload. ^[/intel/analyses/72d8e3b25d5076a52640aca8d8e05fe629e8784d5fadbc533d4db50f0ae5aa70.html]

  • university-research-project-filename-lure — Government/university-themed social-engineering lure (RE_GOVT_OF_SHARJAH__UNIVERSITY_OF_SHARJAH_-_Project_0238.exe) ^[/intel/analyses/72d8e3b25d5076a52640aca8d8e05fe629e8784d5fadbc533d4db50f0ae5aa70.html]

  • karate-club-crm-masquerade — .NET Framework 4.0 WinForms karate-dojo management CRM (KarateClubBusinessLayer / hovF.exe) with member login, belt-rank management, subscription tracking, payment records, and instructor assignments. Repackaged as Purchase_Order.exe. No malicious payload. ^[/intel/analyses/7a310c85d3a3334c4e715402d09355dda340e0e32f784eab626e4ab1a7aff321.html]

  • brazilian-pizza-pos-crm-masquerade — .NET Framework 4.0 WinForms pizza-restaurant POS/CRM (Pizzaria_Management_VIEW / DzAz.exe) with SQL Server ADO.NET backend (ClienteDAL), Portuguese-language UI, MDI WinForms with menu tabs for orders/products/stock/employees, and embedded PNG menu icons. Distributed as products-list.exe. No malicious payload. ^[/intel/analyses/7b3ef6871b0c4d64dd7fd96937c190763fae58bd560131b96dbc9ef860c75e54.html]

  • brazilian-pizza-pos-crm-stolen-tatham-cert — Second confirmed sibling of 7b3ef687. Identical functionality but signed with stolen Simon Tatham COMODO RSA Code Signing CA certificate and masquerading as Adobe Reader / Microsoft PDF Document. Distribution filename 52oTaV20K4bWnvN.exe, internal name Yhdk.exe. No malicious payload. ^[/intel/analyses/5ea6b79d0efa5db5514fb0eb7f6307d35e504425a3af39bd226c22ac39121603.html]

  • brazilian-pizza-pos-crm-third-sibling — Third confirmed sibling of 7b3ef687 / 5ea6b79d. Identical pizza-shop POS/CRM (Pizzaria_Management_VIEW namespace, Euiz.exe internal name, PO#86637_copy.exe distribution filename, v6.0.0.0). Same Portuguese UI, ClienteDAL, Trif32 decoder, embedded PNG icons. Unsigned (not part of stolen-Tatham-cert cluster). VS_VERSIONINFO unchanged (Pizzaria VIEW / Valey Silicone). Same capa false-positive profile. Threat is purely social-engineering masquerade. ^[/intel/analyses/000d931f8f76a4fc9ba255cbc972e03f58d3e49bcdd6008094ac0dc2e4fe25a6.html]

  • transponer-boulloart-crypter-loader — Sixth confirmed sibling of unclassified-dotnet-crypter-loader family (5f54948e). AES-CSP raw overlay loader with E2RGfIgBr2yorOvHv0c1R1zXtD overlay magic, PO_CW00402902400429.exe purchase-order lure, "Transponer" / "Boulloart" VS_VERSIONINFO masquerade, and Unicode control-character / Hangul jamo CIL name obfuscation. ^[/intel/analyses/5f54948ef4ea19feac07408f4109df54c07137d35b34804250cd20eeccfcd254.html]

  • debug-build-capa-false-positives — DebuggerBrowsableAttribute / DebuggableAttribute triggering T1620 (reflective loading) and T1213 (data from info repositories) in capa when analyzing .NET Debug-build CRM applications ^[/intel/analyses/7a310c85d3a3334c4e715402d09355dda340e0e32f784eab626e4ab1a7aff321.html] ^[/intel/analyses/4cce5506593907c3db78282849ed41729ca7cf737e1d38cb82dc10e27d92ff16.html] spanish-student-evaluation-crud-app-masquerade — .NET Framework 4.0 WinForms student-evaluation CRUD app (Evaluacion namespace) with System.Data.SqlClient backend, hardcoded SQL Server credentials, and plaintext password authentication. Distributed as PO#82924A.exe (first sibling) and NewXOrder_00200457.exe (second sibling, stolen Simon Tatham cert, Adobe Reader masquerade). No malicious payload. ^[/intel/analyses/5e34f10aad66da3d4137e4cc4ce01ac33922d427141666bfa4a6f8ec6d181bf5.html] ^[/intel/analyses/0e9cc5f817989d3f415dbe505b11bc79e34cf32e98ed16e14e1bd40f35b0724d.html]

  • dotnet-winforms-checkers-game-masquerade — .NET Framework 4.0 WinForms checkers/draughts game (Windows_User_Interaction.GameForm, Board, Player classes, makeComputerMove AI) distributed with .pif.exe double-extension lure and Security Descriptor Editor / Microsoft Corporation VS_VERSIONINFO masquerade. Future-dated timestamp 2044, PDB daQK.pdb, internal name daQK.exe. Two hardcoded SHA256-like hex strings in #Strings metadata. No malicious payload. ^[/intel/analyses/4cce5506593907c3db78282849ed41729ca7cf737e1d38cb82dc10e27d92ff16.html]

  • 0d3d6bb9 — Second confirmed sibling of 4cce5506. Identical .NET Framework 4.0 WinForms checkers/draughts game (Windows_User_Interaction namespace, daQK.exe internal name, daQK.pdb, v1.0.0.0). Same Trif32 Caesar-shift-23 decoder, same VS_VERSIONINFO masquerade (Security Descriptor Editor / Microsoft Corporation / explorer.exe), same two hardcoded SHA256-like hex strings in #Strings (different values from sibling). Distributed as Shipping_docs.exe (shipping-document lure, no double-extension). Size +1,024 bytes (635,904 vs 634,880). Capa produces zero meaningful matches (only dnfile parser structural warnings). Unsigned. Future-dated timestamp 2044. Threat is purely social-engineering masquerade. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/0d3d6bb9131e58c4dcf833781bb944eedd4bd53f5736bb1c33af11b3031fb4cd.html]

  • pif-exe-double-extension-masquerade — Legacy PIF (Program Information File) extension followed by .exe to exploit Windows "Hide extensions" default; higher-signal than .pdf.exe because PIF can carry executable content natively ^[/intel/analyses/4cce5506593907c3db78282849ed41729ca7cf737e1d38cb82dc10e27d92ff16.html]

  • embedded-sha256-integrity-hash — Hardcoded 64-character SHA256 hex strings in #Strings metadata stream; purpose unknown. Shared with e04d46ff and 9a40908c (FSC UI siblings). ^[/intel/analyses/4cce5506593907c3db78282849ed41729ca7cf737e1d38cb82dc10e27d92ff16.html]

  • hadouken-inventory-crud-app-masquerade — .NET Framework 4.0 WinForms inventory-management CRUD app (Hadouken namespace, zzCV.exe internal name) with MySql.Data ADO.NET connector, Trif32 decoder, MAGIC_WORD authentication gate, and get_Credit_Cart_2 typo method. Distributed as ##Swift_Copy.bat.exe (double-extension masquerade). No malicious payload, no C2, no persistence. Student-grade code quality. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/4d780feaaf05d77f3600868d3d6be2cdaad7eb85dd80745f619fbdc8642fbbe9.html]

  • micromouse-maze-simulator-masquerade — .NET Framework 4.0 WinForms educational micro-mouse maze simulator (MicroMouseSimul.MicroMouse namespace, hDQd.exe) with BackgroundWorker, BinaryFormatter + DeflateStream maze-map serialisation, and .map/.maz file filters. Student-grade code quality with typo method names (TrunRight, TrunLeft). Distributed as Purchase_Order-151024-PDF.exe. No malicious payload. ^[/intel/analyses/4f79aee020df7bee4d64ecf90245a133e11af2ada8c97abef214cad1eb6797a4.html]

  • winforms-paint-editor-trif32-masquerade — .NET Framework 4.0 WinForms paint/drawing application (Paint namespace, wvIf.exe) with GDI+ canvas, shape primitives, line-style/hatch/width/colour choosers, zoom, and BMP/JPEG/PNG/GIF save/load. Contains Trif32 Caesar-shift-23 decoder shared with PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint/AdvWinProgHW2 clusters. Distributed as QUOTE-2K840322-A-CCC.exe (business-document quote lure). No malicious payload. ^[/intel/analyses/5335da6d96c3dbf74623c5ec6374b8bd7b95966e3a40a4d37347984a7c17d029.html]

  • lab4csharp-pictureviewer-masquerade — .NET Framework 4.0 WinForms picture-viewer / basic image-editor lab (Lab4CSharp namespace, srza.exe, v8.4.1.1) with PictureBox, MenuStrip, ToolStrip, ColorDialog, drawing primitives, and Trif32 decoder. VS_VERSIONINFO masquerades as LabSharp / PictureViewer. Distributed as CV_Forner_Eugenia.exe (curriculum-vitae social-engineering lure). No malicious payload. ^[/intel/analyses/549569602f3994b3b7058689b193a28d568cff27d4bbdfcfd527c36890579884.html]

  • karate-club-crm-masquerade — .NET Framework 4.0 WinForms karate-dojo management CRM (Karate_Club / KarateClubBusinessLayer namespace) with member login, belt-rank management, subscription tracking, payment records, and SQL Server ADO.NET backend. Distributed as Purchase_Order.exe and PO.366786-K0001388089465.xlsx.exe. No malicious payload. Second confirmed sibling (7a310c85, 529fa495). ^[/intel/analyses/7a310c85d3a3334c4e715402d09355dda340e0e32f784eab626e4ab1a7aff321.html] ^[/intel/analyses/529fa4957fea8e29e7f990cb261dbe876040b5c30ffb4b9d58288d146e67dfb4.html]

  • xlsx-exe-double-extension-masquerade — .xlsx.exe double-extension filename abuse, higher-fidelity than .pdf.exe because Excel is a common business-document format and the .xlsx prefix is visually convincing ^[/intel/analyses/529fa4957fea8e29e7f990cb261dbe876040b5c30ffb4b9d58288d146e67dfb4.html]

  • turkish-monopoly-winforms-game-masquerade — .NET Framework 4.0 WinForms Turkish-language Monopoly board game (MonopolyGame namespace, falD.exe) with Entity Framework MonopolyDB EDMX model, SQL Server LocalDB persistence, NetComm TCP multiplayer networking, Newtonsoft.Json serialization, and Trif32 decoder. Distributed as SALES_ORDER.pdf.exe (.pdf.exe double-extension masquerade). No malicious payload. ^[/intel/analyses/5bf25358184f7ddd5da889cee29f7adb0f8db9aa9c130b8c83a93f616919fb9d.html]

  • okuZ-winforms-chart-app-masquerade — .NET Framework 4.0 WinForms student-evaluation charting app (Chart namespace, OkuZ.exe, v1.0.0.0) with Chart.Models.Student class, Chart.DataSet1 typed dataset, Chart.frmMain/Chart.FrmStep forms, and get_orhi resource accessor. Hardcoded SHA256 string in #Strings. Distributed as PO781000885.exe purchase-order lure. No malicious payload. ^[/intel/analyses/3c9f96db10be4b69eb71ed27ecea954f721347bee8a310fa25d9a0ee2a0c57dd.html]

  • datalock-phone-locker-courseware-masquerade — .NET Framework 4.0 WinForms phone/locker management simulation (datalock namespace, datalock.exe, v1.0.0.0) with PhoneUI, LockerSystem, LockerManager, CallLogger, ShoppingCart, School, Student, Pennington, Rueben, Morrow classes. Contains System.Security.Cryptography references from student cryptography exercise — no payload encryption layer. IL linker v48.0 (.NET Native/ILC). Future-dated PE timestamp 2060. Unsigned. Distributed as DETAILED_INVOICES.exe (invoice-themed social-engineering lure). No malicious payload. Capa T1620/B0013.001 false positives from Debug-build compiler attributes. ^[/intel/analyses/c9db49c9cc19516d4a95548d1ce4ce1f36df8c40e690c14bcb547ddb1e789bb1.html]

  • oop-inheritance-winforms-coursework-masquerade — .NET Framework 4.0 WinForms OOP inheritance demo (Inheritance namespace, eWfe.exe) with Vehicle → Car/SUV/Truck polymorphism, MDI forms, embedded PNG vehicle images, Trif32 decoder, and System.Data.SqlClient schema. Distributed as PO45120992.exe purchase-order lure. No malicious payload. ^[/intel/analyses/46c14f54405d6c75a0ba41465e754314f586546d12135ef3d584b79fa75dc698.html]

  • japanese-language-trainer-masquerade — .NET Framework 4.0 WinForms Japanese vocabulary flashcard app (JapaneseTrainer namespace, QuqI.exe, v3.1.2.3) with furigana display, star ratings, Fisher-Yates shuffle, and System.Data.SQLite local database. VS_VERSIONINFO masquerades as Idemitsu Kosan / JapaneseTrainer / 振り仮名. Trif32 decoder shared with PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint/AdvWinProgHW2/Paint/Lab4CSharp/Pizzaria/Checkers/Hadouken/OkuZ/Inheritance clusters. Distributed as DRAFT_File_Request_PDF.exe (draft-document social-engineering lure). No malicious payload. ^[/intel/analyses/495a9aa04b3ff3c9b3ca588d077fb6cd60e239b66ccbd9e75c5ca748ebd14700.html]

  • polish-stock-charting-stolen-tatham-cert — .NET Framework 4.0 WinForms Polish-language stock-charting / technical-analysis app (GAD_HW2 namespace, fCGm.exe) with candlestick/HiLoOpenClose plotting, CSV import, moving-average overlays, MojeOkienko helper, and Trif32 decoder. Signed with stolen Simon Tatham COMODO RSA certificate. Distributed as payment_Slip.exe. VS_VERSIONINFO masquerades as pdf / microsoft / exel / zip. No malicious payload. ^[/intel/analyses/0a0a24fc88ba87cd8c77b6a493547b2dc780f60df1838e7b0ddcc87bb1277680.html]

  • parcheesi-hsm-simulator-masquerade — .NET Framework 4.0 WinForms Parcheesi board game (Parcheesi namespace, jeUn.exe) merged with SimpleHSMSimulator crypto-lab module (TripleDES / Rijndael / AES KCV calculator). VS_VERSIONINFO masquerades as KastleSoft / Parcheesi. Distributed as PO_20248099-1 12,300PCS.pdf.exe (purchase-order social-engineering lure). No System.Net, no P/Invoke, no persistence, no anti-analysis, no packing. Capa T1620/B0013.001/C0021.003 are false positives from Debug-build compiler attributes. Unsigned. Plausible timestamp 2024-09-11. ^[/intel/analyses/0bf2e649cea88d4c52b3554f02fa3c22228242e6946601e5284a4fadc1101fdf.html]

  • 46c14f54 — .NET Framework 4.0 WinForms OOP inheritance demonstration coursework (Inheritance namespace, eWfe.exe, v0.0.4.2, AssemblyVersion 0.0.6.0) with Vehicle → Car/SUV/Truck polymorphism (get_Type/set_Type), MDI parent/child forms, PictureBox vehicle images (256×256 and 481×481 PNGs), and Trif32 Caesar-shift-23 decoder shared with PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint/AdvWinProgHW2/Paint/Lab4CSharp/Pizzaria/Checkers/Hadouken/OkuZ clusters. Hardcoded SQL Server connection string (Initial Catalog=VehicleInheritance) and System.Data.SqlClient schema. Distributed as PO45120992.exe (purchase-order social-engineering lure). No System.Net, no P/Invoke, no persistence, no anti-analysis, no packing. Capa T1620/B0013.001 are false positives from Debug-build DebuggerNonUserCodeAttribute/DebuggableAttribute. Unsigned. Plausible timestamp 2024-07-18. Threat is purely social-engineering masquerade. Static-only (CAPE skipped — no Windows guest). ^[/intel/analyses/46c14f54405d6c75a0ba41465e754314f586546d12135ef3d584b79fa75dc698.html]

  • 495a9aa0 — .NET Framework 4.0 WinForms Japanese language-learning trainer (JapaneseTrainer namespace, QuqI.exe, v3.1.2.3, AssemblyVersion 3.1.2.3) with vocabulary flashcard drill, furigana display, star ratings, audio playback, and Fisher-Yates shuffle. System.Data.SQLite local database for vocabulary and progress. VS_VERSIONINFO masquerades as Idemitsu Kosan / JapaneseTrainer / 振り仮名 (furigana). Trif32 decoder shared with PrimeraVentana/GoldenCity/MyPaint.Editor/Ivanov_WF_Paint/AdvWinProgHW2/Paint/Lab4CSharp/Pizzaria/Checkers/Hadouken/OkuZ/Inheritance clusters. Distributed as DRAFT_File_Request_PDF.exe (draft-document social-engineering lure). No System.Net, no P/Invoke, no persistence, no anti-analysis, no packing. Capa T1620/T1213/B0013.001 are false positives from Debug-build compiler attributes. Unsigned. Plausible timestamp 2024-08-05. Thirty-ninth confirmed sibling in the unclassified-dotnet cluster. Static-only (CAPE skipped — no Windows guest). Report + entity update + technique pages + index + log updated. ^[/intel/analyses/495a9aa04b3ff3c9b3ca588d077fb6cd60e239b66ccbd9e75c5ca748ebd14700.html]

  • 0bf2e649 — .NET Framework 4.0 WinForms Parcheesi board game (Parcheesi namespace, jeUn.exe, v3.1.0.0) merged with SimpleHSMSimulator crypto-lab module (TripleDES / Rijndael / AES KCV calculator). VS_VERSIONINFO masquerades as KastleSoft / Parcheesi. Distributed as PO_20248099-1 12,300PCS.pdf.exe (purchase-order social-engineering lure). No System.Net, no P/Invoke, no persistence, no anti-analysis, no packing. Capa T1620/B0013.001/C0021.003 are false positives from Debug-build compiler attributes. Unsigned. Plausible timestamp 2024-09-11. Fortieth confirmed sibling in the unclassified-dotnet cluster. Static-only (CAPE skipped — no Windows guest). Report + entity update + index + log updated. ^[/intel/analyses/0bf2e649cea88d4c52b3554f02fa3c22228242e6946601e5284a4fadc1101fdf.html]

  • db8c072b — .NET Framework 4.0 WinForms dynamic-form generator / reflection demo (DynamicFormLoading namespace, eKys.exe, v7.4.0.0) with an embedded Mirror class implementing RC4 KSA/PRGA cipher scaffolding. Distributed as DHLXKULI570796821_PO200000035_SCAN.exe (DHL airway-bill social-engineering lure). Contains Customer, Vendor, Product, Location domain objects with auto-properties, reflected via GetReflectedAssembly/GetReflectedObject to generate labels and input fields at runtime. No System.Net, no P/Invoke, no persistence, no anti-analysis, no packing. Capa T1620/B0013.001 are false positives from Debug-build compiler attributes. Unsigned. Plausible timestamp 2024-11-25. Forty-first confirmed sibling in the unclassified-dotnet cluster. Static-only (CAPE skipped — no Windows guest). Report + entity update + by-family symlink + index + log updated. ^[/intel/analyses/db8c072bd16c6b45cfbc9964f8cbac16a589c26ecdedccfbada06f57d19b3f05.html]

Capabilities (continued)

  • dynamic-form-loading-reflection-demo — .NET Framework 4.0 WinForms educational app (DynamicFormLoading namespace, eKys.exe) that uses System.Reflection to discover assembly types at runtime and dynamically generate labels/text boxes/check boxes for domain-object properties. Embedded RC4 KSA/PRGA cipher scaffolding in Mirror class. No malicious payload. ^[/intel/analyses/db8c072bd16c6b45cfbc9964f8cbac16a589c26ecdedccfbada06f57d19b3f05.html]
  • dhl-airway-bill-social-engineering-lure — Filename DHLXKULI570796821_PO200000035_SCAN.exe mimicking DHL airway-bill / purchase-order scan document. ^[/intel/analyses/db8c072bd16c6b45cfbc9964f8cbac16a589c26ecdedccfbada06f57d19b3f05.html]

Related Entities