AutoBB.zip
- SHA256 eb9696f008fd49305e1f121f07f3ac3ad18758d6a70efd20cf393d8a0010e9de
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AutoBB.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
AutoBB.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
AutoBB.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
AutoBB.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Newtonsoft.Json.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target AutoBB.zip
- Size 1.4MB
- Sample260708-vprhbset5x
- SHA256 eb9696f008fd49305e1f121f07f3ac3ad18758d6a70efd20cf393d8a0010e9de
- MD5 3d303e2466391500cc9a8aef5e0d5348
- SHA1 8872b30d5aca0f32ea24fc0a253fd03624ed5a49
- SHA512 81a9a62b504e0d1b885d184ba954e57fa324d2151ce3b7917416bdee20e49c0a82ac688e7eb7b5e3ac97367d925b558c00fcc15dc2a88fef279c831abd639dfc
- SSDEEP 24576:Crx5O9fxlYCR3KUOO2BRqIFYrHAuYHI7+ZOjCp74K7h5108OzVbYl:Qx9CXboqzHAllZOIvh5Bl
- TLSH T1BC6533C2486D0F67E02BEC2A9E659B4EF5364DD73A18AB49414C246B173ABF42137C8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/AutoBB.dll unpack001/AutoBB.exe unpack001/Newtonsoft.Json.dll
File Explorer
-
AutoBB.zip.zip 1.4MB
-
AutoBB.deps.json1KB
-
AutoBB.dll.dll 800KB
-
AutoBB.exe.exe 202KB
-
AutoBB.pdb30KB
-
AutoBB.runtimeconfig.json515B
-
Newtonsoft.Json.dll.dll .ps1 1.8MB
AutoBB.deps.json
- SHA256 545fd4e4aee6ddae8bde9156278d1db56b42d564b149e809f4d9355304512d65
- MD5 9d950fea11d46c09fe4ce20d5e175505
- SHA1 1e61ee7125a66ba5a958832438abe8fef38d941a
- SHA512 1756d7e0d44d1ce6fe4b649772f94f262148645883e622fa0db52ddc31bfaf39c1543f3980b50e8c1aef870ac3459ec310c4bfb789f311503d1c05f58ade2c16
- TLSH T1C311CE19D4904DA749B227B6643A4353FB22977B1804248E79FE64DC8F72F271090FA8
- MD5 SHA1 SHA512 TLSH
AutoBB.dll
- SHA256 320e8a94789942486d9822cb9537af1d06ed6188e22f4d8cb01c36bfdefbdaed
- MD5 28860d5e9a4752de4d38b70845ff38d9
- SHA1 ca42de6478b939eae76fb15595f678e59786bb24
- SHA512 0730b326bbb0fb271f72921bcd086166735d52abe1c96ec5d6dfda2ebbe21953be2ea21c9ebaa40bd86a70f3b37d37b73f5794fb180750bf0947bc840e549424
- SSDEEP 24576:UCMMMMMMMXu2GOXfhlxEtNBHLk/EMhpwlMnqqHi7qMMMMMMM5L7BY:XMMMMMMMXuMXfrC/cnhhnHi7qMMMMMMU
- TLSH T15F05CE0122984146E32585B5DB67C232F7B2BD5B5220D6DB5FE1BCCB3FE3B919062A07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\.VSProjects\AutoBB\AutoBB\obj\Release\net8.0-windows\win-x64\AutoBB.pdb
Name
.text
Size
776KB
Virtual Size
773KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
AutoBB.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 257d788caf1f0feadcaf4e7fc4de4af50ddb6eac84564e6c3d120d23287403a3
- MD5 25dd8365a61397bf8aed08b02e77d5c9
- SHA1 2680640331632cb6b54dfb47dba0a9cd20adb025
- SHA512 073a3f94ec8b6c53346c7e004d60b8419b22529232ea7ca5f4ee489d7b43e3e4c80bd6cec3c0f200bd760f9ebdd39273ffbdff9a19b63aac3b88408abc027be3
- SSDEEP 3072:H454jE83DwHBoi2r7Z9V58lmpCnclxuZmPgBZ5C5spWxa6GkX:H454jECi2rd9V58Mp/xuZmIBfo
- TLSH T10014080272A800E9D1A7A2B899A6D935E3727C5A477197CF03D1BD273F73AC19D3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=34321,
count=12, id=260, version=34321,
count=87, id=261, version=34321,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=34438,
count=1, id=258, version=34438,
AutoBB.pdb
- SHA256 a713c2a55705b67c519a104a2eab8d499c8678bb455a21ccb87ed6b17097d3a5
- MD5 2a84979fb1f616cb77d8f6820ff8514b
- SHA1 b361c8bf53bd28350fee675c6b219eef3d5b8648
- SHA512 aa2a2755719a455d7afe13bac2ee01d37726b5743a71eae86b8146c26706377bb93872fd8e876e355b58295240ff531371e626cfd2cb3a33aa4d345b85a29ea3
- SSDEEP 384:oexCvhHYwywXZ1q+PNEK7HN6uaJKxKH+KSB8skxWwLN7AnIPJwyY338xr/5/Hpfm:oexCmAxPNgtxWM9xjUcidDzqnabROlKB
- TLSH T1EAE2B5224388CD3DD150A6368762C29A67BBE3817346CF35A1ECA657EDDA31507B3378
- MD5 SHA1 SHA512 SSDEEP TLSH
AutoBB.runtimeconfig.json
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
Newtonsoft.Json.dll
- SHA256 fbf20c412819f6a2ea60065f4d092a68efdb1c62b71840b782958d78ea76c834
- MD5 19da32d3d4cfd4578b43bc995fd3e5d3
- SHA1 57d33e7a4b41efb994d1d8b400ddb9d604e062c6
- SHA512 34a8c8ae190f2644fd348db64fed5dcad25ba3615b85ece6930cfa7d413741bb3c20f7c70fbf4bb9ce9c5b7b86ad9da77fdc30ed8a47d9ca369f145427c0a3d3
- SSDEEP 24576:e3fNj6w7H8ky393LfhSKF8TnmtKpS2Fvnk+b88fxEBBjgrIQtDgCwnYTx7Ucn:aR57ckm3LpVAmYpi+b4BBjHQtDgznm
- TLSH T1C5859D1697D84B06D22F92BD819B4452E5F1F0435322D7CF158CEE913F83BE29AB235A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ