Release.zip
- SHA256 0ac1a90fbf76f5e4a45d00248107552b3385beab400407e42223c0c2c7ad2147
Overview
overview
3Static
static
3Release/FNFBot20.exe
windows10-2004-x64
3Release/FNFBot20.exe
windows11-ltsc_2024-x64
3Release/FN...PI.dll
windows10-2004-x64
1Release/FN...PI.dll
windows11-ltsc_2024-x64
1Release/Ne...on.dll
windows10-2004-x64
1Release/Ne...on.dll
windows11-ltsc_2024-x64
1Release/Wi...ut.dll
windows10-2004-x64
1Release/Wi...ut.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Release/FNFBot20.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Release/FNFBot20.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Release/FNFDataAPI.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Release/FNFDataAPI.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Release/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Release/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Release/WindowsInput.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Release/WindowsInput.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Release.zip
- Size 379KB
- Sample260809-a8r8ra1why
- SHA256 0ac1a90fbf76f5e4a45d00248107552b3385beab400407e42223c0c2c7ad2147
- MD5 ad120fff37528fb4fa0dc680b216b472
- SHA1 71941a1fbae20715bd513dda44faee665c0f2251
- SHA512 615972c4c0bd635fe6c17cf85cba33fca5e3bfbcfc5c33a11ca04c8c0bd2755ecb6f982c322b5cf980f361e0ba235c4475db3a8e69c6247e8cfbfe905cf11d89
- SSDEEP 6144:vUPgTZxKoqLjNHXnomZJIigPZyybEnkeS3xK8mJO6MmZ6ehvWkAM4QUpddoxBgB+:cPgTazjNXFJIRn1fkJjKsIddokB+
- TLSH T1128423B30B91F8F4FCD580F2D756A729E427544E25294BEC261D0EA1EA1AC610F9CE73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/FNFBot20.exe unpack001/Release/FNFDataAPI.dll unpack001/Release/WindowsInput.dll
File Explorer
-
Release.zip.zip 379KB
-
Release/FNFBot20.exe.exe 66KB
-
Release/FNFDataAPI.dll.dll 13KB
-
Release/Newtonsoft.Json.dll.dll 683KB
-
Release/Newtonsoft.Json.xml.xml 691KB
-
Release/WindowsInput.dll.dll 22KB
-
Release/WindowsInput.xml.xml 120KB
Release/FNFBot20.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fa963c5ffeae9e166d22a08bead86ee8d828a9bb1a1046e0234ee56ffde59578
- MD5 2190c36493d6fb49ce2ccadaca256ccd
- SHA1 39c9896926c1f8d943cbc6c16ad3c8e94dd3e5b9
- SHA512 99516c9cfd47c076071755608bd21253ecb75d7764fb2478a96d4c2ac8b8116119a10e8860b6cc7d1fed3845dc70c28826d881ca471ee6206f4e58333dc0b261
- SSDEEP 1536:vE8ux2Yo+Ymeco5huEC/LCBYikyydi2ZhcGi7zSU:vE8k2Yocxo6hCBRNydiminSU
- TLSH T14963AFA533E4993BC6BD07B610715A5113B5AE0A2667D7CEACC930DD1FB33804B21A53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\Prokects\RiderProjects\FNFBot20\FNFBot20\obj\Release\FNFBot20.pdb
mscoree
_CorExeMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/FNFDataAPI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 337d3b92309577e0c726133ecd39e04dfd960dc258fb618ea3ea0656f44bc2f1
- MD5 1e92afc1652e50c9c0171f2ad44e5c58
- SHA1 27be2400bb85c930b4b165ec98a0423252701f60
- SHA512 fc785b95a920f59d9cc3df6fd5b83705ce1b535918e59453219bd5f9dc4058632f7d1ed46f77022fd2c391c01cb2aca6941bcae0f5f1e68d06a415688357ce0a
- SSDEEP 384:4Ag8EmKUc44K4eUuU08KE97QQmlZDpCkXMFiC2J0knkL:4Ag8EmKUc44KFUuzXE9U1vEEMFzHM4
- TLSH T1EE52DC25EB9882B9DCAF0A3CF412421F037DE5CD7563DE668F1CA0896D127D90643B76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19778
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Prokects\RiderProjects\FNFDataAPI\FNFDataAPI\obj\Debug\FNFDataAPI.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- TLSH T138E44A41A7F88F27D19E6379B430890A47F6F80BA2B5EF4F5908E9A91C937508D40B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Nov 9, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
696798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
673KB
Virtual Size
673KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Newtonsoft.Json.xml
- SHA256 e3c9cb0cbf4b3be20b6030f3a4872edd81e042048d2d19732eac3eeb9779dc0b
- MD5 ad1a946cdbe4fc83907cf558fb80a37f
- SHA1 9b6ab559cccce89e989259e356c55be6e370f1db
- SHA512 3bbbd262f3fc669bb0709963788ccca67e17fe28828ff72ca32f1d6d410a3cf76950d126feb39f204163eb5b43b07f54bc1dd4df7f4132933dbb61c054e9c1e0
- SSDEEP 6144:XqqUmk/RikFaG0rH3jGHdl0/IBHNpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QA:DUn
- TLSH T13EE4E02577C4CB220C7A012A4D1CF0C5FF205AB316192CA635CC5DDB9F7AEA652FB6A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/WindowsInput.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81110d44256397f0f3c572a20ca94bb4c669e5de89f9348abad263fbd81c54b9
- MD5 d711daf0138d35bdb878e397e0abb7c0
- SHA1 92ad5ed3d195fa60b493948f86caadc6ba6d5076
- SHA512 6302420686f2968a0b00e24d7333bf86ecff62efe7598faaa06b51797d95f667b0c5cbbb3fcb5bc84d322c049249679340d373b807b39431ff5c6a16413f95cd
- SSDEEP 384:e0c3XP4cGqWpMgtZvtxsoOaY2ZXnFq+3xfJBRGCV:dsQtqwMkbvnFqqPgq
- TLSH T1D4A20951D3FD9513DCB9ABBDACE32B005FB0BC562963FB3F111840A42C522506AA537B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\TeamCity\buildAgent\work\1f6e193703b8b174\WindowsInput\obj\Release\WindowsInput.pdb
mscoree
_CorDllMain
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/WindowsInput.xml
- SHA256 1fe547adfd58ba84bc2936ddfd2c70eb623d31289e63ca7c2f9ceb74066a9570
- MD5 5e112d1341dcd299d215dbf05778d655
- SHA1 3aa999f410dc194d5c5dfe52bc2172b842f48938
- SHA512 c1af128bc00d05ab2a585978aea572f0dae30068e8314d53c8ec6b5cfc274a4a3ff0c2d18c79324cf13dde07a9b42e813fb537fe1dea8ca194b1673e61ab6297
- SSDEEP 1536:dPvOnUduwvZPx9LI68LNMYkyizORovmpY9YAlElQmE1VlNVFVtF1/J:z5zOROJ
- TLSH T1EEC3AD2672E54B110C76021B7FAAB6C4FE1148271049281630BE5E53BF76C97A3EF79B
- MD5 SHA1 SHA512 SSDEEP TLSH