SplashBitmapv100WithUnpackCodeBoBBobsoft

Hunt Hypothesis

This hunt detects the presence of BobSoft splash bitmap executables containing unpacking code, which often indicates legitimate software installation but can also signal an adversary attempting to obfuscate malicious payloads within standard installer frameworks. A SOC team should proactively hunt for this signature in Azure Sentinel to distinguish between benign deployment activities and potential supply chain compromises where attackers leverage trusted vendor artifacts to establish a foothold.

YARA Rule

rule SplashBitmapv100WithUnpackCodeBoBBobsoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 60 8B 6C 24 20 55 81 ED [4] 8D BD [4] 8D 8D [4] 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 [4] 6A 40 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the SplashBitmapv100WithUnpackCodeBoBBobsoft detection rule, including targeted filters and exclusions:

• Scenario: BobSoft Splash Screen Deployment via SCCM

  • Context: The enterprise uses Microsoft Endpoint Configuration Manager (SCCM/MECM) to push a standardized “BobSoft” splash screen update to workstations during the nightly maintenance window. This process involves unpacking the SplashBitmapv100 resource, which triggers the YARA signature due to the embedded unpacking code.
  • Filter/Exclusion: Create an exclusion based on the Process Name (ccmsetup.exe) and Parent Process (wuauserv.exe or ccmexecutive.exe). Alternatively, exclude files located in the specific SCCM distribution point folder path: C:\Windows\CCM\Cache\*.

• Scenario: Automated Backup of BobSoft Configuration Artifacts

  • Context: A scheduled Windows Task runs every morning at 06:00 AM to archive BobSoft configuration files (including the bitmap splash assets) to a network share. The backup agent (e.g., Veeam or Acronis) extracts and compresses these artifacts, causing the detection engine to flag the unpacking activity as suspicious.
  • Filter/Exclusion: Exclude processes matching VeeamAgent.exe or AcronisBackupService.exe. Additionally, add a path exclusion for the backup staging directory: D:\BobSoft_Backup_Staging\*.

• Scenario: IT Admin Manual Installation of BobSoft Client Updates

  • Context: An IT administrator manually installs a hotfix on a specific workstation using an MSI installer (msiexec.exe) that includes the BobSoft splash bitmap. The installation routine unpacks the