Static task
static1
General
-
Target
5b60d2cb0b63bcd9c7df5873496d119de3f5364ba6eeea8548f20b2940a73ffa
-
Size
3.9MB
-
MD5
5c21cca8d79a5c46f7f1bd78b222c47a
-
SHA1
bd249dea8ceb0a4bde6ee336ed2063696b821767
-
SHA256
5b60d2cb0b63bcd9c7df5873496d119de3f5364ba6eeea8548f20b2940a73ffa
-
SHA512
1f63c24f59d5508a81e371e8c4ab8f11ce1c61a31fb78ecefdbe3d59d5e62eb281bda61e507642b92f3a897b11b0a3b0dcee3369cb78686097c91c91b08108d7
-
SSDEEP
98304:o6u5/mdsfAg6zsMn+NPOU3tLkBQ7iIxA7LXOJxiZhvINou0d+2:oJndtLkhZhKou0s2
Malware Config
Signatures
-
FFDroider Payload 1 IoCs
resource yara_rule sample family_ffdroider -
Ffdroider family
Files
-
5b60d2cb0b63bcd9c7df5873496d119de3f5364ba6eeea8548f20b2940a73ffa.exe windows x86
0fe7c747747cdd5cce39f3b09e435ca2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLogicalProcessorInformation
user32
DeleteMenu
gdi32
SetROP2
advapi32
RegDeleteKeyW
shell32
DragFinish
msimg32
TransparentBlt
comctl32
InitCommonControlsEx
urlmon
URLDownloadToFileW
gdiplus
GdipAlloc
wininet
InternetOpenW
winhttp
WinHttpQueryHeaders
quartz
AMGetErrorTextW
oleacc
LresultFromObject
imm32
ImmReleaseContext
winmm
PlaySoundW
winspool.drv
ClosePrinter
crypt32
CertDuplicateCertificateContext
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 1.4MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 748KB - Virtual size: 748KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 22KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 871KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 763KB - Virtual size: 764KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 81KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ