Static task
static1
Behavioral task
behavioral1
Sample
airbnb.exe
Resource
win7-20220414-en
General
-
Target
airbnb.exe
-
Size
3.3MB
-
MD5
dfb6e366186969c7265e5602a4b85335
-
SHA1
f20c75e427ef43b853b4a053e98cd301cae331c1
-
SHA256
d77bea86bd4c36acae410d6dec8e012439e36d6226d99f1fd7de29827fca3835
-
SHA512
5420980743bb7772ffd1cda00acbbe921ec3746c20db17b653fc8cd4c795db33d516ea82604f43b61dc94ca6a949d21338f3d3528b3ac0f168bdae4676af9019
-
SSDEEP
49152:ZyV3P4uIjAcmZMTmcZ+6TBp1Zf0J/E+g9H+rEK+/085bR5WUd1H8KcTqUyp+SPdn:ZyV3AuZMRVg/qHIE/SW1Tc38+SPJr
Malware Config
Signatures
-
FFDroider Payload 1 IoCs
resource yara_rule sample family_ffdroider -
Ffdroider family
Files
-
airbnb.exe.exe windows x86
a71b735d20c1b17c39530e3975651687
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetThreadPriority
user32
WinHelpW
gdi32
BitBlt
advapi32
RegDeleteKeyW
shell32
SHGetSpecialFolderLocation
msimg32
TransparentBlt
comctl32
InitCommonControlsEx
shlwapi
PathFindExtensionW
oledlg
OleUIBusyW
gdiplus
GdipSetInterpolationMode
wininet
InternetReadFile
winhttp
WinHttpQueryAuthSchemes
quartz
AMGetErrorTextW
oleacc
LresultFromObject
imm32
ImmReleaseContext
winmm
PlaySoundW
winspool.drv
ClosePrinter
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 1.2MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 468KB - Virtual size: 468KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 871KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 759KB - Virtual size: 760KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 81KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ