Static task
static1
Behavioral task
behavioral1
Sample
jg2_2qua.exe
Resource
win7-20220414-en
General
-
Target
jg2_2qua.exe
-
Size
3.8MB
-
MD5
da0fd627e5f973c05b64520a79ceb5c3
-
SHA1
c331add626fffa0751618a03632d187a12626b85
-
SHA256
cdff3d6732cbfee9eea53694ce2e72d165554a33c26b2acbc133b699bc0f1797
-
SHA512
1ffddd165ecc4a1db3b159a9822e01c6a266132b474b840cc1dfefa116b5bf8d01c59593862acc709facd9c40ff11e6350daeefbcea26eaf8e91f2cd83f8ad67
-
SSDEEP
49152:SvD9pgi6yJbrS7rpfylBJ9KjggRrxqA4D8dPRLVg56gWePmDUk/08CnMaPSC+Mkg:SvqcrS7rECjggRNLVuTW6usQPrFS5H
Malware Config
Signatures
-
FFDroider Payload 1 IoCs
resource yara_rule sample family_ffdroider -
Ffdroider family
Files
-
jg2_2qua.exe.exe windows x86
0fe7c747747cdd5cce39f3b09e435ca2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLogicalProcessorInformation
user32
DeleteMenu
gdi32
SetROP2
advapi32
RegDeleteKeyW
shell32
DragFinish
msimg32
TransparentBlt
comctl32
InitCommonControlsEx
urlmon
URLDownloadToFileW
gdiplus
GdipAlloc
wininet
InternetOpenW
winhttp
WinHttpQueryHeaders
quartz
AMGetErrorTextW
oleacc
LresultFromObject
imm32
ImmReleaseContext
winmm
PlaySoundW
winspool.drv
ClosePrinter
crypt32
CertDuplicateCertificateContext
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 1.4MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 748KB - Virtual size: 748KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 22KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 883KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 773KB - Virtual size: 776KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ