Skip to content

Fix Read the Docs build by replacing images that serve WebP under a .png name #962

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pulorsok merged 1 commit into from
Aug 15, 2026
Merged

Fix Read the Docs build by replacing images that serve WebP under a .png name #962

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions docs/source/malware_report.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ With these rules, Quark is now able to identify the DroidKungFu malware family a

Below is a summary report of a DroidKungFu sample (``D277C97B1A8A78F859672B4A20E74B3313E9F964E68A6E857C1E9D33763434A5``). The report shows that Quark identified the sample as **high-risk** and provided a list of the sample's behaviors.

.. image:: https://cdn.imgpile.com/f/dna1NWm_xl.png
.. image:: https://i.ibb.co/99dXBM7f/quark-dna1-NWm-xl.png

Identified Well-Known Threats
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Expand All @@ -20,7 +20,7 @@ With Quark's rule classification feature, analysts can generate behavior maps an

**1. Gain unlimited access to a device**

.. image:: https://cdn.imgpile.com/f/4nCi9mL_xl.png
.. image:: https://i.ibb.co/ZpGgwNjL/quark-4n-Ci9m-L-xl.png

The diagram shows that the ``Lcom/google/update/UpdateService;getPermission2`` function runs shell scripts and Linux commands directly, and also calls the ``Lcom/google/update/Utils;oldrun`` function to execute additional commands.

Expand All @@ -31,7 +31,7 @@ Behaviors detected by Quark:

**2. Install/Uninstall additional apps**

.. image:: https://cdn.imgpile.com/f/jpAr3Tm_xl.png
.. image:: https://i.ibb.co/23Qfyq76/quark-jp-Ar3-Tm-xl.png

The diagram shows that the ``Lcom/waps/k;a`` function installs APKs from a file, and calls the ``Lcom/waps/l;a`` function to install more APKs and the ``Lcom/waps/k;b`` function to connect to a URL.

Expand All @@ -42,7 +42,7 @@ Behaviors detected by Quark:

**3. Forward confidential data**

.. image:: https://cdn.imgpile.com/f/TsURgyN_xl.png
.. image:: https://i.ibb.co/zT3vVjBB/quark-Ts-URgy-N-xl.png

The diagram shows that the ``Lcom/madhouse/android/ads/_;_`` function queries confidential data such as SMS and call logs and also calls the ``Lcom/madhouse/android/ads/_;__`` function to check for network connectivity.

Expand Down Expand Up @@ -651,7 +651,7 @@ With these rules, Quark is now able to identify the GoldDream malware family as

Below is a summary report of a GoldDream sample (``ECA3A3666B0FD72028431431E7FAE6774A8CA692E35AE3CB44FD8F2AA418F746``). The report shows that Quark identified the sample as **high-risk**, with a list of behaviors as evidence.

.. image:: https://cdn.imgpile.com/f/qg9XDXG_xl.png
.. image:: https://i.ibb.co/zVzQntPH/quark-qg9-XDXG-xl.png

Identified Well-Known Threats
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Expand All @@ -660,7 +660,7 @@ With Quark's rule classification feature, analysts can generate behavior maps an

**1. Monitor SMS messages and phone calls**

.. image:: https://cdn.imgpile.com/f/egCf5BD_xl.png
.. image:: https://i.ibb.co/QFcHWfYR/quark-eg-Cf5-BD-xl.png

The behavior map shows that the ``Lcom/sjhi/client/zjReceiver;onReceive`` function monitors SMS messages and phone call activity. It also calls the ``Lcom/sjhi/client/zjReceiver;a`` function to collect the data into files.

Expand All @@ -673,7 +673,7 @@ Behaviors detected by Quark:

**2. Upload SMS messages and phone calls to remote servers**

.. image:: https://cdn.imgpile.com/f/SOrA9Qz_xl.png
.. image:: https://i.ibb.co/rGGtzyWJ/quark-SOr-A9-Qz-xl.png

The behavior map shows that the ``Lcom/sjhi/client/e;a`` function connects to a URL and writes a file to an output stream. If the output stream is from the URL, this indicates the function uploads a file to a remote server.

Expand Down
Loading