0198b8fa11bf9e8442defa00befa2ab224ada5ebb4a60256f2bf5fc491cca0a1

Resubmissions

19-10-2022 07:24

221019-h8nvbsfehl 10

13-09-2022 08:50

220913-krtqcsfbc9 8

02-09-2022 10:02

220902-l2sfqacadq 8

Analysis

max time kernel
4255706s
max time network
161s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
02-09-2022 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0198b8fa11bf9e8442defa00befa2ab224ada5ebb4a60256f2bf5fc491cca0a1.apk
Size

4.0MB
MD5

0b3248698651c68aa79c128c26df6f5c
SHA1

93be818f6087423909594f5630b67cf0ddcf71b6
SHA256

0198b8fa11bf9e8442defa00befa2ab224ada5ebb4a60256f2bf5fc491cca0a1
SHA512

c9815d347d65cb2184a50b9e0bc6086dd77023666189b69baabfe3e21e7cebaae513c7530c96af877bd0ef03f1f946a23f947bcaafc4be7d89d967bb9d3dbfa4
SSDEEP

98304:rAf1Qd2ofrWriq/urhQuzI6TZS+DixH8bU4bFLzbcHeze8:rANZLky4To+mgU4bFLq8

Score

8^/10

banker evasion

Malware Config

Signatures

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.personal.pdf
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.personal.pdf

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.personal.pdf

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.personal.pdf

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.personal.pdf

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.personal.pdf

com.personal.pdf
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4467

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.personal.pdf/app_webview/Default/Cookies

Filesize
64KB

MD5
dfb2098ca7b3bf16d6f5f1e7d3839af5

SHA1
ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

SHA256
e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

SHA512
fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/Cookies-journal

Filesize
1KB

MD5
659c90ef959360bbb20d56446863683a

SHA1
77f4609fbd65f9729a2f548e73433a9adf0b66ae

SHA256
496ab605919c64d8eaa60c53dbe325ff99f5eb17613681e6e505e848de2c8d9c

SHA512
556ff6d670f860a792090d0393d9aab0c5d7aa23db24bbc06dcc769bac45605980ac90b2c8ec35046caf46e8c7ef37ced6c309243e6be5cd158d7ede4b5705de

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
a7945809376aaf857d970afbcfc81e71

SHA1
47ec1794d71315f321470068de21493ecb4025bf

SHA256
71a0fde53d39623041a55781ad419e097d3b40147e77aee901092aea6ad7f836

SHA512
5860999d8dee59b04c21125d9d5f59b14c8526779e8abbe93474e31f421048f9bf5e41872996dc2db14a5a46e2023d0411141dbe1da4633c91948532c4fa1662

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.personal.pdf/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
fdc8ee92e40c9f67686c745f98841345

SHA1
955028e51d9b8a79a0d87b5501341b1580d06927

SHA256
cc29fc9ea07b3f8873107aeebc609255d24f0e982a703d19b399d74c8a6cefce

SHA512
928400941f7f143b7dd163749fbb970832d5061e5b5b77a661d7a415c0ddd9122b024ae9d68d40277f20f09cc39c6d1d30a5a70b4ac134d547015d273caccac6

Download Submit
/data/user/0/com.personal.pdf/app_webview/webview_data.lock

Filesize
22B

MD5
7b59ff393c2377ece113699a9054c514

SHA1
72d14c95d2fd0b6eaeec1f15e8c4a5131b150043

SHA256
83f261212fba10dbd7d6d66528ab10aef27a745c7880a7744a842f4af95997ac

SHA512
7b43735fca3798ebbbd6da2bcd9f1d73a079ac760dee453d52cadfdddf49e8208442b7d97bd8fbd21ab10e71db882294828de0c2f343d673031678010ecf6ff5

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
b8db9615901e6927910ed0676a63dfe7

SHA1
24d1a2d3c44c3ec0bfc0c7dcb6e292039e94ce52

SHA256
0989ae1b4577abde9f2240b3ff36dd61c60d9089d741e9c7b10b3e420865e03a

SHA512
d4281dcb46cfdb26465ab841775a3095181ce77fa13013e2bc1e0ed2ab83e0700c43f32b7e70f09adb22d7fd44e9e87f40b9b5fbb23333af0365cc908dfe2f8c

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/44e5652fb145311f_0

Filesize
3KB

MD5
cff8517b0d144801d9944c15a15b2f9f

SHA1
3ceeab47fb194ece3ec398dc5214995fdc63110f

SHA256
9393f25441dde971abcfafb53ea701176ee70f22feaa1deedfbdb35c20269b12

SHA512
7a5ac11c93eed7fc8e8a5164001c263a95c0ad0f447d0f8967466d15f5e184943eafc7948783b78401f7be01a146b912721cbda6f834614a89a036450ce88d21

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/6f729cdd8af6b4b7_0

Filesize
754B

MD5
4da246d7497103ef42bdc389f6702fd6

SHA1
b6caa03d60430a48680a5f402ee74b6128e3c40f

SHA256
c81a52b13dca2c0585c40aa25712c0251e5e6df97314deac81a89ee2fd902676

SHA512
59da73a7dd76b6bc3d5434e2c1914eda3158a1975510a2b4717708bcf4ac9af8fdf05a47ff1f112ee19103ab1b36a2c493cef1f64e78d6020adbb218c7974798

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
ccf48eb4197e5e9fc17304568ce156cc

SHA1
707c4e5adf2c19b29fe82b8f419f9960d8c69fe3

SHA256
763be3b9cc4bb0fb6c25012ed9052b362ffd4d28a53d92e0098a67dcd54eb31b

SHA512
65f247662ea1ea1d35447fda1a2267357b645e756f70b8aec1f32fdad82dfbf40dfa6d93cd5b39693f657dc88c753e3c83ed474fa7fc6aa22aeb0b330e0e02df

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
46ee94335b77a2d617b80f4c198e6c1e

SHA1
67c6937150c33ce84e9aaf3970214ee31a82513a

SHA256
520556b755f483fdf791543b51a290514e1e182ce5adc3aafa9a7f0da824504c

SHA512
2f62824ac6a9ee4bda24c8b0c6a9c32846b2157d65f012356495f3d74c689660aca0f3f4b73fde7313341ea076f8c1db4d1c04f9f3e5858dae3ac4939484a730

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
144B

MD5
d246e8deaef0d8ed9ba9e74c23c1eb9d

SHA1
e4a34989b0b7a88f8ec09ab372fd3c21cbb14756

SHA256
8bf1278dc8be2367d512bd9b060d82c0cd5c6b93de2a3e003981ce20c505bae4

SHA512
14a5507ddbe780e5cb6407974176c9a7e6c53bcdb899d3b78b68c8aa48ff3d8d3c5b0b144013138296f3afa96aaa302af5e82ac958a1c84b812963239dd30d4d

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
192B

MD5
3a8a0b1614dea2c10159b2cb8361305e

SHA1
ab50af892fffbe7078f638e56d836025ec9f9022

SHA256
530f80111f12f4ca15e86a1b060e6b66e34d69c51b5a6e71c56caa70ced4f78b

SHA512
16269467955c86b4b141dca7c11a08d850e05beec4ebc431786d2f6ec26c6dce97cffc8c7f48527f511cf4550f7f5179b0fd741100ced8f9635785a9b9381717

Download Submit
/data/user/0/com.personal.pdf/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.personal.pdf/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit