Overview

overview

10

Static

static

7

Quick PDF Scanner.apk

android-9-x86

10

Quick PDF Scanner.apk

android-10-x64

7

Quick PDF Scanner.apk

android-11-x64

7

Resubmissions

15/01/2023, 04:36

230115-e8nmsaaa9710

12/01/2023, 09:04

230112-k1lfcafe967

Analysis

  • max time kernel
    3011678s
  • max time network
    140s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    15/01/2023, 04:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Quick PDF Scanner.apk
  • Size 10.6MB
  • Sample230115-e8nmsaaa97
  • SHA256 eb46541e2991a20c20fca66e51a705a309e6576296c435126ac369ba41e6bff5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
jokerevasioninfostealerransomwaretrojan

Malware Config

Extracted

Family

  • joker

C2

  • https://weco.oss-eu-central-1.aliyuncs.com/simple

  • https://weco.oss-eu-central-1.aliyuncs.com/test_kbnt

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

    infostealertrojanjoker
  • Checks Android system properties for emulator presence. 1 IoCs
  • Loads dropped Dex/Jar 5 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.pdfdocuments.quickscannerapp
    1⤵
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4154

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Cookies
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/app_webview/Cookies
        • Size 64KB
        • SHA256 64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Cookies-journal
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/app_webview/Cookies-journal
        • Size 1KB
        • SHA256 d3d12598bd98717308a1ed01c187a929c3a80f280f46192f2a57e7e55720d016
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/app_webview/GPUCache/index
        • Size 20B
        • SHA256 3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/app_webview/GPUCache/index-dir/temp-index
        • Size 48B
        • SHA256 2ce57579ce4c02a92c443c75b3d6a66bdd9fcf64637d203a592b5f968d6021a4
        • MD5 SHA1 SHA512
        Submit Download

        000001.dbtmp
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/app_webview/Local Storage/leveldb/000001.dbtmp
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        000003.log
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/app_webview/Local Storage/leveldb/000003.log
        • Size 935B
        • SHA256 d824493c188f46e7ceefd505f04cd350d347c4fd40214fe2830fead51cd29829
        • MD5 SHA1 SHA512
        Submit Download

        LOG
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/app_webview/Local Storage/leveldb/LOG
        • Size 70B
        • SHA256 dbeba30a00d3f284927e715d4faefe0278286f600e2a2308d364cf270f7c45fe
        • MD5 SHA1 SHA512
        Submit Download

        MANIFEST-000001
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/app_webview/Local Storage/leveldb/MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512
        Submit Download

        Web Data
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/app_webview/Web Data
        • Size 104KB
        • SHA256 47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Web Data-journal
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/app_webview/Web Data-journal
        • Size 1KB
        • SHA256 728cc3664fed686a923bf66658d7ab54df73447638262f27bbaca69a56be3eaa
        • MD5 SHA1 SHA512
        Submit Download

        metrics_guid
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/app_webview/metrics_guid
        • Size 36B
        • SHA256 14c76e3f2bfcb05e944aba17f5385ae5273c46d88517a1faf4c5a16b1ff8db16
        • MD5 SHA1 SHA512
        Submit Download

        bc810d9ce0332bf9_0
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/org.chromium.android_webview/bc810d9ce0332bf9_0
        • Size 6KB
        • SHA256 e586ce73197a26d1e7f8f2f80e603b3df72932d6e3e7431577d8d8cfe45ba8f3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dfe6b2497a7513ba_0
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/org.chromium.android_webview/dfe6b2497a7513ba_0
        • Size 6KB
        • SHA256 a996460d6f95eb991046909b6b933885a7377fd202932705433e28b6154881ce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        f038e94cb33282ab_0
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/org.chromium.android_webview/f038e94cb33282ab_0
        • Size 125KB
        • SHA256 097832f5185e3f962e4b9bdcf22a67833ca3bc2a79a9b74ac452c7fa470b6ecc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        f038e94cb33282ab_1
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/org.chromium.android_webview/f038e94cb33282ab_1
        • Size 196B
        • SHA256 1c397be36a3f9ee11e3c9f66b493f94a9f5216b64db213b82ca4b46fc18d0d54
        • MD5 SHA1 SHA512
        Submit Download

        f60eaf12735df878_0
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/org.chromium.android_webview/f60eaf12735df878_0
        • Size 58KB
        • SHA256 9c1caad335406c6c8bb00171e65f9237ffceefe441d89822143b4dea41707dfa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        f60eaf12735df878_1
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/org.chromium.android_webview/f60eaf12735df878_1
        • Size 178B
        • SHA256 c3d15e17ead14423bd8e843dc12cf42080a36a4c304262d949580d17c4c46891
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/org.chromium.android_webview/index
        • Size 20B
        • SHA256 3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 48B
        • SHA256 6ec4129d074bdafb014465ea869cb52e24050d48b4945b6d71744a45534e7b5c
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 144B
        • SHA256 5af55d8c2464034b1113946eada47b3876beac1c9e6e0ae7649a24a45fc6e7da
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 144B
        • SHA256 d5350a0e35d0deb761e165929add8f11edd079ca05bb8baf527a0ee2eb552130
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 144B
        • SHA256 f9d0e52270437776d830297950fc1fa2ea3121f739e5dc6636146d48538a056c
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 144B
        • SHA256 5b9e6c33b96f8b11a83dc5146e8b8a10fc9e52dc10694a9525cba9fc1638543d
        • MD5 SHA1 SHA512
        Submit Download

        pdf.db
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/databases/pdf.db
        • Size 16KB
        • SHA256 49220e13346febc4ebee1d76a8f9c49f32ac5f2b9e9271bbdb7ea5bc8229b00e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pdf.db-journal
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/databases/pdf.db-journal
        • Size 524B
        • SHA256 7bc517995bbbb2adb0b7783ec00da9e69abec045ec6a644a1f4a1fb70426fb44
        • MD5 SHA1 SHA512
        Submit Download

        pdf.db-shm
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/databases/pdf.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        pdf.db-shm
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/databases/pdf.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        pdf.db-wal
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/databases/pdf.db-wal
        • Size 16KB
        • SHA256 6c2132ede93732697e285bce0c95c8190f9d0c2ae461c0034ee3919485bfe9ea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pdf.db-wal
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/databases/pdf.db-wal
        • Size 4KB
        • SHA256 11531ae61cdf4de486069a8c7b095147fa9d896279fdf77806f077c2e0d216ca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zzxqmsm
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/files/zzxqmsm
        • Size 26KB
        • SHA256 5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zzxqmsm
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/files/zzxqmsm
        • Size 26KB
        • SHA256 5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        zzxqmsm
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/files/zzxqmsm
        • Size 26KB
        • SHA256 5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        zzxqmsm
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/files/zzxqmsm
        • Size 26KB
        • SHA256 5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        zzxqmsm
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/files/zzxqmsm
        • Size 26KB
        • SHA256 5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        WebViewChromiumPrefs.xml
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/shared_prefs/WebViewChromiumPrefs.xml
        • Size 127B
        • SHA256 bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
        • MD5 SHA1 SHA512
        Submit Download

        admob.xml
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/shared_prefs/admob.xml
        • Size 133B
        • SHA256 4412caa6e6d9406c582e44aed5d1ccecce5db9c200560b9baad5a3a8337a7343
        • MD5 SHA1 SHA512
        Submit Download

        admob.xml
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/shared_prefs/admob.xml
        • Size 175B
        • SHA256 fc59c08e923ab8332bd82ea5cf1b8050ce9b4d12f0e363df1257a38fbb0578b9
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 547B
        • SHA256 2be460c3f7437ea7c4e3dfa2ee8bee3c607cae4c09645038862444b13ec6cbf5
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 65B
        • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 122B
        • SHA256 2478c97a377db9ce6a44977b4864a40af8b4f5e5c8f81892c424a608ddec911e
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 514B
        • SHA256 e8042925e0faef015b404234e6bedeb63810892b42dc42da31f89fa18609c65f
        • MD5 SHA1 SHA512
        Submit Download

        com.pdfdocuments.quickscannerapp_preferences.xml
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/shared_prefs/com.pdfdocuments.quickscannerapp_preferences.xml
        • Size 122B
        • SHA256 d4c6ce38959454cb40c147cbda68d2a18cda6dd9de599ac7eeb3dcbf05a07f44
        • MD5 SHA1 SHA512
        Submit Download

        com.pdfdocuments.quickscannerapp_preferences.xml
        • Path /data/user/0/com.pdfdocuments.quickscannerapp/shared_prefs/com.pdfdocuments.quickscannerapp_preferences.xml
        • Size 234B
        • SHA256 0f956a5c5a05f1d2801e2f73220396364bfc423db2ff0a6b388ebf0df528c787
        • MD5 SHA1 SHA512
        Submit Download

        Anonymous-DexFile@0xd8227000-0xd822a4c0
        • Path Anonymous-DexFile@0xd8227000-0xd822a4c0
        • Size 13KB
        • SHA256 dca2d34d6881cfa25c089d49e7f0e4b4fed7851e8443eae4ac3ddf9b4fa5107b
        • MD5 SHA1 SHA512 SSDEEP
        Download