b6249fa996cb4046bdab37bab5e3b4d43c79ea537f119040c3b3e138149897fd

Resubmissions

06-06-2023 13:19

230606-qk2ehsec9z 10

11-01-2023 09:41

230111-lntfvsff3y 8

Analysis

max time kernel
2430754s
max time network
318s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
06-06-2023 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6249fa996cb4046bdab37bab5e3b4d43c79ea537f119040c3b3e138149897fd.apk
Size

11.5MB
MD5

7e061e87f9a4c27bfb69980980270720
SHA1

34d37927b35f422e7c28055ea989ef6524a668ef
SHA256

b6249fa996cb4046bdab37bab5e3b4d43c79ea537f119040c3b3e138149897fd
SHA512

aa7fc96da1040e1c97c522bc23e2a84c7684813185289cde4ff57937b11b7866ad5ea5a87df19fe7dbd090b18efb1540146380f4e91fd2104e0cf15e0e5545fd
SSDEEP

196608:HNQ+EyaHv2Dl1bQ6x49K6MoJzMHWjfd/7LbDRtUlCv1phj2oIK1Dfo:H4DHv2vme04HafVLDRKlCv1phj2FK1ro

Score

9^/10

evasion ransomware

Malware Config

Signatures

Renames multiple (74) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pdffiller.l2f
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.pdffiller.l2f
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.pdffiller.l2f

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pdffiller.l2f

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.pdffiller.l2f

com.pdffiller.l2f
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4417

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.pdffiller.l2f/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.pdffiller.l2f/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
c25eebfc09a945691bf8775ba676b329

SHA1
b34dcdaceb73428cde6979d642d5cfd80924a23f

SHA256
1acacad56cb12223c7f5622700348d63cf6cc9202085c5c124fb53381c284391

SHA512
150e7fa3ad155053a336f8ada250a1ffcf22b085128ee8d08c6d4a936cbca90c84177622bc8e09e00465719969cbdf57d383558d341111db511b1e00bed1b3fc

Download Submit
/data/user/0/com.pdffiller.l2f/app_webview/webview_data.lock

Filesize
23B

MD5
e8ba952e20818d7481ae40364379bfee

SHA1
6cf589dcf89fdb4a6f5ed9dc50305d1bf9291e94

SHA256
296efc0cc0a0406850eeeb4d433b647b72e48884b9d2ce4dde3a3cca2cbcfee1

SHA512
45730797a1511677c005ea93693e1b2ed16b00fa6995ea9ff3a8659c83ff049d68f1ab05a939e9c85df6f7747b22d53eb0dd5fa7e5e5b633b64ee30f70c60417

Download Submit
/data/user/0/com.pdffiller.l2f/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
ecff19e93e16fad97f8e33df321e2cbb

SHA1
c1c0e66b9b2a1e6afd4cc7ae437850bd22f1b7f0

SHA256
c92787e7d202baf886006584b1cf22ee9a84f8d7e952197ec15ae71c8cd1707f

SHA512
7688f8e0bf81e1233015e118c9b76787cf59107e816faad657546bab92e55a379aa713a252191a901d5376525dce89fd25b152150f9e3b71283a622ca8352a3c

Download Submit
/data/user/0/com.pdffiller.l2f/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.pdffiller.l2f/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
71cf26a7ffad6ffec5460d00cdfc5499

SHA1
57ff6228fa52f97066cf14b38f56e5772c35514e

SHA256
0dcd1f2a396a1865253e88f3cac5e5ae5291806591cb775f27a3d826d65ac4e8

SHA512
d2eca4f43c20b31df72417b1988ecc896ef340bb69c0f492fc75e9c9cd0da87db4c9061fde0e6625f75739e6c9c3cbbbb95f249fb679f2a188df25a4afd8c936

Download Submit
/data/user/0/com.pdffiller.l2f/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.pdffiller.l2f/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
ff8fa0a8e741c3b5b783b725d45a3715

SHA1
d5a25e3fee5165e8c4017ab4dac2752057d00d7f

SHA256
381db93ba7fbe4e2d58782fe2bdd2d545807c389a79021bd50afb0d982337023

SHA512
bd01a80eefd9515e8b17675e4b66d78c4e01d2392e333e3d44d5de4ec981134bf31fa346637f94b80d305ce0a16d4d8e7997b7d9cc129eb631be183b35f13d6c

Download Submit
/data/user/0/com.pdffiller.l2f/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.pdffiller.l2f/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.pdffiller.l2f/shared_prefs/com.pdffiller.l2f_preferences.xml

Filesize
166B

MD5
9f47baf3a9a6194affde23f6045a061d

SHA1
5f7777d88f68d11406d777a6221b79c66de22837

SHA256
8300e9295420e9621c996b1e23bdc1c65a6707f72e12b73309667f7762917f50

SHA512
cf224e18a29b3794f07cf96cdb1bbaf1ddaa6c56867429b02e93a173f262377721244383c2aad24ed46c6e9411e0ad8f4fdd7828de7c45c561fabb01836f9348

Download Submit
/data/user/0/com.pdffiller.l2f/shared_prefs/config.xml

Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit