General

  • Target

    DOC-20230716-WA0007.

  • Size

    137.0MB

  • MD5

    45dcff88184fe8ba396d753f99767d48

  • SHA1

    3ce1e6ff3d09225cc3c08d846be356ca08de29c1

  • SHA256

    4071846b73cbca9a3c26f3cae35c892efd98c0326d6115b1c2f58da3813f14c2

  • SHA512

    fc3ad547d8268b8738e3f0f4d0430f724cba1196c03c3c40f8b342597a434fcf910233d0e3b727c069fe39ef0db30f72f47f0f56b73c1480c565db0b0776201c

  • SSDEEP

    3145728:7rklp3/CutViGxZkfLIPUNx5qr7VjqDFYqLKgcDYm2VvNH7Jq2IYT:7AlBCWLkzWULVqkJH7J7PT

Score
7/10

Malware Config

Signatures

  • Requests dangerous framework permissions 11 IoCs

Files

  • DOC-20230716-WA0007.
    .apk android arch:arm64 arch:arm arch:x86 arch:x64

    app.rvx.android.youtube

    com.google.android.apps.youtube.app.application.Shell_SettingsActivity


  • 42_js_module_config.dat
    .js
  • CarroisGothicSC-Regular.ttf
  • ComingSoon-Regular.ttf
  • DancingScript-Regular.ttf
  • MonoSerif-Regular.ttf
  • YTSans-Medium.otf
  • account_link_button.eml_8fe5181c3cb6cf3d
  • ad_badge.eml_78c849e47e6b1ba9
  • advanced_quality_sheet_content.eml-js_6672780c014568a9
  • advanced_quality_sheet_content_controller_7072197dfd465592
    .js
  • android_builtin_effects_settings.binarypb
  • android_shorts_timeline_builtin_effects_settings.binarypb
  • animated_checkbox.eml_503cb2800e10ff6d
  • animated_like_icon.eml_304df680dc70f06c
  • audio_track_sheet_content.eml-js_4070fc6b55cff279
  • audio_track_sheet_content_controller_884692e921ccfbf4
    .js
  • avatar.eml_e67de273a120c3c4
  • avatar_with_ring.eml_2e8940af47fea462
  • badge.eml_b0dc8d5521577952
  • baseline.prof
  • baseline.profm
  • bell_inline_menu.eml_88674f0cfcf782b7
  • bell_inline_menu_item.eml_a5dbc9a928791c3c
  • bottom_sheet_header.eml_415831f4d573f7af
  • bottom_sheet_list_option.eml_de0473163ce670bd
  • button.eml_3c8b902a156d7282
  • caption_tracks.eml-js_138dd67471e0cf44
  • caption_tracks_controller_c7ab7badce726f03
    .js
  • captions_sheet_content.eml-js_21f029c55a2e6f3a
  • captions_sheet_content_controller_7d1c14a016485de0
    .js
  • cast_error_mapper_prod_container_manifest
    .js
  • channel_purchase_button.eml_8e3765d9f2111a03
  • clip_button.eml_a9f44c7f593d764b
  • collage_thumbnail.eml_593599be02f4d698
  • com_google_android_gms_clearcut_client_package_metadata.binarypb
  • com_google_android_libraries_consentverifier_package_metadata.binarypb
  • com_google_android_libraries_mdi_sync_package_metadata.binarypb
  • com_google_android_libraries_notifications_package_metadata.binarypb
  • com_google_android_libraries_notifications_platform_package_metadata.binarypb
  • com_google_android_libraries_onegoogle_package_metadata.binarypb
  • com_google_android_libraries_performance_primes_package_metadata.binarypb
  • com_google_android_libraries_user_profile_photopicker_package_metadata.binarypb
  • com_youtube_mainapp_android_package_metadata.binarypb
  • comments_entry_point_button.eml_d936cedcf23c8219
  • compact_channel_bar.eml_d7cf492246862f3c
  • compact_channel_bar_header.eml_f4f271c40a309e69
  • compact_playlist_slots.eml_7b066c0e3ca398d2
  • compact_sponsor_button.eml_3e96bdb6ac41a7e7
  • compact_subscribe_button.eml_7a79531f5dd5f6a5
  • compact_video_slots.eml_3480ce2a00cb8fb3
  • datapush_release_version.binarypb
  • decorated_avatar.eml_eede956849ca9580
  • dislike_button.eml_2c19a97809b04920
  • divider.eml_c8857933d13a2555
  • download_button.eml_33aad8d3b697e9a
  • download_icon.eml_7c7e49844a9527b2
  • download_icon_with_partial_playability.eml_a0b81527851a849
  • downloads_page_banner.eml_a4f98338f7a2be6e
  • downloads_page_expand_button.eml_837527c7ffbc280b
  • downloads_page_habanero_entry_point.eml_2a706c00e4867c2f
  • downloads_page_playlist.eml_32d097eeb3233df5
  • downloads_page_playlist_download_status_unwrapper.eml_427fc7bbd1dbc9d8
  • downloads_page_playlist_unwrapper.eml_d4342b1bf171a32c
  • downloads_page_recommended_video.eml_3a96088770be9746
  • downloads_page_recommended_video_download_status_unwrapper.eml_b15d309a7ebbf287
  • downloads_page_recommended_video_unwrapper.eml_fc7b0d7c05e2706d
  • downloads_page_video.eml_90492d67f99a52a9
  • downloads_page_video_download_status_unwrapper.eml_c1564c159e57f217
  • downloads_page_video_unwrapper.eml_19405ab31e499a49
  • downloads_thumbnail_overlay.eml_68e9c30f4cb546ca
  • dream_plasma_overlay_alpha.png
    .png
  • dream_time_blur_weights.png
    .png
  • embedded_filegroups_embedded_datapush_proto.dat
  • fragment_shader_contrast_es2.glsl
  • fragment_shader_hsl_es2.glsl
  • fragment_shader_lut_es2.glsl
  • fragment_shader_oetf_es3.glsl
  • fragment_shader_transformation_es2.glsl
  • fragment_shader_transformation_external_yuv_es3.glsl
  • fragment_shader_transformation_sdr_external_es2.glsl
  • fragment_shader_transformation_sdr_internal_es2.glsl
  • fragment_shader_transformation_sdr_oetf_es2.glsl
  • frame_blurred.png
    .png
  • fullscreen_video_action_button.eml_5717b5cbf0540069
  • image_preview_supergraph.binarypb
  • info_card_teaser_overlay.eml-js_fb4541f2da23ec46
  • info_card_teaser_overlay_controller_bd2bbdc5bd8e8e3d
    .js
  • like_button.eml_3487d8786749e482
  • listen_first_suggested_action_controller_8bb32eaa708a675
    .js
  • listen_first_suggested_action_v2.eml-js_2a8e84d7e3d3c39d
  • live_ring.eml_9d0bd37edda497ef
  • lut_BEAM.png
    .png
  • lut_BEAM_2.png
    .png
  • lut_BLUSH.png
    .png
  • lut_CRUSH.png
    .png
  • lut_DAWN.png
    .png
  • lut_DOCUMENTARY.png
    .png
  • lut_GLAMOUR.png
    .png
  • lut_GLOW.png
    .png
  • lut_NOIR.png
    .png
  • lut_POP.png
    .png
  • lut_SILVERSCREEN.png
    .png
  • lut_SLATE.png
    .png
  • lut_SUPER8.png
    .png
  • mainapp_filegroup_datapush_manifest.dat
  • media_engine_audio_container_manifest
  • metadata.eml_142421114592f41f
  • metadata_content.eml_2c06085ffd3e3626
  • metadata_with_download_status.eml_1a21046432a188b0
  • notification_bell.eml_e19ee76f3c85a4a9
  • notification_dot.eml_f6061226d78da84
  • offline_status_indicator.eml_e12b1982ddcbb4dc
  • overflow_button.eml_3fecbb8841903bea
  • paid_content_overlay_controller_7451446f14147a1b
    .js
  • paid_content_overlay_v2.eml-js_2cc8ac3a815761a2
  • playback_quality_list.eml_c550accaf4a8fe72
  • playback_quality_picker.eml_a00399a9eb73a03c
  • playback_quality_picker_preview.eml_e46f4d81db892c59
  • playback_speed_sheet_content.eml-js_5db61281cc0c684d
  • playback_speed_sheet_content_controller_890e10734e91846a
    .js
  • playlist_add_to_option.eml-js_583dfd3157a29244
  • playlist_add_to_option_controller_d636a46328e9028f
    .js
  • playlist_add_to_option_upb.eml-js_85634dfc25ad9aa4
  • playlist_add_to_option_upb_controller_b56b18846539a09a
    .js
  • playlist_add_to_option_upb_wrapper.eml-js_77fa5f9b0ee959a6
  • playlist_add_to_option_wrapper.eml-js_b97959ba95998607
  • qos_container_manifest
  • quality_sheet_footer.eml_44c30f23c3441896
  • quality_sheet_header.eml-js_7622baf826ac39ad
  • quality_sheet_header_controller_944497c40a63c0a4
    .js
  • query_engine_container_manifest
  • query_engine_container_manifest.dat
  • quick_quality_sheet_content.eml-js_899fe98a0b9d5a23
  • quick_quality_sheet_content_controller_26b2f08c1a50ca3
    .js
  • radio_button.eml_12a2d2cd0e729a36
  • radio_picker.eml_6b26701a7dfd71f5
  • radio_picker_option.eml_44bc9af892b5007f
  • root_b3314f9adbebcf15
    .js
  • save_to_playlist_button.eml_66a22baeb22d4652
  • save_to_playlist_button_vm.eml_58df9b954ef8b9af
  • segmented_like_dislike_button.eml_a5e31b4b604d8809
  • segmented_like_dislike_button_vm.eml_cd152efe6882d9c8
  • silver_screen_grain.png
    .png
  • snackbar.eml_89fd3f654bc2b065
  • status_dot.eml_ee2a0ee00cd12e25
  • stories_ring.eml_119d0921f8347570
  • subscribe_button.eml_c9bdddb6b51b6cae
  • subscribe_menu_button.eml_8b12e236f6b8fd61
  • subscribe_menu_notifications.eml_583ba33de4db3f55
  • subscribed_icon.eml_cbd657d9b0020cd1
  • suggested_action.eml_7bfa06239a299264
  • super8_frame.png
    .png
  • super8_grain.png
    .png
  • switch_button.eml_6f99e4b59f23e8c8
  • sy0_b3314f9adbebcf15
  • sy1_b3314f9adbebcf15
    .js
  • sy2_b3314f9adbebcf15
    .js
  • sy3_b3314f9adbebcf15
  • sy4_b3314f9adbebcf15
  • sy5_b3314f9adbebcf15
  • sy6_b3314f9adbebcf15
    .js
  • sy7_b3314f9adbebcf15
  • sy8_b3314f9adbebcf15
    .js
  • sy9_b3314f9adbebcf15
  • sya_b3314f9adbebcf15
  • syb_b3314f9adbebcf15
    .js
  • syc_b3314f9adbebcf15
    .js
  • syd_b3314f9adbebcf15
  • sye_b3314f9adbebcf15
  • syf_b3314f9adbebcf15
  • syg_b3314f9adbebcf15
    .js
  • syh_b3314f9adbebcf15
    .js
  • syi_b3314f9adbebcf15
    .js
  • syj_b3314f9adbebcf15
    .js
  • syk_b3314f9adbebcf15
  • syl_b3314f9adbebcf15
    .js
  • sym_b3314f9adbebcf15
  • thumbnail.eml_d252fe349f81875e
  • timely_action.eml-js_d2f8e01abf21f9dc
  • timely_action_controller_3c313e13f6f81fa4
    .js
  • timely_actions_overlay.eml-js_42d7a1bdcd88e677
  • timely_actions_overlay_controller_3174d0a39598f620
    .js
  • toggle_button.eml_8d9c17697f586815
  • toggle_button_inner.eml_3874c2486a2f2d8f
  • triptych_thumbnail.eml_a2f990fa1bf5699
  • verified_badge.eml_20900a61e1491362
  • vertex_shader_transformation_es2.glsl
  • vertex_shader_transformation_es3.glsl
  • video_action_bar.eml_9a7563ee07b520ae
  • video_action_button.eml_620a3a90ac7f2fbd
  • video_action_button_pill.eml_482e6e6fbdea104a
  • video_action_toggle_button.eml_cdfecc2d1f63394b
  • video_badge.eml_1fe51de99820d658
  • video_metadata.eml_604644d4993b2f7b
  • video_subtitle.eml_888bbd9517f40ee5
  • vignette.png
    .png
  • youtube_activity_container_manifest.dat
  • youtube_mobile_master_cert_2020_public_key
  • youtube_mobile_master_cert_2021_public_key
  • youtube_mobile_master_cert_2022_public_key
  • youtube_mobile_master_cert_2023_public_key
  • youtube_prod_container_manifest.dat
  • youtube_sans.xml
    .xml
  • youtube_sans_black.xml
    .xml
  • youtube_sans_bold.xml
    .xml
  • youtube_sans_bold_font.ttf
  • youtube_sans_extrabold.xml
    .xml
  • youtube_sans_light.xml
    .xml
  • youtube_sans_medium.xml
    .xml
  • youtube_sans_semibold.xml
    .xml
  • youtube_singleton_account_container_manifest.dat

Android Permissions

DOC-20230716-WA0007.

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_VIDEO

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.MANAGE_DOCUMENTS

android.permission.GET_ACCOUNTS

android.permission.MANAGE_ACCOUNTS

com.google.android.providers.gsf.permission.READ_GSERVICES

com.mgoogle.android.c2dm.permission.RECEIVE

android.permission.WAKE_LOCK

android.permission.NFC

android.permission.CAMERA

android.permission.VIBRATE

com.google.android.gms.permission.AD_ID_NOTIFICATION

com.google.android.gms.permission.AD_ID

app.rvx.android.youtube.permission.C2D_MESSAGE

android.permission.GET_PACKAGE_SIZE

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.USE_FINGERPRINT

android.permission.USE_BIOMETRIC

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.READ_CONTACTS

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.RECORD_AUDIO

android.permission.READ_PHONE_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.HIGH_SAMPLING_RATE_SENSORS

com.sec.android.provider.badge.permission.READ

com.sec.android.provider.badge.permission.WRITE

com.htc.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.UPDATE_SHORTCUT

com.sonyericsson.home.permission.BROADCAST_BADGE

com.sonymobile.home.permission.PROVIDER_INSERT_BADGE

android.permission.POST_NOTIFICATIONS

android.permission.ACCESS_ADSERVICES_ATTRIBUTION

app.rvx.android.youtube.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION