394241ae21314b4ea3ab32052f426a797d3aa1b0c761551921665f50071f2bef

Analysis

max time kernel
762287s
max time network
190s
platform
android_x86
resource
android-x86-arm-20230831-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
submitted
13-10-2023 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WPS_Office-Premium-v18.2_build_1466-Mod_ROCKMODS.NET.apk
Size

162.9MB
MD5

aed926ccee408e1cbf2dd9f69c6e32be
SHA1

9a4ab6febd255cced50bdc285575e49a748c2663
SHA256

394241ae21314b4ea3ab32052f426a797d3aa1b0c761551921665f50071f2bef
SHA512

7493a651fb4a6299a7de28bb082b6699871803d7995669b2fa8258a974384e72b4fcfcc0ea34a2f4b33d4903ba82cfcd8387d3a9ca0ffdc224d9477f73446bef
SSDEEP

3145728:mROlwrijanaL+1YrM54DJmfny3nu/On3EPIlifAc97r:I16anaL+1YYuwfny6On0PIsocl

Score

7^/10

evasion link pdf

Malware Config

Signatures

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	cn.wps.moffice_eng

Checks the presence of a debugger.
evasion

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral1/files/fstream-16.dat	pdf_with_link_action

cn.wps.moffice_eng
1⤵
- Acquires the wake lock.
PID:4237

cn.wps.moffice_eng:gcmpush
1⤵
PID:4341

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cn.wps.moffice_eng/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/cn.wps.moffice_eng/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
32fc2d024ba0398d02c414a2f26d606a

SHA1
bf5983dfc2329ed4723938d453f014e0e05e32e8

SHA256
5cfb46efedb87eef2b154ad9b390ed162dcd56f7a105f6f55a97c7e661fbc02a

SHA512
27b26a628cf830502731aed6a4989be4fa25ad67844b94c3b7a735bf9943bf91aac4184bb5dabc0ac1324a80f0df4da13c28ed9befb01757515256d9f0332410

Download Submit
/data/data/cn.wps.moffice_eng/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/cn.wps.moffice_eng/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
b82cfd2d7961c332531d31c9a643651b

SHA1
8754f79fcfff68ef18552d45c6dcc7a0048dbb44

SHA256
eb5169ebd64d20dd1e7b641040481297f11b22a9db0bef6e42b920d24d957b1b

SHA512
6b95c8e48b790e6b22f69c97b8ce0f59a48d131937a4cf551e3635003bed75b9aa35c0128f0bded3ee6f9e8e3b2975cc4e666d2a4bfea5c0b261ed03e189c3d8

Download Submit
/data/data/cn.wps.moffice_eng/databases/google_app_measurement_local.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/cn.wps.moffice_eng/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
625e3982ac28cc0dcd637baad24b6870

SHA1
ef80fb33782818ffba0b11208126c4de3f906337

SHA256
bc5bbeca44b49878160dc3f44819037d32bfdbad1888dbec2a916667d6724f9b

SHA512
6bb6a982a6c4771e3d0c683120f51177ee336247464b14840f75923e73464de591dbed2d4ce1759e68543c1e5446b9a9097d8b18a735003fe962fc0858bf6c74

Download Submit
/data/data/cn.wps.moffice_eng/databases/google_app_measurement_local.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/cn.wps.moffice_eng/databases/google_app_measurement_local.db-wal

Filesize
40KB

MD5
c6ea6fb3640ab6d97be3866132d0e71a

SHA1
e8c395b4c12056aa937b83dca5f7fcd4b9bdcd36

SHA256
925765cd5daa0628ebbd1006f7612fede73c64c1ea5db5ad81da2acaaa0d3938

SHA512
db6f1db2b68c813167308b6c10926f887d4de4e6288e36eb2615a401d48d405680c11b2e0d1b09b487338aa1f56ed1515b5ca595c62fb4ae0b0182547f13789e

Download Submit
/data/data/cn.wps.moffice_eng/databases/google_app_measurement_local.db-wal

Filesize
36KB

MD5
02d612ca09694d1645c165eefc52eb8b

SHA1
99c745e1fdc0d9b10a8225c02bd373385c3188bd

SHA256
1735c03f94e746fc35a8b8a8f7b0bb3aa57a27c9b11ee6537ac3578b01e21fd7

SHA512
04e671e37479069b73719e7d8b8c73c03ad5caeb7af1da522c719749a0b0baef9b185d9771f6d8c2e51a9d74815f4ab1b024550d8482dc9d004c0298d70fefd0

Download Submit
/data/data/cn.wps.moffice_eng/files/.com.google.firebase.crashlytics.files.v2:cn.wps.moffice_eng/open-sessions/652A59F501690001108DA42BEBD19D0C/keys

Filesize
40B

MD5
da692d140ae1f944a10fb055db1ef42a

SHA1
dcb74d95c6c249234091396257b44bf29ed64ec2

SHA256
523002aceb5eac76100f7d0d91dff06a192e4061ff8480ced405c342fa2ca442

SHA512
813c48a8f897612bd289f152718fe46544fce0172d53ab8d56a5377c56264d7aad8c4e0ab70a9adf6adf149c4f45693f90de118fe1a217b91bf65573ff313787

Download Submit
/data/data/cn.wps.moffice_eng/files/.com.google.firebase.crashlytics.files.v2:cn.wps.moffice_eng/open-sessions/652A59F501690001108DA42BEBD19D0C/keys

Filesize
72B

MD5
31f95123dad211e216cd895266d9c900

SHA1
200f8d1039f0237496cccf62c264fa5963bd014d

SHA256
a5fc19ba2eeb790be73ea51c5a8c14f67122bc806b3dec236ade02efd31fcd57

SHA512
645f4cafabe8fe1459b5fdd89161c803f69210acf39dcdf8f485c812634bf3c52ca0f7728ece269f96c5b7a432f0275b755b30489cdbd95afac5e775ffc39c6c

Download Submit
/data/data/cn.wps.moffice_eng/files/.com.google.firebase.crashlytics.files.v2:cn.wps.moffice_eng/open-sessions/652A59F501690001108DA42BEBD19D0C/keys

Filesize
81B

MD5
63c567aa6fddfabf5d3485f0bba2629d

SHA1
1dc5e9d6ff52b6fa689d6a81be2499cdb5357427

SHA256
f7347f15236bdf19af9eb40ab9da27b15f394595cc4d3b0947402e63091fcf72

SHA512
af0845ce677601105e57e75f3aeec3a216a408f1d120a41cb71a72773c26a2e5dd297e2f3bd217c7161adb1a08dae510c7002ea36dc2949530783c310d317d56

Download Submit
/data/data/cn.wps.moffice_eng/files/.com.google.firebase.crashlytics.files.v2:cn.wps.moffice_eng/open-sessions/652A59F501690001108DA42BEBD19D0C/keys

Filesize
300B

MD5
6c5922c302d840d5c32d7ba6caa27bbd

SHA1
5863739d313a3d677b01b9b0943265fecff52387

SHA256
6a8feb0a21dbcbb657fd3e9d6ce5723a1fbc2466e2e1a86ac5cc0e3d75f916a6

SHA512
d20a97f4e6cacdf1c23afd5ca0d7768836dff368d115e022b371fa5f44b25d1a139d3898b8eb5dccc59b21228cd0a7c4e8bf486f42ee68d66a3e29184fa079f0

Download Submit
/data/data/cn.wps.moffice_eng/files/.com.google.firebase.crashlytics.files.v2:cn.wps.moffice_eng/open-sessions/652A59F501690001108DA42BEBD19D0C/report

Filesize
737B

MD5
42b1f67b83253ef0fd9ee5e0f723daa8

SHA1
2a3fc47d4b9f1be2031292a9592447395083e9d0

SHA256
88fe627631d097b02c4e949566023adc170bc2cbb6dee4eb9e681ab00f5b2ad0

SHA512
eae635f6198e3109b8319b630b3227925829c62f1bcf769bf0854b3ebb271862f93a475f3a1e9196e2ab544a8f62b4d66730f7d2eca7a749d2c9204469c9dbd3

Download Submit
/data/data/cn.wps.moffice_eng/files/.com.google.firebase.crashlytics.files.v2:cn.wps.moffice_eng/open-sessions/652A59F501690001108DA42BEBD19D0C/user-data

Filesize
45B

MD5
c72b9f1ec1e5f361c06a03e2752cc3be

SHA1
037dd1cd2bef43f8fcb07da8755fc151c564711c

SHA256
fdd7f664e3483d70fe7b558a57e5c1dfbfa371b2f9980791a33c846786a12316

SHA512
1c427976bb85315bf33c5ad859dd1b0460abd171bc7f816b8a2219a8c679722a9f271519f75dfc70d3fa5953e82da1d9f74736bd1997ecce1977429ea8ec964c

Download Submit
/data/data/cn.wps.moffice_eng/files/.com.google.firebase.crashlytics.files.v2:cn.wps.moffice_eng_gcmpush/open-sessions/652A59F901FD000110F5A42BEBD19D0C/report

Filesize
32KB

MD5
334990c30e1862eb7b9b857c20bd7bd6

SHA1
d4cb5c74eda9ce576286164f3cf3f44b2d88aacd

SHA256
20ec38bada128e9ef43e7c96dd1b92d91373ec588866cd8d22735be11e8b81b4

SHA512
81722405f1bd0d277aa8b12bb2cf772247ef1cf00fbdf2b4a8ebd4f6df4c7ccb6b7b6944ecd0c9d073d643f6aeb1e14c47b15a6da734477505b560a413b42a0a

Download Submit
/data/data/cn.wps.moffice_eng/files/PersistedInstallation2064493228332308108tmp

Filesize
559B

MD5
dab85ac7e02fac6a53f119f6502ed3c7

SHA1
e93c758e1464cb232a003fa13cc3574024a90ce9

SHA256
8926764a9cca2ed2afb875caa341d3995bb84a2c4bc28669c8752bcd40bcdab3

SHA512
12cabc3f6af942d5cbfff6b4ce9fd0651231c5a3204b36c2163ec3aa05e8593a8b5d6107c998748a24dd047553536ffc43f8c2444c20f67d4c7c31280aaa1ff9

Download Submit
/data/data/cn.wps.moffice_eng/files/PersistedInstallation8895741686786514567tmp

Filesize
90B

MD5
37f5b4775a8fdeadbea86f03d10e93bf

SHA1
8a66f208d312f3a0cc6412a3d0417cfcba80f418

SHA256
070eaaf48226d972e2d9ebf5c41ada9d81e4988db84e52b8fa514afe1e2d5828

SHA512
ae744b2294aade52d3f32309576f1a0dfdf8d00c7927efcea1cd5f4acba65c1d119f2e3a6267fbc290f5463f17182a561ff7ae6bf01698752ea19cc2779208a4

Download Submit
/data/data/cn.wps.moffice_eng/files/mmkv/ServerAttributes_en

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/cn.wps.moffice_eng/files/mmkv/ServerAttributes_en.crc

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/cn.wps.moffice_eng/files/mmkv/ServerData_en

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/cn.wps.moffice_eng/files/mmkv/ServerData_en.crc

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/cn.wps.moffice_eng/files/mmkv/login_config

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/cn.wps.moffice_eng/files/mmkv/login_config.crc

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/cn.wps.moffice_eng/files/mmkv/public_default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/cn.wps.moffice_eng/files/mmkv/public_default.crc

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/cn.wps.moffice_eng/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
06c07fe7dce8268eb4c5b33d7ea2fc5c

SHA1
3a802782aec378c3fec318392aaef616476a5759

SHA256
e10f1b8042150b9d04905477abebf1f559e5e1b7d9a5bbd6004d65c9b761d1b3

SHA512
b179fa1c1e1a35d1f2419a70141ffbb31113db8a99f0a4d49303219828bd100b12063383a0f53e078e9b66ddf4641f170eb121cfb29b5de58d8543353113af14

Download Submit
/data/data/cn.wps.moffice_eng/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/cn.wps.moffice_eng/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
7156cc1be091774ccae8d042cbe89228

SHA1
ff49ead531ff18429732622262e4047587117e91

SHA256
d6fb4ebeb168aab07e94188242e8c007718b7ccff3cfeb91ff65f29ae388341f

SHA512
b2c6432a919489f3ce647686863ec54dc55afb8fee10222d32145853ff8951d5ef2491e09d6676aed7d65ef8fe36138116b61031c57429304f6651a4c4a6d967

Download Submit
/data/data/cn.wps.moffice_eng/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
334990c30e1862eb7b9b857c20bd7bd6

SHA1
d4cb5c74eda9ce576286164f3cf3f44b2d88aacd

SHA256
20ec38bada128e9ef43e7c96dd1b92d91373ec588866cd8d22735be11e8b81b4

SHA512
81722405f1bd0d277aa8b12bb2cf772247ef1cf00fbdf2b4a8ebd4f6df4c7ccb6b7b6944ecd0c9d073d643f6aeb1e14c47b15a6da734477505b560a413b42a0a

Download Submit
/data/data/cn.wps.moffice_eng/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
49695efb9d22f75ec58f6f145f35de61

SHA1
8623f415746216c5cf857df52c9d2d194fab1501

SHA256
7a45976c18630c1003d216cd965b01e1a8317bc6faef9171ffb16d927544000e

SHA512
16b2e721722f5d41b58baec7464deae64d54f130171a73fa133835da4168705559c2a7e4f354b714ee841f816a0177641b8e3e6ea29271a9952167a74d7ef429

Download Submit
/data/data/cn.wps.moffice_eng/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
7cfd756e600262d73578528bc8f9c8fb

SHA1
78e41eb04b46627f6dc958e0b5f38c0210a97afe

SHA256
d24efd9aef13d002c3dc18c3a24468c1b80ceeb03c67969480ffa69e34abaa19

SHA512
093049e0f2868b120c22efba57f45ace57b4d586bea6ed55b9eea919772f520c62bd0a0299bc7ee6058c84f1e7b4053a44031a0c62ab568316e1689066f53d5a

Download Submit
/data/misc/profiles/cur/0/cn.wps.moffice_eng/primary.prof

Filesize
23KB

MD5
f0634c6df84eeb5fe106b48ab873fa20

SHA1
9c3bff30bcf29590561bec677053c62815be7d20

SHA256
694e141ec330dd5b46acab4ed0929909d71f02c158f3c9390b373af7050b2891

SHA512
d5be80c1c780a41e54cccedeaad776c65ab5ee982d7a2f119552a8c9aec039bd667b1435da4b062395585f1a562b19ab1d4f8b3ce7571868580d6e79f3f1d1e5

Download Submit
/storage/emulated/0/Android/data/cn.wps.moffice_eng/.cache/KingsoftOffice/file/Get Started with WPS Office for Android.pdf

Filesize
2.2MB

MD5
cc175e5535991e4b406c2fb024a6f025

SHA1
e60a185551e2347c65704d18b47c66f7b2702326

SHA256
3e144a9ddcedccf2bb037de7c9f86d8ede2da069526fd56d26f041d9259213eb

SHA512
a3ed2d6ee7852c1e1425209a12ba932c1e459272691b020676068fed23ad6ca2afdbcf468f4040fcb67b252c64543ca09d9db18a35b83839353a4c103eee44c6

Download Submit
/storage/emulated/0/Android/data/cn.wps.moffice_eng/.cache/KingsoftOffice/file/Interesting Sudoku Game.xlsx

Filesize
30KB

MD5
65875f9cce812ef4b346c8d7fa84910a

SHA1
768ac8b47df5f81148f76d0d0a8779a002a6a87f

SHA256
4a71f028070a2312bac13a8b69d62ee11c429ab48b8c54f6dab28760c0a81d26

SHA512
7f6e7bb36bbe2d88aa14e231cd3ec3e47ae4bce0ba9a42c33cedb5a146ab18c91ea5f5df9f6166aaad1ffad09e9f4cf556bf111be849248cad03e973195d9b46

Download Submit
/storage/emulated/0/Android/data/cn.wps.moffice_eng/cache/entry_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads