General

  • Target

    YouTube_base.apk

  • Size

    23.6MB

  • MD5

    ac8fc22e20f9ba52821c1452c7fe0143

  • SHA1

    8e6a84ffbea23f826a3ece784ed94c1b3059e24c

  • SHA256

    489c0685ab3bf975567a3f1911c300546b469715c535506a1ba6477357b1ad36

  • SHA512

    6a410ec2f2595406d308c4938838593cf50dd1eb63f670d622bed3caa62375be00da5a4544be3675d78d0d34d2ece86dc11abef48196fcb2540aec8ae0210446

  • SSDEEP

    393216:cftrLLUuzukkAbJJ9F2wmPJelalU3RZ//9ZMgcD+CrLnF/GUjzg2FG55AAjUfHm:4tTDzuk7/9F2DBjKhx/HlbFMquAT

Score
7/10

Malware Config

Signatures

  • Requests dangerous framework permissions 12 IoCs

Files

  • YouTube_base.apk
    .apk android

    com.google.android.youtube

    com.google.android.apps.youtube.app.application.Shell_SettingsActivity


  • 42_js_module_config.dat
    .js
  • CarroisGothicSC-Regular.ttf
  • ComingSoon-Regular.ttf
  • DancingScript-Regular.ttf
  • MonoSerif-Regular.ttf
  • YTSans-Medium.otf
  • account_link_button.eml_8e6c0b534a3c549e
  • ad_badge.eml_e3a73cca01716c61
  • advanced_quality_sheet_content.eml-js_f03eadebbd3fafb5
  • advanced_quality_sheet_content_controller_53a5e6cde5cdb861
    .js
  • android_builtin_effects_settings.binarypb
  • android_shorts_timeline_builtin_effects_settings.binarypb
  • animated_button_border.eml_6bf905c2d7df1d4c
  • animated_checkbox.eml_f24e5f8d0c01a844
  • animated_like_icon.eml_a5f69c6c3da4c7e8
  • animated_subscribe_button.eml_c7cf2623ea6924f0
  • animated_subscribe_button_v2.eml_455f8c6655fe6e5d
  • audio_track_sheet_content.eml-js_41d3425823a3bbc6
  • audio_track_sheet_content_controller_d1b70101eef98b7a
    .js
  • avatar.eml_3ede005154fafd4b
  • avatar_with_ring.eml_ce3cd0d8042017db
  • badge.eml_9d6221066c0334f0
  • baseline.prof
  • baseline.profm
  • bell_inline_menu.eml_244ba658a18507dc
  • bell_inline_menu_item.eml_71706de4048a35cc
  • bottom_sheet_header.eml_7e78a7a62803b1cb
  • bottom_sheet_list_option.eml_1117cedafb0dcba
  • button.eml_3d8eac1823456f65
  • caption_tracks.eml-js_f974500e49b48fe7
  • caption_tracks_controller_c0d77124905cd122
    .js
  • captions_sheet_content.eml-js_2f4c46d970a31e86
  • captions_sheet_content_controller_3b7619bce6e3bf76
    .js
  • cast_error_mapper_prod_container_manifest
    .js
  • cell_divider.eml_bfcce5c18e92e622
  • channel_purchase_button.eml_c7c3dd0426ad3086
  • clip_button.eml_94bdf2920112e9bb
  • collection_thumbnail.eml_2160266fe2b928c2
  • com_android_billingclient_package_metadata.binarypb
  • com_google_android_gms_device_performance_package_metadata.binarypb
  • com_google_android_libraries_consentverifier_package_metadata.binarypb
  • com_google_android_libraries_mdi_sync_package_metadata.binarypb
  • com_google_android_libraries_notifications_package_metadata.binarypb
  • com_google_android_libraries_notifications_platform_package_metadata.binarypb
  • com_google_android_libraries_onegoogle_package_metadata.binarypb
  • com_google_android_libraries_performance_primes_package_metadata.binarypb
  • com_google_android_libraries_user_profile_photopicker_package_metadata.binarypb
  • com_youtube_mainapp_android_package_metadata.binarypb
  • comments_entry_point_button.eml_1b383033d89d0513
  • compact_channel_bar.eml_88d4db97f764f58b
  • compact_channel_bar_header.eml_b63e9439d4081e3c
  • compact_channel_bar_inner.eml_62e3cb637f214060
  • compact_sponsor_button.eml_ffa89baba3a17f94
  • compact_subscribe_button.eml_5827962b34d24089
  • compact_video.eml_8bf9126618694ca4
  • datapush_release_version.binarypb
  • decorated_avatar.eml_45f9107ba433378b
  • dislike_button.eml_e4966aa5a92a2d85
  • divider.eml_eddb8da2c1be483b
  • download_button.eml_b409be755785e58b
  • download_icon.eml_dbd71044a8a5a2bf
  • download_icon_with_partial_playability.eml_842cab05f5448be9
  • downloads_page_banner.eml_87d3cc35551e5725
  • downloads_page_disclaimer.eml_276f447a2a9ee5b6
  • downloads_page_download_recommendations_header.eml_ac733747ca221a14
  • downloads_page_loading_spinner.eml_9c1aae528f9c2617
  • downloads_page_smart_downloads_header.eml_8ead98d15e9aed58
  • downloads_page_smart_downloads_header_unwrapper.eml_f014479a551201bf
  • downloads_page_smart_downloads_opt_in_banner.eml_afd42d6f09c6281c
  • downloads_page_smart_downloads_zero_state.eml_8b2a5fc393384fd6
  • downloads_page_zero_state.eml_8d1b79a7a6429007
  • downloads_thumbnail_overlay.eml_4b90478d1f4994c6
  • drag_and_drop_shadow.eml_e7f2df905f680f2c
  • dream_plasma_overlay_alpha.png
    .png
  • dream_time_blur_weights.png
    .png
  • embedded_filegroups_embedded_datapush_proto.dat
  • error_message.eml_faad81ff0a6fed15
  • fragment_shader_alpha_scale_es2.glsl
  • fragment_shader_copy_es2.glsl
  • fragment_shader_hsl_es2.glsl
  • fragment_shader_lut_es2.glsl
  • fragment_shader_oetf_es3.glsl
  • fragment_shader_transformation_es2.glsl
  • fragment_shader_transformation_external_yuv_es3.glsl
  • fragment_shader_transformation_hdr_internal_es3.glsl
  • fragment_shader_transformation_sdr_external_es2.glsl
  • fragment_shader_transformation_sdr_internal_es2.glsl
  • fragment_shader_transformation_sdr_oetf_es2.glsl
  • frame_blurred.png
    .png
  • fullscreen_video_action_button.eml_e2e16dfbe54d8f47
  • image_preview_supergraph.binarypb
  • info_card_teaser_overlay.eml-js_4efd8d34e13e562a
  • info_card_teaser_overlay_controller_9ffd57f9c1be0578
    .js
  • like_button.eml_8373bb4390d3a303
  • listen_first_suggested_action_controller_9321fef2ce4d0670
    .js
  • listen_first_suggested_action_v2.eml-js_ccf8f56940d969d4
  • live_ring.eml_cf45bfc58bd6ca66
  • lut_BEAM.png
    .png
  • lut_BEAM_2.png
    .png
  • lut_BLUSH.png
    .png
  • lut_CRUSH.png
    .png
  • lut_DAWN.png
    .png
  • lut_DOCUMENTARY.png
    .png
  • lut_GLAMOUR.png
    .png
  • lut_GLOW.png
    .png
  • lut_NOIR.png
    .png
  • lut_POP.png
    .png
  • lut_SILVERSCREEN.png
    .png
  • lut_SLATE.png
    .png
  • lut_SUPER8.png
    .png
  • mainapp_filegroup_datapush_manifest.dat
  • me_fragment_shader_es2.glsl
  • me_vertex_shader_es2.glsl
  • media_engine_audio_container_manifest
  • metadata.eml_8d362e6f68b256ce
  • metadata_content.eml_3bdf752d3b9e3de0
  • modern_type_metadata_content.eml_b33a37798c60681
  • notification_bell.eml_188bbc553f4e7655
  • notification_dot.eml_9695f826d7cc0572
  • offline_status_indicator.eml_cc2ff13d394a756d
  • overflow_button.eml_2b61b7e1feae3ab6
  • paid_content_overlay_controller_4c483a9990c41d39
    .js
  • paid_content_overlay_v2.eml-js_7e1c1cdc1d5e4544
  • playback_quality_list.eml_2e54737097c94374
  • playback_quality_picker.eml_d3dd3276b3c87150
  • playback_quality_picker_preview.eml_bf3c69ad79588836
  • playback_speed_sheet_content.eml-js_bf32993ab6b33adb
  • playback_speed_sheet_content_controller_77422fa63250429a
    .js
  • player_disclosure.eml_b7821feae086f5b3
  • playlist_add_to_option.eml-js_258e6e940c5d38eb
  • playlist_add_to_option_controller_c990527e237188d8
    .js
  • playlist_add_to_option_wrapper.eml-js_e136e043b0fe1716
  • qos_container_manifest
  • quality_sheet_footer.eml_b4d5cfd85b686e76
  • quality_sheet_header.eml-js_c200e640e0c4a9b1
  • quality_sheet_header_controller_bcbca3a3eef3259
    .js
  • query_engine_container_manifest
  • query_engine_container_manifest.dat
  • quick_quality_sheet_content.eml-js_d6e66991f42d951d
  • quick_quality_sheet_content_controller_c073b38672cf3682
    .js
  • radio_button.eml_bc0d1da712cd1b01
  • radio_picker.eml_81ab48f0a77d5221
  • radio_picker_option.eml_b4bf6e080f328f
  • root_752bab254d2c8633
    .js
  • save_to_playlist_button_vm.eml_98fae9fa3fa05287
  • segmented_like_dislike_button.eml_2c25f907408dbdac
  • segmented_like_dislike_button_vm.eml_c1daffa51f1a5aba
  • silver_screen_grain.png
    .png
  • snackbar.eml_12ee188c3e616d58
  • spinner.eml_9c38c7d5f92b7ed8
  • status_dot.eml_cd396ea60a3037b2
  • subscribe_button.eml_6425aac3febf3096
  • subscribe_menu_button.eml_b7e7fe665ae0dbb
  • subscribe_menu_notifications.eml_76018212a733f370
  • suggested_action.eml_8b201f82d405bb3f
  • super8_frame.png
    .png
  • super8_grain.png
    .png
  • switch_button.eml_fc5ee0619f2c6a69
  • sy0_752bab254d2c8633
    .js
  • sy1_752bab254d2c8633
  • sy2_752bab254d2c8633
  • sy3_752bab254d2c8633
    .js
  • sy4_752bab254d2c8633
    .js
  • sy5_752bab254d2c8633
    .js
  • sy6_752bab254d2c8633
    .js
  • sy7_752bab254d2c8633
    .js
  • sy8_752bab254d2c8633
    .js
  • sy9_752bab254d2c8633
  • sya_752bab254d2c8633
    .js
  • syb_752bab254d2c8633
  • syc_752bab254d2c8633
  • syd_752bab254d2c8633
  • sye_752bab254d2c8633
  • syf_752bab254d2c8633
  • syg_752bab254d2c8633
    .js
  • syh_752bab254d2c8633
  • syi_752bab254d2c8633
  • syj_752bab254d2c8633
    .js
  • syk_752bab254d2c8633
    .js
  • syl_752bab254d2c8633
    .js
  • sym_752bab254d2c8633
  • thumbnail.eml_59ab0a0e3423bc23
  • timely_action.eml-js_c7750d348ae277f9
  • timely_action_controller_98cb26f5f401721f
    .js
  • timely_action_delegate_f777006a9caae174
  • timely_actions_overlay.eml-js_98e8331395e46ca
  • timely_actions_overlay_controller_fdf20473c78124b6
    .js
  • toggle_button.eml_afa073977d511414
  • toggle_button_inner.eml_a619d02520fe475f
  • triptych_thumbnail.eml_5657bd57375de76e
  • verified_badge.eml_849ace48910b73c3
  • vertex_shader_thumbnail_strip_es2.glsl
  • vertex_shader_transformation_es2.glsl
  • vertex_shader_transformation_es3.glsl
  • video_action_bar.eml_2757d7fc26424bc
  • video_action_button.eml_e696762efa047f53
  • video_action_button_pill.eml_9e0aba70339c31d6
  • video_action_toggle_button.eml_5c286008cad94823
  • video_badge.eml_b9879b82f0474b18
  • video_metadata.eml_ea421d692ac861e8
  • video_metadata_inner.eml_d710d9a5a0d816a2
  • video_subtitle.eml_8992019ea7c4d1da
  • vignette.png
    .png
  • youtube_activity_container_manifest.dat
  • youtube_mobile_master_cert_2020_public_key
  • youtube_mobile_master_cert_2021_public_key
  • youtube_mobile_master_cert_2022_public_key
  • youtube_mobile_master_cert_2023_public_key
  • youtube_prod_container_manifest.dat
  • youtube_sans.xml
    .xml
  • youtube_sans_black.xml
    .xml
  • youtube_sans_bold.xml
    .xml
  • youtube_sans_bold_font.ttf
  • youtube_sans_extrabold.xml
    .xml
  • youtube_sans_light.xml
    .xml
  • youtube_sans_medium.xml
    .xml
  • youtube_sans_semibold.xml
    .xml
  • youtube_singleton_account_container_manifest.dat

Android Permissions

YouTube_base.apk

Permissions

android.permission.READ_MEDIA_VISUAL_USER_SELECTED

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_VIDEO

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.MANAGE_DOCUMENTS

android.permission.GET_ACCOUNTS

android.permission.MANAGE_ACCOUNTS

com.google.android.providers.gsf.permission.READ_GSERVICES

com.google.android.c2dm.permission.RECEIVE

android.permission.WAKE_LOCK

android.permission.NFC

android.permission.CAMERA

android.permission.FOREGROUND_SERVICE_CAMERA

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.FOREGROUND_SERVICE_MICROPHONE

android.permission.VIBRATE

com.google.android.gms.permission.AD_ID_NOTIFICATION

com.google.android.gms.permission.AD_ID

com.google.android.youtube.permission.C2D_MESSAGE

android.permission.GET_PACKAGE_SIZE

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK

android.permission.RUN_USER_INITIATED_JOBS

android.permission.USE_FINGERPRINT

android.permission.USE_BIOMETRIC

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.READ_CONTACTS

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.RECORD_AUDIO

android.permission.READ_PHONE_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.HIGH_SAMPLING_RATE_SENSORS

com.sec.android.provider.badge.permission.READ

com.sec.android.provider.badge.permission.WRITE

com.htc.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.UPDATE_SHORTCUT

com.sonyericsson.home.permission.BROADCAST_BADGE

com.sonymobile.home.permission.PROVIDER_INSERT_BADGE

android.permission.POST_NOTIFICATIONS

android.permission.ACCESS_ADSERVICES_ATTRIBUTION

android.permission.ACCESS_ADSERVICES_AD_ID

com.google.android.youtube.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION