e79fd8a39ecbad6155a2f7bb39ccf24f3207f3704f5b8873d7dc77769ee6a276

Sharing

Copy URL Twitter E-mail

General

Target

e79fd8a39ecbad6155a2f7bb39ccf24f3207f3704f5b8873d7dc77769ee6a276
Size

26.3MB
MD5

77f7eda01be68cae1bc8a00b9960993e
SHA1

352625118d649be6026f5ed39b4b702c8188282a
SHA256

e79fd8a39ecbad6155a2f7bb39ccf24f3207f3704f5b8873d7dc77769ee6a276
SHA512

3bff3697f1cee13f86aab80e2e66fb373097ad203ca0a5210e9e44610aceed85984df829359988f1fa453bbcad8b301361739834615fecf7343bd66d8eaf5d67
SSDEEP

786432:AKHFJli2Y4bQYMR/BWp2cRo+UlkqJ7I0V4GvcRgcZWD:Aj2YTYMtGDRo+UlVxI0u3RsD

Score

8^/10

upx

Malware Config

Signatures

Patched UPX-packed file 5 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx
sample	patched_upx
sample	patched_upx
sample	patched_upx
sample	patched_upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx
sample	upx
sample	upx
sample	upx
sample	upx

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

Files

e79fd8a39ecbad6155a2f7bb39ccf24f3207f3704f5b8873d7dc77769ee6a276
.apk android arch:arm

com.gewara

com.gewara.main.CoverActivity

Activities

com.gewara.main.CoverActivity

android.intent.action.MAIN

com.gewara.main.GewaraMainActivity

android.intent.action.VIEW

com.gewara.activity.common.CitySettingActivity

android.intent.action.VIEW

com.gewara.activity.qrcode.CaptureActivity

android.intent.action.VIEW

com.gewara.activity.common.CinemaMapActivity

android.intent.action.VIEW

com.gewara.activity.usercenter.UserAccountActivity

android.intent.action.VIEW

com.gewara.main.order.YPMyOrderActivity

android.intent.action.VIEW

com.gewara.activity.usercenter.MoreComplainActivity

android.intent.action.VIEW

com.gewara.activity.search.SearchAllActivity

android.intent.action.VIEW

com.tencent.tauth.AuthActivity

android.intent.action.VIEW

com.gewara.main.TestActivity

android.intent.action.VIEW

com.meituan.android.mrn.container.MRNBaseActivity

android.intent.action.VIEW

com.gewara.mrn.MyMrnActivity

android.intent.action.VIEW

com.gewaradrama.activity.DramaCalendarActivity

android.intent.action.VIEW

com.gewaradrama.activity.DramaDetailActivity

android.intent.action.VIEW

com.gewaradrama.activity.UserAcceptAddressActivity

android.intent.action.VIEW

com.gewaradrama.activity.YPMyShowOrderDetailActivity

android.intent.action.VIEW

com.gewaradrama.activity.YPShowPaySuccessActivity

android.intent.action.VIEW

com.gewaradrama.activity.DramaOrderShareActivity

android.intent.action.VIEW

com.gewaradrama.activity.MyTheatreDetailActivity

android.intent.action.VIEW

com.gewaradrama.chooseseat.YPShowChooseSeatActivity

android.intent.action.VIEW

com.gewaradrama.activity.MYShowPointCardActivity

android.intent.action.VIEW

com.gewara.trade.MoviePointCardActivity

android.intent.action.VIEW

com.gewara.trade.seat.MovieSelectSeatActivity

android.intent.action.VIEW

com.gewara.trade.pay.MoviePaySeatActivity

android.intent.action.VIEW

com.gewara.trade.pay.MovieSeatPayResultActivity

android.intent.action.VIEW

com.gewara.trade.cinema.MoviePoiCinemaActivity

android.intent.action.VIEW

com.gewara.trade.MovieFansMeetingActivity

android.intent.action.VIEW

com.maoyan.android.pay.cashier.CashierActivity

android.intent.action.VIEW
android.intent.action.VIEW

com.gewara.trade.cinema.MovieCinemaListActivity

android.intent.action.VIEW

com.gewara.trade.deal.MovieDealListActivity

android.intent.action.VIEW

com.gewara.trade.deal.MovieDealOrderConfirmationActivity

android.intent.action.VIEW

com.gewara.trade.deal.MovieDealDetailActivity

android.intent.action.VIEW

com.gewara.trade.deal.MovieDealPayResultActivity

android.intent.action.VIEW

com.gewara.trade.pay.MoviePayEmemberCardActivity

android.intent.action.VIEW

com.gewara.trade.pay.MovieEmemberCardPayResultActivity

android.intent.action.VIEW

com.gewara.trade.cinema.MovieCinemaDetailActivity

android.intent.action.VIEW

com.gewara.trade.trailer.MovieTrailerActivity

android.intent.action.VIEW

com.gewara.trade.order.seat.MovieSeatOrderDetailActivity

android.intent.action.VIEW

com.gewara.trade.deal.MovieDealMerchantListActivity

android.intent.action.VIEW

com.gewara.trade.deal.MovieDealOrderDetailActivity

android.intent.action.VIEW

com.gewara.trade.movielist.MovieListActivity

android.intent.action.VIEW

com.gewara.trade.MovieFansMeetingShareActivity

android.intent.action.VIEW

com.maoyan.android.presentation.sns.news.RelativeNewsItemActivity

android.intent.action.VIEW

com.maoyan.android.presentation.sns.news.MYNewsDetailActivity

android.intent.action.VIEW

com.maoyan.android.gewara.medium.services.MYGewaraMovieDetailActivity

android.intent.action.VIEW

com.maoyan.android.presentation.mediumstudio.shortcomment.MYUserShortCommentsActivity

android.intent.action.VIEW

com.maoyan.android.presentation.mediumstudio.shortcomment.MYEditShortCommentActivity

android.intent.action.VIEW

com.maoyan.android.presentation.mediumstudio.mine.UserMovieListWishActivity

android.intent.action.VIEW

com.maoyan.android.presentation.mediumstudio.shortcomment.MYShareShortCommentActivity

android.intent.action.VIEW

com.maoyan.android.presentation.mediumstudio.shortcomment.MYShortCommentDetailActivity

android.intent.action.VIEW

com.maoyan.android.presentation.mediumstudio.shortcomment.MYShareMovieWishActivity

android.intent.action.VIEW

com.maoyan.android.presentation.mediumstudio.gallery.MYMovieGalleryTypesActivity

android.intent.action.VIEW

com.maoyan.android.presentation.mediumstudio.gallery.MYMovieGalleryImageActivity

android.intent.action.VIEW

com.maoyan.android.presentation.actor.MYActorDetailActivity

android.intent.action.VIEW

com.maoyan.android.presentation.activity.MovieSearchActorActivity

android.intent.action.VIEW

com.maoyan.android.presentation.activity.MovieSearchActivity

android.intent.action.VIEW

com.gewara.base.knb.KNBActivity

android.intent.action.VIEW

com.maoyan.android.adx.web.ThirdPartyWebActivity

android.intent.action.VIEW

com.maoyan.android.pay.cashier.ccb.CCBResultActivity

comccbpay80001maoyanccb

com.maoyan.android.pay.cashier.CardBinCheckActivity

android.intent.action.VIEW

com.maoyan.android.pay.cashier.WebPayActivity

android.intent.action.VIEW

com.dianping.base.push.pushservice.HWPushDetailActivity

android.intent.action.VIEW
dpmtpush.action.oppopush
com.dianping.dpmtpush.CLICK_NOTIFICATION

com.maoyan.account.LoginMainActivity

com.maoyan.android.intent.action.login

com.sina.weibo.sdk.share.WbShareTransActivity

com.sina.weibo.sdk.action.ACTION_SDK_REQ_ACTIVITY

com.sina.weibo.sdk.share.WbShareToStoryActivity

com.sina.weibo.sdk.action.ACTION_SDK_REQ_STORY

com.sankuai.meituan.android.knb.base.PageNavigator

android.intent.action.VIEW

Permissions

android.permission.DOWNLOAD_WITHOUT_NOTIFICATION
android.permission.WRITE_SETTINGS
android.permission.ACCESS_WIFI_STATE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.CHANGE_WIFI_STATE
android.permission.INTERNET
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_NETWORK_STATE
android.permission.VIBRATE
android.permission.RESTART_PACKAGES
android.permission.READ_PHONE_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.CAMERA
android.permission.GET_TASKS
android.permission.READ_EXTERNAL_STORAGE
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.CHANGE_CONFIGURATION
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.FLASHLIGHT
android.permission.CALL_PHONE
android.permission.WAKE_LOCK
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
com.android.launcher.permission.READ_SETTINGS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.CHANGE_NETWORK_STATE
android.permission.NFC
android.permission.ACCESS_NETWOEK_STATE
android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.ACCESS_LOCATION_EXTRA_COMMANDS
org.simalliance.openmobileapi.SMARTCARD
android.permission.R
com.meizu.flyme.push.permission.RECEIVE
com.coloros.mcs.permission.RECIEVE_MCS_MESSAGE
com.gewara.push.permission.MESSAGE
com.meizu.c2dm.permission.RECEIVE
com.gewara.permission.C2D_MESSAGE
android.permission.DEVICE_POWER

Receivers

com.gewaradrama.net.state.NetworkStateReceiver

android.net.conn.CONNECTIVITY_CHANGE

com.gewara.base.push.PushReceiver

com.dianping.dpmtpush.RECEIVE_PASS_THROUGH_MESSAGE
com.dianping.dpmtpush.RECEIVE_STATUS
com.dianping.dpmtpush.RECEIVE_TOKEN

com.xiaomi.push.service.receivers.NetworkStatusReceiver

android.net.conn.CONNECTIVITY_CHANGE

com.xiaomi.push.service.receivers.PingReceiver

com.xiaomi.push.PING_TIMER

com.dianping.xiaomipush.MiPushMessageReceiver

com.xiaomi.mipush.RECEIVE_MESSAGE
com.xiaomi.mipush.ERROR

com.dianping.huaweipush.HWPushMessageReceiver

com.huawei.android.push.intent.REGISTRATION
com.huawei.android.push.intent.RECEIVE
com.huawei.android.push.intent.CLICK
com.huawei.intent.action.PUSH_STATE

com.huawei.hms.support.api.push.PushEventReceiver

com.huawei.intent.action.PUSH

com.dianping.meizupush.MZPushReceiver

com.meizu.flyme.push.intent.MESSAGE
com.meizu.flyme.push.intent.REGISTER.FEEDBACK
com.meizu.flyme.push.intent.UNREGISTER.FEEDBACK
com.meizu.c2dm.intent.REGISTRATION
com.meizu.c2dm.intent.RECEIVE

com.dianping.base.push.pushservice.PhoneStatusReceiver

android.intent.action.BOOT_COMPLETED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED
android.intent.action.PROXY_CHANGE
android.appwidget.action.APPWIDGET_UPDATE
android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.USER_PRESENT

com.dianping.base.push.pushservice.PushStartReceiver

com.dianping.action.PUSH_START

com.dianping.base.push.pushservice.LogReportReceiver

com.dianping.dpmtpush.RECEIVE_PASS_THROUGH_MESSAGEsdklogrpt

com.igexin.download.DownloadReceiver

android.net.conn.CONNECTIVITY_CHANGE

com.meizu.cloud.pushsdk.SystemReceiver

com.meizu.cloud.pushservice.action.PUSH_SERVICE_START

com.meituan.android.common.horn.HornPushReceiver

com.dianping.dpmtpush.RECEIVE_PASS_THROUGH_MESSAGEhorn

com.dianping.networklog.PushMessageReceiver

com.dianping.dpmtpush.RECEIVE_PASS_THROUGH_MESSAGElogan

com.meituan.android.time.TimeChangeReceiver

android.intent.action.TIMEZONE_CHANGED
android.intent.action.TIME_SET

Services

com.dianping.base.push.pushservice.dp.DPPushService

com.dianping.action.PUSHSERVICE

com.dianping.base.push.pushservice.dp.FakeService

com.dianping.action.PUSHSERVICE

com.meituan.android.patch_service.PatchService

com.meituan.android.patch.action.PATCH

com.meituan.android.common.holmes.service.HolmesService

com.meituan.android.holmes.intent.action.HOLMESERVICE
alipay_plugin.apk
.apk android arch:arm

com.alipay.android.app

.activity.Cashier

Activities

.activity.Cashier

android.intent.action.MAIN

.activity.Alerter

android.intent.action.MAIN

.activity.Welcome

android.intent.action.MAIN

.activity.Updater

android.intent.action.MAIN

.activity.PageForBrowser

android.intent.action.VIEW

.activity.CertBiz

android.intent.action.MAIN

.activity.MessageActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.READ_PHONE_STATE
android.permission.ACCESS_COARSE_LOCATION
android.permission.SEND_SMS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECEIVE_USER_PRESENT
android.permission.VIBRATE
android.permission.CHANGE_NETWORK_STATE
com.alipay.notify.permission.PUSHSERVICE
com.alipay.android.permission.BOOT_COMPLETED
com.alipay.android.app.gphone.SHARE

Receivers

com.alipay.notify.BroadcastActionReceiver

android.intent.action.BOOT_COMPLETED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.USER_PRESENT
android.intent.action.PACKAGE_ADDED

Services

.AlixService

com.alipay.android.app.IAlixPay
com.alipay.android.app.IAliPay

com.alipay.notify.push.NotificationService

com.alipay.notify.push.NotificationService

com.alipay.notify.poll.config.ConfigService

com.alipay.notify.poll.config.ConfigService

Android Permissions

e79fd8a39ecbad6155a2f7bb39ccf24f3207f3704f5b8873d7dc77769ee6a276

Permissions

android.permission.DOWNLOAD_WITHOUT_NOTIFICATION

android.permission.WRITE_SETTINGS

android.permission.ACCESS_WIFI_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.CHANGE_WIFI_STATE

android.permission.INTERNET

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.VIBRATE

android.permission.RESTART_PACKAGES

android.permission.READ_PHONE_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CAMERA

android.permission.GET_TASKS

android.permission.READ_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.CHANGE_CONFIGURATION

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.FLASHLIGHT

android.permission.CALL_PHONE

android.permission.WAKE_LOCK

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

com.android.launcher.permission.READ_SETTINGS

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.CHANGE_NETWORK_STATE

android.permission.NFC

android.permission.ACCESS_NETWOEK_STATE

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

org.simalliance.openmobileapi.SMARTCARD

android.permission.R

com.meizu.flyme.push.permission.RECEIVE

com.coloros.mcs.permission.RECIEVE_MCS_MESSAGE

com.gewara.push.permission.MESSAGE

com.meizu.c2dm.permission.RECEIVE

com.gewara.permission.C2D_MESSAGE

android.permission.DEVICE_POWER

Sharing

General

Malware Config

Signatures

Files

com.gewara

com.gewara.main.CoverActivity

Activities

com.gewara.main.CoverActivity

com.gewara.main.GewaraMainActivity

com.gewara.activity.common.CitySettingActivity

com.gewara.activity.qrcode.CaptureActivity

com.gewara.activity.common.CinemaMapActivity

com.gewara.activity.usercenter.UserAccountActivity

com.gewara.main.order.YPMyOrderActivity

com.gewara.activity.usercenter.MoreComplainActivity

com.gewara.activity.search.SearchAllActivity

com.tencent.tauth.AuthActivity

com.gewara.main.TestActivity

com.meituan.android.mrn.container.MRNBaseActivity

com.gewara.mrn.MyMrnActivity

com.gewaradrama.activity.DramaCalendarActivity

com.gewaradrama.activity.DramaDetailActivity

com.gewaradrama.activity.UserAcceptAddressActivity

com.gewaradrama.activity.YPMyShowOrderDetailActivity

com.gewaradrama.activity.YPShowPaySuccessActivity

com.gewaradrama.activity.DramaOrderShareActivity

com.gewaradrama.activity.MyTheatreDetailActivity

com.gewaradrama.chooseseat.YPShowChooseSeatActivity

com.gewaradrama.activity.MYShowPointCardActivity

com.gewara.trade.MoviePointCardActivity

com.gewara.trade.seat.MovieSelectSeatActivity

com.gewara.trade.pay.MoviePaySeatActivity

com.gewara.trade.pay.MovieSeatPayResultActivity

com.gewara.trade.cinema.MoviePoiCinemaActivity

com.gewara.trade.MovieFansMeetingActivity

com.maoyan.android.pay.cashier.CashierActivity

com.gewara.trade.cinema.MovieCinemaListActivity

com.gewara.trade.deal.MovieDealListActivity

com.gewara.trade.deal.MovieDealOrderConfirmationActivity

com.gewara.trade.deal.MovieDealDetailActivity

com.gewara.trade.deal.MovieDealPayResultActivity

com.gewara.trade.pay.MoviePayEmemberCardActivity

com.gewara.trade.pay.MovieEmemberCardPayResultActivity

com.gewara.trade.cinema.MovieCinemaDetailActivity

com.gewara.trade.trailer.MovieTrailerActivity

com.gewara.trade.order.seat.MovieSeatOrderDetailActivity

com.gewara.trade.deal.MovieDealMerchantListActivity

com.gewara.trade.deal.MovieDealOrderDetailActivity

com.gewara.trade.movielist.MovieListActivity

com.gewara.trade.MovieFansMeetingShareActivity

com.maoyan.android.presentation.sns.news.RelativeNewsItemActivity

com.maoyan.android.presentation.sns.news.MYNewsDetailActivity

com.maoyan.android.gewara.medium.services.MYGewaraMovieDetailActivity

com.maoyan.android.presentation.mediumstudio.shortcomment.MYUserShortCommentsActivity

com.maoyan.android.presentation.mediumstudio.shortcomment.MYEditShortCommentActivity

com.maoyan.android.presentation.mediumstudio.mine.UserMovieListWishActivity

com.maoyan.android.presentation.mediumstudio.shortcomment.MYShareShortCommentActivity

com.maoyan.android.presentation.mediumstudio.shortcomment.MYShortCommentDetailActivity

com.maoyan.android.presentation.mediumstudio.shortcomment.MYShareMovieWishActivity

com.maoyan.android.presentation.mediumstudio.gallery.MYMovieGalleryTypesActivity

com.maoyan.android.presentation.mediumstudio.gallery.MYMovieGalleryImageActivity

com.maoyan.android.presentation.actor.MYActorDetailActivity

com.maoyan.android.presentation.activity.MovieSearchActorActivity

com.maoyan.android.presentation.activity.MovieSearchActivity

com.gewara.base.knb.KNBActivity

com.maoyan.android.adx.web.ThirdPartyWebActivity

com.maoyan.android.pay.cashier.ccb.CCBResultActivity

com.maoyan.android.pay.cashier.CardBinCheckActivity

com.maoyan.android.pay.cashier.WebPayActivity

com.dianping.base.push.pushservice.HWPushDetailActivity

com.maoyan.account.LoginMainActivity

com.sina.weibo.sdk.share.WbShareTransActivity

com.sina.weibo.sdk.share.WbShareToStoryActivity

com.sankuai.meituan.android.knb.base.PageNavigator

Permissions

Receivers

com.gewaradrama.net.state.NetworkStateReceiver

com.gewara.base.push.PushReceiver

com.xiaomi.push.service.receivers.NetworkStatusReceiver