Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
26/04/2024, 13:38
General
-
Target
00e3334af6fb8be6d21042fc6aa6169f_JaffaCakes118.apk
-
Size
8.2MB
-
MD5
00e3334af6fb8be6d21042fc6aa6169f
-
SHA1
7b7fd5e1ceb703368203b27327613dfc79346295
-
SHA256
bc3d22f3eb93a323f64b921d0423b9969ef80b6235277a53259df396f7290a44
-
SHA512
f6bd81cd90ec4569c2593942001a3c85e1e3aec9592fe00e90b86e342350deafa88012c8195f581d17948437507886a335ae537b7d66d238e7d5b9983eb0f21c
-
SSDEEP
196608:73W+ZIZp9fOZ6vPnxZCt2xte2u1ZgAxJg9feDX/W+:K9ZnfOmPOt2xtPygAxJwmDX/W+
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 14 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about running processes on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
-
Checks if the internet connection is available 1 TTPs 3 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.qidksreader.olwfa1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
chmod 755 /data/user/0/com.qidksreader.olwfa/.jiagu/libjiagu.so2⤵
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.qidksreader.olwfa/.jiagu/tmp.dex --output-vdex-fd=44 --oat-fd=46 --oat-location=/data/data/com.qidksreader.olwfa/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
sh -c ps2⤵
-
-
ps2⤵
-
-
com.qidksreader.olwfa:pushservice1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
-
com.qidksreader.olwfa:player1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
-
/system/bin/dex2oat --instruction-set=x86 --dex-file=/data/user/0/com.qidksreader.olwfa/.jiagu/classes.dex --dex-file=/data/user/0/com.qidksreader.olwfa/.jiagu/classes.dex!classes2.dex --oat-file=/data/user/0/com.qidksreader.olwfa/.jiagu/oat/x86/classes.odex --inline-max-code-units=0 --compiler-filter=speed2⤵
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5937ef85638e2a39aadf05b3d9c1acbc2
SHA1426118c2a2d796571cdb356c7fc319cf7ff678b4
SHA2561da5af6d6c323374c3739cd9a8fa46d4b1db20db031db53d19a792ac9e4c491b
SHA512ce15a8e4aafe9c11909916d91a8ab8cf2f63d36650d9c595d1e12efcf372a9374861880b0b7ef9e0d9dbfcbd573ccc063ae0eb0a19bd53fb895bb24b014bb6ec
-
Filesize
382KB
MD5aa01dd97609092ce310e17bf791069ce
SHA1f000840a8f68ea7beb2e29ea466088daf55609db
SHA256e432c191f918053ce368e1b1f155b2e1f9e84379611b93aabec0106172b73aa2
SHA512766c120a06215d0950aae32026fcde3eafed8d18ae0de7bc8135a7378a9055c8f0040d61574d9af67fe2b5b90eeae64c62d787343858ae375bb6658df8afe7b4
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
512B
MD59785a802288dc4371f97c980be041770
SHA178b85686e55f5c248c3a4d3ee9ec47e3aba994b7
SHA25665969c3b16687b2f9a9fa827e2a2cf0ae45542c159cada8f9afbd6865d3073ad
SHA512076396e26b204a1694fcbe85f0ecf16e9da14a025e44ca5151c471440f4991fa239df2da5334f932064bcc0d08a9faa07323bf6dc0590010aec966158c7cd593
-
Filesize
92KB
MD5a8d928c32ffd60818694e1f7105fe543
SHA1e139eeb2d3c0a178918b0fce66c1cfdb4b35dbf7
SHA256e47880714b92e20971766d19337869d0aaa2ab486ac4b579898fad4fb7a67852
SHA512b0a3b1bcdc36b2c66a837236add754ea8653c54cc680c7cdf1fa9286915ade54276cefc6e6bbb5c1db98e925a1bebc6ea40128dd71466415790b10499a94545e
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5b079dfcbc3a73348cef6b2e383bb93e5
SHA1af02ea4f10ac15c644bdf3eb3c797aef7a73d480
SHA2564f75683d7768e6cc674e78dae0ea2ae93d4b5bb7df23c83458e859767f5f8348
SHA512944e8545078c01c54c9ab932544a650db9b2285e1579be0278aa49f9597ade29cae4f19338b124d1f79896419ca18ac7388b99832fe73eadfa797961fd50ba58
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
177KB
MD5033997e5a51fe45c6e295ddcd59e8557
SHA13f00bf913c37292131b801f234a719f372835cb1
SHA2566fe702e41018c9633ebceeb75f6e6a596bd80870a7202c4062aab9a012a47cb9
SHA51245ce9e3c097e9979c5e3b7ebf9a8c2186eef1d01ad5372f508175839170ef4c07ac02902b90ade58ccbe3c32d772643f28af69b406f0c7b1bc62827407946429
-
Filesize
40B
MD5f27815f59512acc00cc68876420ff36c
SHA129d8d5c990328a7be2e5b80301f59d5a73f1de24
SHA25638c9365313b037f79a740ddc5d91246cd306028d50bebc42c876779723ac6562
SHA5123b5bbde182ef077defb65a191a67874f05d26fa6dca42e0ccde9d6d59b44ce961ca06ee84cfc9c2c58457b9e5f3802a6ecb8b4c0c38157f42ee9c44ed1b2b97b
-
Filesize
40B
MD597c30f59ee373a0d6cf6dfe01b66476a
SHA1733758d0fbfaded2ceadb6cfb71ec67f32d2e9a1
SHA25672411bec7f8cb3fdc83387c6ecd869e7e9415029b062fe30b47effc3aa043ba0
SHA5126654423fc22a4d307ae58417667c95689921c10d6ff6b48b30c43eda714e208bea56ebd755a52eb2d4a1370bd27d57166f4b2450db1238ef4bc0b7b593d0f10d
-
Filesize
340B
MD51d9f314ee88ee053f5f833c2b2e0bd71
SHA15abedee0d85764d7de54d27126620116da009fe0
SHA2565341e7ee14550a595708e524f76d90767bfec3b03170ef13ad49d134424b43fb
SHA512336839d7de47d23f09634f513a3fa799a5e875615cc681dcbf882cbf2001b6357fadc8acb4416c134779d0f22e4a8cd62850259a43066a88fd60c4b95055addc
-
Filesize
340B
MD56ae9b8d1b62c3ba8ef71003adbefe554
SHA1dc9f5837dcbc2746bb095537c8857686476c4242
SHA25612a8b8d8d6ded056017e5bcda1a25b500b647dbc91811352dd579fe75ab4b388
SHA512769f91066c28ad026534982e25ce1e97d3dae240fddc66284cee9ab85eadc61dfd1dfdf1aa670146ad980702b84934db2c0ba6c83073106a5fdd3c45741ce532
-
Filesize
40B
MD5a3916fd239d997a7f4198679578d319b
SHA1a8e9e6dc964b18ed4249b7affa8b9b980979390c
SHA256a4ddf704aacaaa74bcb4ec6d9a0c8bd111e1abe636e21b71e5560858f8766adf
SHA512ea85c21648bd501060eb2a9557abb2f692ed102ffdc73dcc1c6291f371f85ac1ef0f673d0fa1a189a793042f8353e9361d2c906bde196d0be73878fa6385ca6e
-
Filesize
314B
MD503ecab6a668c011c8a342eb245205648
SHA1804aa23a30e95f0cf56fa3440c7f731a9ed52ccd
SHA2569a1d8194a20b4cb39d217e4a96796ede5b3ee540679ce877cb1427850134b67a
SHA51294751e96c28aac117a5d06a414b0ac4e7e8dbf3fd8c8046f94ffd14ded5606eb6aaf67ae564128331495a67f8de4807ff6e06b64ea72087e16666132109a65be
-
Filesize
27B
MD53c5699a47f885bccd750644be60388ff
SHA157dd9172660feab3adf0b516513e43a85a878673
SHA256d1d4aa84d51990d3094d8f7e9c24fc736d08b1b5a9a4f08a17868b223eaec459
SHA512b5601a506a11856e6bbf916b51114c1329a4c04f1185418194e48a526e73c1b3ad9392c2217c24bb738354d3419c5a2b0e92bc50c4321d4a68b463d120cdfd40
-
Filesize
151B
MD5e00efcc2b79c5f76d133317eb2560bdb
SHA19c68073cbd983ed023dfd3de44212b882cad7e71
SHA256bf4bd177fb653cdd0fb882dc6fb45fc4ba2f5f2e218b62676d22004ee9961db4
SHA512ffc3b3b532dfc3c52df11c852588bbb5b6e6eadeebda56f272bdde26785e90dd86a203718b74561df751551e81dcb015caba34149a265563a92cd15d0d39f079
-
Filesize
295B
MD59a85752648fa83a82f7b1e7630c61409
SHA11378b371a5b7ebd0e42d6ae8e25618aa387b3e71
SHA2568bd76ad72904a0997987154066d8aaddd02edefbfd40d94fa01732b046216e52
SHA512eecdc18711dc5d35b3bf71f55b33d6783ef7e91127c4c860bed4fdb0fb0ff9aeb0cc2351880e5b34cd879fc97c590b0463de7de1a73c3cd5909ca84683e3fa5d
-
Filesize
703B
MD5f0c0ab68597705cd7161be4bbc721a86
SHA1ad10a81284730e6860f2c030b163e722cf800c20
SHA256fd8b3669acc95248e8df56b4a3f3a747c4555a2c75e43509dd1ea879a7b0c725
SHA512e44384550cbc25d99c701a22effc940ed14274a9caca689ec66153e2d25483b20ba13328f68d42fdae3fcfecb4aab8bcd07f078951486924fffc1d12f52b4012
-
Filesize
347KB
MD51f242aacba9ca2f41d5b685e1849f6db
SHA1e8d3fe66d74f9b36b2c3329cef038cf41e0b587c
SHA2564dc03a24256062998c05630a06a9e6da41fce84dd821a92add0cbadd46b8b893
SHA512cd77a0f4bf1e3ceb6fe72131088ab1a8a6c6b56ab3b20bf03a2cb9696d02c919b88d16212de0570711546b785a13d96f7f266dbc7be72b5b9420365a24edfa03
-
Filesize
842KB
MD5a3d2c725a0591d2ae74b2a35d0f624e0
SHA1dc945d36c986496e700424e640e73e93c4daca36
SHA256cc27d55aae26f54773abe5865cd398380fa32c9934a243bf409f2f94df333a94
SHA512f5a2b9df17e6f81eb74e3811485175b078dcef657369c0c89e196eb189f328bd49b8d02346a9fe3d07e914ab8ef31f0f902f6a83b94faca1516e0918cacf7713
-
Filesize
630B
MD5933d26c0df12842700f4b798b6bc4f2a
SHA15b46a53908235704e2496cf6a3ee42fe7c615ed9
SHA256252513a9155d70db9ddf86e50c86df8afea308f1d7261bd2cb607a46b14e95d6
SHA51292697ce58d0ae432411808d83f30c93498e6b7ece5ab4eb7398bc0f638834cb3056fa02034f6c9cb87d83d6243284431c27fd66a07aa32cbd7fa7e91c97105f2
-
Filesize
211B
MD50f4e4300662fe679310c53a1e7d1e317
SHA1b2bf9697b814dba530e44ab06f8b2ac77e2a7e5c
SHA25675772297d6e0da98f5e57104f30fdb9eb3fe89e1f1bb1466179712fe46b87628
SHA512c5a662eb6cf83146766efeac80bc3a2da390c36e32bd9a79dfc767b0f106aa9ef7f59d83d158e93abd17375b2745e8d097a87cd2a580f59b42dca3a675a74808
-
Filesize
5.3MB
MD588cf5bb7ed5836d090597860cb12e7b9
SHA153e0c88e302991d450ad2de3421211cf24714f91
SHA2564577826918c48d6b604e9e3771a14379f0a87efe0715ee4ac14b4cc5b38b7d6f
SHA512014f545070bed04df90b338f35a26794596f5a4780378066df41d964616e0ac094c6b7bc5d19a3a55c3e3b53db829929f7965ffa54de7b6b2c0d55139c442903
-
Filesize
829KB
MD56029ab7eff30f03af7dbc328aa10d30e
SHA13507772ea08530df9c126733f6bec5a1c32d5bcb
SHA25679358a8c856ae881b36e19ca52663eaed3b526acb083b1a659f89452f74dc268
SHA5120a4a29eb6c9da0fe4bf490378b94ace7045e099741bf3c3f39b2bb1046ea80512a1d7708094123d58b2c25bf3c043b3a9331496d0d9a8afbf5d706dffa5bfec2
-
Filesize
48B
MD51d8d16c4e3b19ebf18988530d9b9a757
SHA1bc94c1cce05cd848a53271ecb9c5311e27ffebf5
SHA256abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7
SHA5124562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82
-
Filesize
32B
MD58b00e3a101423458586dedeb7e78a806
SHA177444ca925267c609d69d7bdf7d631d7eb4f8eb2
SHA2567ec52c2806c440e07e7c5180a80c8a948cb3c33a2071c87969c4f833088ff0c2
SHA512ed307ebf695724eb1ae663b5dfb3cc35435b0485f6b11fba67d5455dd9a542f6669fb139afd303544c767d616ce6f29ea25cbcb570752e010c1d6b0aa3ecb437