61e9c8982b95219c7a044cc1f05cfa68_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
61e9c8982b95219c7a044cc1f05cfa68_JaffaCakes118
Size 31.2MB
Sample240521-d8frhagg2w
SHA256 b021a76caa38f15d796bc242a19dd7f536c575859e9d46150531c5e59a1f4c59
MD5 61e9c8982b95219c7a044cc1f05cfa68
SHA1 ad3b049bbdaa345be628c0065769c71aa79185c0
SHA512 387fa10e831c25e88cb74a02e443764c77b6fe18ea09d939ee1caf8e4d107efc69ba7324bf7489d49675b87bedaf6d9965b708688c37c47cb7ba46b6c2286dda
SSDEEP 786432:wlI67O6gNSmRWzZ9boyNIdX9ns/0sQ5uxVhdvZIws:wCp69gWd1x+tscAJDIP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

Patched UPX-packed file 10 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx
sample	patched_upx
sample	patched_upx
sample	patched_upx
sample	patched_upx
sample	patched_upx
sample	patched_upx
sample	patched_upx
sample	patched_upx
sample	patched_upx

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx
sample	upx
sample	upx
sample	upx
sample	upx
sample	upx
sample	upx
sample	upx
sample	upx
sample	upx

Requests dangerous framework permissions 14 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

File Explorer

61e9c8982b95219c7a044cc1f05cfa68_JaffaCakes118

.apk 31.2MB
autonavi_Resource1_1_0.png

.apk 240KB
bdxadsdk.jar

.apk 193KB
gdtadv2.jar

.apk 443KB

61e9c8982b95219c7a044cc1f05cfa68_JaffaCakes118

SHA256 b021a76caa38f15d796bc242a19dd7f536c575859e9d46150531c5e59a1f4c59
MD5 61e9c8982b95219c7a044cc1f05cfa68
SHA1 ad3b049bbdaa345be628c0065769c71aa79185c0
SHA512 387fa10e831c25e88cb74a02e443764c77b6fe18ea09d939ee1caf8e4d107efc69ba7324bf7489d49675b87bedaf6d9965b708688c37c47cb7ba46b6c2286dda
SSDEEP 786432:wlI67O6gNSmRWzZ9boyNIdX9ns/0sQ5uxVhdvZIws:wCp69gWd1x+tscAJDIP
MD5 SHA1 SHA512 SSDEEP

android arch:arm arch:x86

Patched UPX-packed file

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

com.futurefleet.pandabus.ui

com.yitong.panda.client.bus.ui.activitys.StartActivity_

android.intent.action.MAIN android.intent.action.VIEW

com.yitong.panda.client.bus.ui.activitys.LauncherActivity_

com.yitong.panda.client.bus.ui.activitys.MainActivity_

com.yitong.panda.client.bus.ui.activitys.MainNewActivity_

com.yitong.panda.client.bus.ui.activitys.AllRecruitLineActivity_

com.yitong.panda.client.bus.ui.activitys.BuyModeActivity_

com.yitong.panda.client.bus.ui.activitys.BackLineActivity_

com.yitong.panda.client.bus.ui.activitys.BuyTicketActivity_

com.yitong.panda.client.bus.ui.activitys.OrderConfirmActivity_

com.yitong.panda.client.bus.ui.activitys.OrderPayActivity_

android.intent.action.VIEW

com.yitong.panda.client.bus.ui.activitys.MyTicketDetailActivity_

com.yitong.panda.client.bus.ui.activitys.AccountSettingActivity_

com.yitong.panda.client.bus.ui.activitys.MyVoucherActivity_

com.yitong.panda.client.bus.ui.activitys.MyOrderActivity_

com.yitong.panda.client.bus.ui.activitys.LineDetailActivity_

com.yitong.panda.client.bus.ui.activitys.StationDetailActivity_

com.yitong.panda.client.bus.ui.activitys.TwoDimensionCodeActivity_

com.yitong.panda.client.bus.ui.activitys.LoginActivity_

com.yitong.panda.client.bus.ui.activitys.RegisterActivity_

com.yitong.panda.client.bus.ui.activitys.ChangePasswordActivity_

com.yitong.panda.client.bus.ui.activitys.ForgetPasswordActivity_

com.yitong.panda.client.bus.ui.activitys.LineDetailMapActivity_

com.yitong.panda.client.bus.ui.activitys.OpenRouteSearchActivity

com.yitong.panda.client.bus.ui.activitys.RecruitRouteSearchActivity

com.yitong.panda.client.bus.ui.activitys.SearchPoiActivity_

com.yitong.panda.client.bus.ui.activitys.ChangeBindMobileActivity_

com.yitong.panda.client.bus.ui.activitys.MotificationNameActivity_

com.yitong.panda.client.bus.ui.activitys.RegisterSuccessActivity_

com.yitong.panda.client.bus.ui.activitys.AddressActivity_

com.yitong.panda.client.bus.ui.activitys.ApplyNewLineActivity_

com.yitong.panda.client.bus.ui.activitys.AboutUsActivity_

com.yitong.panda.client.bus.ui.activitys.RecruiteLineDetailActivity_

com.yitong.panda.client.bus.ui.activitys.RecruitLineDetailMapActivity_

com.yitong.panda.client.bus.ui.activitys.ApplyRecruitActivity_

com.yitong.panda.client.bus.ui.activitys.AttentionActivity_

com.yitong.panda.client.bus.ui.activitys.OrderPaySucceedActivity_

com.yitong.panda.client.bus.ui.activitys.FeedbackActivity_

com.yitong.panda.client.bus.ui.activitys.RouteLineSearchResultActivity_

com.yitong.panda.client.bus.ui.activitys.RecruitSearchResultActivity_

com.yitong.panda.client.bus.ui.activitys.CommentRouteActivity_

com.yitong.panda.client.bus.ui.activitys.WriteRouteCommentActivity_

com.yitong.panda.client.bus.ui.activitys.ShareSignLineActivity_

com.yitong.panda.client.bus.ui.activitys.MyWalletActivity_

com.yitong.panda.client.bus.ui.activitys.ChargeActivity_

com.yitong.panda.client.bus.ui.activitys.ChargeWebviewActivity

com.yitong.panda.client.bus.ui.activitys.ChargeHitoryActivity_

com.yitong.panda.client.bus.ui.activitys.PassengerXuzhiActivity_

com.yitong.panda.client.bus.ui.activitys.SettingActivity_

com.yitong.panda.client.bus.ui.activitys.ScoreHistoryActivity_

com.yitong.panda.client.bus.ui.activitys.ShakeActivity_

com.yitong.panda.client.bus.ui.activitys.MoreActivity_

com.yitong.panda.client.bus.ui.activitys.MyTicketActivity_

com.yitong.panda.client.bus.ui.activitys.InviteFriendActivity

com.yitong.panda.client.bus.ui.activitys.WithDrawCashActivity

com.futurefleet.pandabus.ui.wxapi.WXPayEntryActivity

com.futurefleet.pandabus.ui.wxapi.WXEntryActivity

com.mob.tools.MobUIShell

android.intent.action.VIEW

com.yitong.panda.pandabus.activity.NearbyActivity_

com.yitong.panda.pandabus.activity.RouteSearchActivity_

com.yitong.panda.pandabus.activity.StopSearchActivity_

com.yitong.panda.pandabus.activity.NavigationSearchActivity_

com.yitong.panda.pandabus.activity.RouteDetailActivity_

com.yitong.panda.pandabus.activity.NavigationDetailActivity_

com.yitong.panda.pandabus.activity.NavigationMapActivity_

com.yitong.panda.pandabus.activity.RouteMapActivity_

com.yitong.panda.pandabus.activity.RouteErrorActivity

com.yitong.panda.pandabus.activity.NewLineActivity

com.yitong.panda.pandabus.activity.RouteChooseActivity

com.yitong.panda.pandabus.activity.RouteUpdateActivity

com.yitong.panda.pandabus.activity.NavigationSettingActivity

com.yitong.panda.pandabus.activity.ChangeCityActivity

com.yitong.panda.pandabus.activity.LocationErrorActivity

com.yitong.panda.pandabus.activity.OffLineMapActivity

com.yitong.panda.pandabus.activity.ICCardMainActivity

android.nfc.action.NDEF_DISCOVERED android.nfc.action.TAG_DISCOVERED android.nfc.action.TECH_DISCOVERED

com.yitong.panda.pandabus.activity.ICCardRecordActivity

com.yitong.panda.pandabus.activity.ICCardRechargeActivity

com.yitong.panda.client.bus.ui.activitys.NotOpenCityActivity

com.yitong.panda.client.bus.ui.activitys.SpecialLineActivity

com.yitong.panda.client.bus.ui.activitys.SpecialLineDetailActivity

com.yitong.panda.client.bus.ui.activitys.SpecialBuyTicketActivity

com.yitong.panda.client.bus.ui.activitys.CreditActivity

com.yitong.panda.client.bus.ui.activitys.ApplyNewLineResultActivity

com.yitong.panda.carpool.ui.activity.CarpoolMainNewActivity_

com.yitong.panda.carpool.ui.activity.SucceedCarActivity_

com.yitong.panda.carpool.ui.activity.NavigationActivity_

com.yitong.panda.carpool.ui.activity.ReserveMapActivity_

com.yitong.panda.carpool.ui.activity.WalkMapActivity_

com.yitong.panda.carpool.ui.activity.ForgetPasswordActivity_

com.yitong.panda.carpool.ui.activity.AboutUsActivity_

com.yitong.panda.carpool.ui.activity.MotificationNameActivity_

com.yitong.panda.carpool.ui.activity.ChangePasswordActivity_

com.yitong.panda.carpool.ui.activity.ChangeBindMobileActivity_

com.yitong.panda.carpool.ui.activity.WalkNavigationActivity

com.yitong.panda.carpool.ui.activity.SearchCarActivity_

com.yitong.panda.carpool.ui.activity.MyOrderActivity_

com.yitong.panda.carpool.ui.activity.OrderPayActivity_

com.yitong.panda.carpool.ui.activity.MyTicketActivity_

com.yitong.panda.carpool.ui.activity.MatchingCancelActivity_

com.yitong.panda.carpool.ui.activity.SuggestWayActivity

com.yitong.panda.carpool.ui.activity.RefoundTicketActivity

com.yitong.panda.client.bus.ui.activitys.CharteredBusActivity

com.yitong.panda.client.bus.ui.activitys.CustomBusRefoundActivity

com.yitong.panda.carpool.ui.activity.JourneyCommentActivity

com.yitong.panda.carpool.ui.activity.PanoramaActivity

com.yitong.panda.client.bus.ui.activitys.RouteLineSearchActivity

com.yitong.panda.client.bus.ui.activitys.ERCodeBuyTicketActivity

com.yitong.panda.client.bus.ui.activitys.BDLineDetailActivity_

com.yitong.panda.client.bus.ui.activitys.SearchPoiWithNoMapActivity

com.yitong.panda.client.bus.ui.activitys.AllLineActivity

com.yitong.panda.client.bus.ui.activitys.HorBusRouteChooseActivity

com.yitong.panda.client.bus.ui.activitys.HorRouteDetailActivity

com.yitong.panda.client.bus.ui.activitys.BusTimeTableActivity

com.yitong.panda.carpool.ui.activity.CarpoolReservationActivity

com.yitong.panda.client.bus.ui.activitys.Main2Activity

com.yitong.panda.client.bus.ui.activitys.AllLineHotRouteActivity

com.yitong.panda.carpool.ui.activity.ERWaveCodeBuyTicketActivity

com.yitong.panda.client.bus.ui.activitys.ActCentralActivity

com.yitong.panda.client.bus.ui.activitys.BusSearchActivity

com.yitong.panda.client.bus.ui.activitys.YouzanActivity

com.yitong.panda.client.bus.ui.activitys.MyMessageActivity

com.yitong.panda.client.bus.ui.activitys.QRPayActivity

com.yitong.panda.company.activity.LineDetailActivity_

com.yitong.panda.client.bus.ui.activitys.BusSearchResultActivity

com.yitong.panda.client.bus.ui.activitys.MonthBuyTicketActivity_

com.yitong.panda.client.bus.ui.activitys.RouteSearchActivity

com.yitong.panda.client.bus.ui.activitys.UserMessageActivity_

com.yitong.panda.company.activity.CompanyMainActivity

com.yitong.panda.company.activity.CompanyERCodeActivity

com.yitong.panda.client.bus.ui.activitys.MyOrderRouteDetailActivity

com.yitong.panda.carpool.ui.activity.MyCarpoolOrderRouteDetailActivity

com.yitong.panda.client.bus.ui.activitys.MyCharterBusOrderRouteDetailActivity

com.yitong.panda.client.bus.ui.activitys.SplashActivity

com.alipay.sdk.app.H5PayActivity

com.alipay.sdk.app.H5AuthActivity

com.yitong.panda.client.service.activity.GroupsActivity

com.yitong.panda.client.service.activity.PublicGroupsActivity

com.yitong.panda.client.service.activity.GroupSimpleDetailActivity

com.yitong.panda.client.service.activity.GroupDetailsActivity

com.yitong.panda.client.service.activity.ExitGroupDialog

com.yitong.panda.client.service.activity.GroupCharSettingActivity

com.yitong.panda.client.service.activity.ChatActivity

com.yitong.panda.client.service.activity.ContextMenu

com.yitong.panda.client.service.activity.AlertDialog

com.yitong.panda.client.service.activity.ShowBigImage

com.yitong.panda.client.service.activity.DiagnoseActivity

com.sdu.didi.openapi.DiDiWebActivity

com.google.zxing.client.android.CaptureActivity

android.intent.action.MAIN com.google.zxing.client.android.SCAN android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW

com.google.zxing.client.android.PreferencesActivity

com.google.zxing.client.android.encode.EncodeActivity

com.google.zxing.client.android.ENCODE android.intent.action.SEND android.intent.action.SEND

com.tencent.bugly.beta.ui.BetaActivity

cn.jpush.android.ui.PopWinActivity

cn.jpush.android.ui.PushActivity

com.base.app.activity.WebViewActivity_

com.bytedance.sdk.openadsdk.activity.TTLandingPageActivity

com.bytedance.sdk.openadsdk.activity.TTVideoLandingPageActivity

com.bytedance.sdk.openadsdk.activity.TTRewardVideoActivity

com.bytedance.sdk.openadsdk.activity.TTFullScreenVideoActivity

com.bytedance.sdk.openadsdk.activity.TTDelegateActivity

com.ss.android.socialbase.appdownloader.view.DownloadSizeLimitActivity

com.ss.android.socialbase.appdownloader.view.DownloadTaskDeleteActivity

com.ss.android.downloadlib.activity.InteractionMiddleActivity

com.server.base.YdH5Activity

com.qq.e.ads.ADActivity

com.qq.e.ads.PortraitADActivity

com.qq.e.ads.LandscapeADActivity

com.server.wxapi.WXEntryActivity

com.baidu.mobads.AppActivity

com.yitong.panda.client.bus.service.PositionService_

com.yitong.panda.client.bus.service.OfflineTicketService_

com.yitong.panda.client.bus.service.LineDetailPositionService_

com.yitong.panda.carpool.service.GpsService

com.yitong.panda.client.bus.service.AGpsService

com.yitong.driver.gps

com.easemob.chat.EMChatService

cn.jpush.android.service.DownloadService

cn.jpush.android.service.PushService

cn.jpush.android.intent.REGISTER cn.jpush.android.intent.REPORT cn.jpush.android.intent.PushService cn.jpush.android.intent.PUSH_TIME

cn.jpush.android.service.DaemonService

cn.jpush.android.intent.DaemonService

com.tencent.bugly.beta.tinker.TinkerResultService

com.tencent.tinker.lib.service.TinkerPatchService

com.tencent.tinker.lib.service.TinkerPatchService$InnerService

com.tencent.tinker.lib.service.DefaultTinkerResultService

com.amap.api.location.APSService

com.ss.android.socialbase.downloader.notification.DownloadNotificationService

com.ss.android.socialbase.downloader.downloader.DownloadService

com.ss.android.socialbase.appdownloader.DownloadHandlerService

com.qq.e.comm.DownloadService

com.yd.tt.service.AppDownloadService

com.server.download.DownloadService

autonavi_Resource1_1_0.png

SHA256 b74f203d82609a6e23270dffa7d471aaf1ae66646d97c5b41d25c51f7232a0aa
MD5 d09d60d0401395ff2a1900757c11616d
SHA1 827aa244916cd655b9ffea708e62a0712bfe5cd8
SHA512 e9ae13d7b56022a557672cc015197c7e0bab19d35646ac907705e499f132986d5f1805e358012535b38d043a949450cc5c3f4e629761d0bec35e0a1df85722cd
SSDEEP 6144:qAoIldwuCXoADE7bDJish6m16ACbO024uJl9lm+WQAP:qAoIIu4lEX+m16AY248lC+WQAP
MD5 SHA1 SHA512 SSDEEP

android

Patched UPX-packed file

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

com.example.navigationsdk

Android Permissions

61e9c8982b95219c7a044cc1f05cfa68_JaffaCakes118

Permissions

android.permission.RECEIVE_USER_PRESENT

android.permission.WAKE_LOCK

android.permission.READ_PHONE_STATE

android.permission.VIBRATE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.ACCESS_NETWORK_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.CALL_PHONE

android.permission.CAMERA

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

android.permission.CHANGE_NETWORK_STATE

android.permission.INTERNET

android.permission.RECEIVE_SMS

android.permission.GET_TASKS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.NFC

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_WIFI_STATE

android.permission.RECORD_AUDIO

android.permission.CHANGE_WIFI_STATE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.GET_ACCOUNTS

android.permission.USE_CREDENTIALS

android.permission.MANAGE_ACCOUNTS

android.permission.AUTHENTICATE_ACCOUNTS

com.android.launcher.permission.READ_SETTINGS

android.permission.BROADCAST_STICKY

android.permission.WRITE_SETTINGS

android.permission.FLASHLIGHT

android.permission.READ_CONTACTS

com.android.browser.permission.READ_HISTORY_BOOKMARKS

com.futurefleet.pandabus.ui.permission.JPUSH_MESSAGE

android.permission.READ_LOGS

android.permission.CHANGE_CONFIGURATION

android.permission.REQUEST_INSTALL_PACKAGES