General

  • Target

    aaaa76577d67ec3fe6b2b799dcef7eb9_JaffaCakes118

  • Size

    17.4MB

  • MD5

    aaaa76577d67ec3fe6b2b799dcef7eb9

  • SHA1

    fb6d7ef067e4a7092cb17bfd4ca47a5270de0443

  • SHA256

    863319d40a0150dfc87e2b9c63b5a5be2ef0731877abe43d851c592bd2c82a41

  • SHA512

    28fad05057cb08f62e01f37c17a2b404553058765b958380ec7adebf2c9a5a95d3114acb4fd64d15e5ea3bb579a42b21a83d43b738aa992c846ba04225ecab32

  • SSDEEP

    393216:M8MNf1oRsZ67PyCTOGX0Hoo9gkt0O3XpU2Fx5jVO24vuO9:MlNNiu09ho9gk2EXW2FxtF4vB

Score
10/10
upx

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://google-gson.googlecode.com/files/google-gson-2.2.2-release.zip

Signatures

  • Patched UPX-packed file 20 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Requests dangerous framework permissions 10 IoCs

Files

  • aaaa76577d67ec3fe6b2b799dcef7eb9_JaffaCakes118
    .apk android arch:arm64 arch:arm arch:x86 arch:x64

    cn.itplus.springinternational

    cn.itplus.springinternational.activity.SplashActivity


Android Permissions

aaaa76577d67ec3fe6b2b799dcef7eb9_JaffaCakes118

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_WIFI_STATE

android.permission.READ_CONTACTS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.VIBRATE

android.permission.WRITE_SETTINGS

android.permission.CAMERA

android.permission.RECORD_AUDIO

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.CHANGE_WIFI_STATE