com[.]microsoft[.]office[.]word_16[.]0[.]17726[.]20080[.]apk

Sharing

Copy URL Twitter E-mail

General

Target

com.microsoft.office.word_16.0.17726.20080.apk
Size

246.1MB
MD5

a401b3520dd92bd8536f5262b5484f41
SHA1

34939c99689ee6d92ab2cf708173ede7b71aee35
SHA256

22b4716f0193b414e4f5c2bf313d91cd3e6b7f7e780b2053ffc1f22a2a7079f1
SHA512

c15d34875908df72cd545397a45d53d4996a831f049d1fa8a31d21cfd8b9b62f8f062586a1f1dc3674eb161fbf23084e9bc85695613c3fabf9de3e1d6ef15569
SSDEEP

1572864:Nv9QDicLsdmsnV8dZuyyaf4er+XZpZa80S/AA9vKJJG0P:Ni94lyyaf4er+XLVd/AAATGm

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
sample	office_macro_on_action

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED

Files

com.microsoft.office.word_16.0.17726.20080.apk
.apk android arch:arm64

com.microsoft.office.word

com.microsoft.office.word.WordActivity

Activities

com.microsoft.office.word.WordActivity

android.intent.action.VIEW
android.intent.action.MAIN
android.intent.action.VIEW
android.intent.action.EDIT
com.dropbox.android.intent.action.DBXC_EDIT
com.dropbox.android.intent.action.DBXC_VIEW
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW

com.dropbox.client2.android.AuthActivity

android.intent.action.VIEW

com.microsoft.android.crosssell.activities.PowerpointCrossSellHandlerActivity

android.intent.action.VIEW
android.intent.action.EDIT
com.dropbox.android.intent.action.DBXC_EDIT
com.dropbox.android.intent.action.DBXC_VIEW
android.intent.action.VIEW

com.microsoft.android.crosssell.activities.ExcelCrossSellHandlerActivity

android.intent.action.VIEW
android.intent.action.EDIT
com.dropbox.android.intent.action.DBXC_EDIT
com.dropbox.android.intent.action.DBXC_VIEW
android.intent.action.VIEW

com.microsoft.android.crosssell.activities.WordCrossSellHandlerActivity

android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.EDIT
com.dropbox.android.intent.action.DBXC_EDIT
com.dropbox.android.intent.action.DBXC_VIEW
android.intent.action.VIEW

com.microsoft.android.crosssell.activities.PdfCrossSellHandlerActivity

android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.EDIT
com.dropbox.android.intent.action.DBXC_EDIT
com.dropbox.android.intent.action.DBXC_VIEW

Permissions

android.permission.POST_NOTIFICATIONS
android.permission.READ_MEDIA_IMAGES
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.MANAGE_EXTERNAL_STORAGE
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.FOREGROUND_SERVICE_SPECIAL_USE
android.permission.ACCESS_WIFI_STATE
android.permission.RECORD_AUDIO
android.permission.CAMERA
com.android.vending.CHECK_LICENSE
com.android.launcher.permission.INSTALL_SHORTCUT
com.google.android.c2dm.permission.RECEIVE
com.microsoft.office.word.permission.C2D_MESSAGE
android.permission.WAKE_LOCK
com.android.vending.BILLING
android.permission.READ_PHONE_STATE
android.permission.READ_EXTERNAL_STORAGE
com.microsoft.office.word.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.GET_PACKAGE_SIZE
android.permission.SYSTEM_ALERT_WINDOW
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.BLUETOOTH
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.VIBRATE
android.permission.READ_MEDIA_VIDEO
android.permission.READ_MEDIA_VISUAL_USER_SELECTED
android.permission.NFC

Receivers

com.microsoft.office.officehub.util.OHubBroadcastReceiver

com.android.vending.INSTALL_REFERRER

com.microsoft.office.asyncdatapointreporting.InstallBroadcastReceiver

android.intent.action.PACKAGE_FULLY_REMOVED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.microsoft.intune.mam.client.service.MAMBackgroundReceiver

android.intent.action.DOWNLOAD_COMPLETE

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE
androidx.profileinstaller.action.SKIP_FILE
androidx.profileinstaller.action.SAVE_PROFILE
androidx.profileinstaller.action.BENCHMARK_OPERATION

com.microsoft.office.appwarmup.service.AppWarmUpBroadcastReceiver

com.microsoft.office.appwarmup.action.WARMUP

com.microsoft.android.crosssell.CrossSellReceiver

com.microsoft.android.crosssell.action.REFRESH_CROSS_SELL
com.microsoft.android.crosssell.action.STOP_CROSS_SELL

com.microsoft.android.crosssell.PackageStateReceiver

android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_CHANGED
android.intent.action.PACKAGE_FULLY_REMOVED

com.microsoft.android.crosssell.SelfReplacementReceiver

android.intent.action.MY_PACKAGE_REPLACED

com.microsoft.office.BackgroundTaskHost.SystemBroadcastReceiver

android.intent.action.MY_PACKAGE_REPLACED
com.microsoft.office.Notification.ACTION_APP_FIRST_LAUNCH
android.intent.action.BOOT_COMPLETED
com.microsoft.office.Notification.ACTION_AUTOMATION_RUN
com.microsoft.office.Notification.DELAYED_PACKAGE_UPGRADE
com.microsoft.office.action.OFF_PEAK_HOURS_DAILY

Services

com.microsoft.office.msohttp.keystore.OfficeAuthenticationService

android.accounts.AccountAuthenticator

com.microsoft.office.onepipe.OnepipeFirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.microsoft.office.plat.sharedprefservice.SharedPrefService

com.microsoft.office.plat.sharedprefservice.BIND

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.microsoft.android.crosssell.CrossSellAgentMarker

com.microsoft.android.crosssell.action.AGENT_CHECK

com.microsoft.tokenshare.TokenSharingService

com.microsoft.tokenshare.TokenSharingService

Android Permissions

com.microsoft.office.word_16.0.17726.20080.apk

Permissions

android.permission.POST_NOTIFICATIONS

android.permission.READ_MEDIA_IMAGES

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.ACCESS_WIFI_STATE

android.permission.RECORD_AUDIO

android.permission.CAMERA

com.android.vending.CHECK_LICENSE

com.android.launcher.permission.INSTALL_SHORTCUT

com.google.android.c2dm.permission.RECEIVE

com.microsoft.office.word.permission.C2D_MESSAGE

android.permission.WAKE_LOCK

com.android.vending.BILLING

android.permission.READ_PHONE_STATE

android.permission.READ_EXTERNAL_STORAGE

com.microsoft.office.word.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.GET_PACKAGE_SIZE

android.permission.SYSTEM_ALERT_WINDOW

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.BLUETOOTH

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.VIBRATE

android.permission.READ_MEDIA_VIDEO

android.permission.READ_MEDIA_VISUAL_USER_SELECTED

android.permission.NFC

Sharing

General

Malware Config

Signatures

Files