pegasus | JaffaCakes118_d65343874d6e9de7e40dc495594ed0ef

Sharing

Copy URL

Twitter E-mail

Reason

error processing APK: strconv.ParseInt: parsing "0x7fffffff": invalid syntax

General

Target

JaffaCakes118_d65343874d6e9de7e40dc495594ed0ef
Size

15.8MB
MD5

d65343874d6e9de7e40dc495594ed0ef
SHA1

b2927bb1630cd826a5788dc1ea9b2596dc6fa860
SHA256

469b3ac4ca633139f43b33a7d2761e354288b68dfac4165dad16915733da2c8c
SHA512

e06375259dccbdfc48d29892c8bd21d5c419e8dfff3b53f65a3f87ea96cee25ef20e1a19efd484c4df7913ba1afae88f864627704f1853320f68b0c07dc9c73b
SSDEEP

393216:57VxC17fc0eMP6L0iu0UYnvXhm/UTsl+nV4G:TxC1DcaUu0U4hm/UT8+V4G

Score

10^/10

pegasus

Malware Config

Signatures

Pegasus family
pegasus

Pegasus payload 1 IoCs

resource	yara_rule
static1/unpack001/Root·/tencentmobilemanager3.8.5_android_build0599.apk	family_pegasus1

Requests dangerous framework permissions 16 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Root·/AdbWinApi.dll
unpack001/Root·/AdbWinUsbApi.dll
unpack001/Root·/adb.exe

Files

JaffaCakes118_d65343874d6e9de7e40dc495594ed0ef
.zip
Root·/AdbWinApi.dll
.dll windows:6 windows x86 arch:x86

c64cac39044626770353879245ea25e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\code\android\donut\development\host\windows\usb\api\objfre_wxp_x86\i386\AdbWinApi.pdb

Imports

ole32

CoCreateInstance

kernel32

GetACP
SetLastError
CloseHandle
GetLastError
DeviceIoControl
WriteFile
ReadFile
GetOverlappedResult
CreateFileW
WideCharToMultiByte
Sleep
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetProcAddress
LoadLibraryW
GetFileAttributesW
GetSystemDirectoryW
RaiseException
FreeLibrary
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetCommandLineA
GetVersionExA
RtlUnwind
HeapFree
HeapAlloc
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCPInfo
GetOEMCP
OutputDebugStringA
VirtualAlloc
HeapReAlloc
HeapSize
LoadLibraryA
GetModuleHandleW
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
VirtualProtect
GetSystemInfo
VirtualQuery
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW

Exports

Exports

??0AdbEndpointObject@@QAE@ABV0@@Z
??0AdbEndpointObject@@QAE@PAVAdbInterfaceObject@@EE@Z
??0AdbIOCompletion@@QAE@ABV0@@Z
??0AdbIOCompletion@@QAE@PAVAdbEndpointObject@@KPAX@Z
??0AdbInterfaceObject@@QAE@ABV0@@Z
??0AdbInterfaceObject@@QAE@PBG@Z
??0AdbObjectHandle@@QAE@ABV0@@Z
??0AdbObjectHandle@@QAE@W4AdbObjectType@@@Z
??1AdbEndpointObject@@MAE@XZ
??1AdbIOCompletion@@MAE@XZ
??1AdbInterfaceObject@@MAE@XZ
??1AdbObjectHandle@@MAE@XZ
??4AdbEndpointObject@@QAEAAV0@ABV0@@Z
??4AdbIOCompletion@@QAEAAV0@ABV0@@Z
??4AdbInterfaceObject@@QAEAAV0@ABV0@@Z
??4AdbObjectHandle@@QAEAAV0@ABV0@@Z
??_7AdbEndpointObject@@6B@
??_7AdbIOCompletion@@6B@
??_7AdbInterfaceObject@@6B@
??_7AdbObjectHandle@@6B@
?AddRef@AdbObjectHandle@@UAEJXZ
?AsyncRead@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?AsyncWrite@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?CloseHandle@AdbObjectHandle@@UAE_NXZ
?CreateHandle@AdbObjectHandle@@UAEPAXXZ
?GetEndpointInformation@AdbEndpointObject@@UAE_NPAU_AdbEndpointInformation@@@Z
?GetInterfaceName@AdbInterfaceObject@@UAE_NPAXPAK_N@Z
?GetParentInterfaceHandle@AdbEndpointObject@@QBEPAXXZ
?GetParentObjectHandle@AdbIOCompletion@@QBEPAXXZ
?GetUsbConfigurationDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_CONFIGURATION_DESCRIPTOR@@@Z
?GetUsbDeviceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_DEVICE_DESCRIPTOR@@@Z
?GetUsbInterfaceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_INTERFACE_DESCRIPTOR@@@Z
?IsCompleted@AdbIOCompletion@@UAE_NXZ
?IsObjectOfType@AdbObjectHandle@@UBE_NW4AdbObjectType@@@Z
?IsOpened@AdbObjectHandle@@QBE_NXZ
?LastReferenceReleased@AdbObjectHandle@@MAEXXZ
?Lookup@AdbObjectHandle@@SGPAV1@PAX@Z
?Release@AdbObjectHandle@@UAEJXZ
?SyncRead@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?SyncWrite@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?Type@AdbEndpointObject@@SG?AW4AdbObjectType@@XZ
?Type@AdbIOCompletion@@SG?AW4AdbObjectType@@XZ
?Type@AdbInterfaceObject@@SG?AW4AdbObjectType@@XZ
?adb_handle@AdbObjectHandle@@QBEPAXXZ
?endpoint_id@AdbEndpointObject@@QBEEXZ
?endpoint_index@AdbEndpointObject@@QBEEXZ
?interface_name@AdbInterfaceObject@@QBEABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?object_type@AdbObjectHandle@@QBE?AW4AdbObjectType@@XZ
?overlapped@AdbIOCompletion@@QAEPAU_OVERLAPPED@@XZ
?parent_interface@AdbEndpointObject@@QBEPAVAdbInterfaceObject@@XZ
?parent_io_object@AdbIOCompletion@@QBEPAVAdbEndpointObject@@XZ
?usb_config_descriptor@AdbInterfaceObject@@QBEPBU_USB_CONFIGURATION_DESCRIPTOR@@XZ
?usb_device_descriptor@AdbInterfaceObject@@QBEPBU_USB_DEVICE_DESCRIPTOR@@XZ
?usb_interface_descriptor@AdbInterfaceObject@@QBEPBU_USB_INTERFACE_DESCRIPTOR@@XZ
AdbCloseHandle
AdbCreateInterface
AdbCreateInterfaceByName
AdbEnumInterfaces
AdbGetDefaultBulkReadEndpointInformation
AdbGetDefaultBulkWriteEndpointInformation
AdbGetEndpointInformation
AdbGetEndpointInterface
AdbGetInterfaceName
AdbGetOvelappedIoResult
AdbGetSerialNumber
AdbGetUsbConfigurationDescriptor
AdbGetUsbDeviceDescriptor
AdbGetUsbInterfaceDescriptor
AdbHasOvelappedIoComplated
AdbNextInterface
AdbOpenDefaultBulkReadEndpoint
AdbOpenDefaultBulkWriteEndpoint
AdbOpenEndpoint
AdbQueryInformationEndpoint
AdbReadEndpointAsync
AdbReadEndpointSync
AdbResetInterfaceEnum
AdbWriteEndpointAsync
AdbWriteEndpointSync

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Root·/AdbWinUsbApi.dll
.dll windows:6 windows x86 arch:x86

fda9f9f5f569ddd0dbf3ad8a275a2eb8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\code\android\donut\development\host\windows\usb\winusb\objfre_wxp_x86\i386\AdbWinUsbApi.pdb

Imports

ole32

CoCreateInstance

kernel32

TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapReAlloc
HeapSize
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
WriteFile
OutputDebugStringA
ExitProcess
LoadLibraryA
GetModuleHandleW
GetCPInfo
GetACP
GetOEMCP
GetModuleHandleA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
VirtualProtect
GetSystemInfo
VirtualQuery
GetProcAddress
HeapAlloc
HeapFree
RtlUnwind
GetVersionExA
GetCommandLineA
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
Sleep
CreateFileW
WideCharToMultiByte
CreateEventW
CloseHandle
GetLastError
SetLastError
InterlockedDecrement
GetLocaleInfoA

winusb

WinUsb_GetDescriptor
WinUsb_Free
WinUsb_QueryPipe
WinUsb_GetOverlappedResult
WinUsb_ReadPipe
WinUsb_WritePipe
WinUsb_QueryInterfaceSettings
WinUsb_GetCurrentAlternateSetting
WinUsb_Initialize
WinUsb_SetPipePolicy

adbwinapi

?IsCompleted@AdbIOCompletion@@UAE_NXZ
??0AdbIOCompletion@@QAE@PAVAdbEndpointObject@@KPAX@Z
?GetUsbConfigurationDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_CONFIGURATION_DESCRIPTOR@@@Z
?GetUsbDeviceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_DEVICE_DESCRIPTOR@@@Z
?GetInterfaceName@AdbInterfaceObject@@UAE_NPAXPAK_N@Z
??0AdbInterfaceObject@@QAE@PBG@Z
??1AdbEndpointObject@@MAE@XZ
?SyncWrite@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?SyncRead@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?AsyncWrite@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?AsyncRead@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?GetEndpointInformation@AdbEndpointObject@@UAE_NPAU_AdbEndpointInformation@@@Z
?LastReferenceReleased@AdbObjectHandle@@MAEXXZ
?IsObjectOfType@AdbObjectHandle@@UBE_NW4AdbObjectType@@@Z
?CloseHandle@AdbObjectHandle@@UAE_NXZ
?CreateHandle@AdbObjectHandle@@UAEPAXXZ
?AddRef@AdbObjectHandle@@UAEJXZ
??0AdbEndpointObject@@QAE@PAVAdbInterfaceObject@@EE@Z
??1AdbIOCompletion@@MAE@XZ
??1AdbInterfaceObject@@MAE@XZ
?GetUsbInterfaceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_INTERFACE_DESCRIPTOR@@@Z

Exports

Exports

InstantiateWinUsbInterface

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Root·/CallMaster_V4.1.2.26_Android_pf145_bi800_(Build12073017).apk
.apk android arch:arm

com.blovestorm

.application.DialerActivity

Activities

.application.CallMaster

com.blovestorm.UC_BROWSER_BLOVESTORM_COMPLETED

.message.mms.NewMessageToSendActivity

android.intent.action.SEND

.application.DialerActivity

android.intent.action.MAIN
android.intent.action.MAIN
android.intent.action.MAIN
com.blovestorm.action.START_SMART_DIALER
com.blovestorm.action.VIEW_MISS_VOIP_CALL
com.blovestorm.action.VIEW_CONVERSATION
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.CALL_BUTTON
android.intent.action.DIAL
android.intent.action.VIEW
android.intent.action.DIAL

.application.DialerActivity2

android.intent.action.MAIN

.application.more.CreateSmartdialerShortcutActivity

android.intent.action.CREATE_SHORTCUT

.application.more.CreateDonkeymessagesShortcutActivity

android.intent.action.CREATE_SHORTCUT

.application.more.CreateContactslistShortcutActivity

android.intent.action.CREATE_SHORTCUT

.toolbox.datalistener.activity.DataListenerActivity

android.intent.action.DEFAULT
com.blovestorm.action.SHOW_AUTOADJUST_DIALOG

.contact.activity.ContactDetailsActivity

android.intent.action.VIEW

.message.ucim.activity.ActivityChatting

android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.SENDTO

Permissions

android.permission.RECEIVE_BOOT_COMPLETED
android.permission.READ_PHONE_STATE
android.permission.MODIFY_PHONE_STATE
android.permission.PROCESS_OUTGOING_CALLS
android.permission.CALL_PHONE
android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_CONTACTS
android.permission.WRITE_CONTACTS
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.RECEIVE_SMS
android.permission.VIBRATE
android.permission.SEND_SMS
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.RECEIVE_MMS
android.permission.RESTART_PACKAGES
android.permission.RAISED_THREAD_PRIORITY
com.android.launcher.permission.INSTALL_SHORTCUT
Intent.FLAG_GRANT_READ_URI_PERMISSION
Intent.FLAG_GRANT_WRITE_URI_PERMISSION
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.WAKE_LOCK
android.permission.READ_LOGS
android.permission.WRITE_SETTINGS
android.permission.GET_TASKS
android.permission.PERSISTENT_ACTIVITY
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.RECORD_VIDEO
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION

Receivers

.daemon.BootReceiver

android.intent.action.BOOT_COMPLETED

.daemon.SmsReceiver

android.provider.Telephony.SMS_RECEIVED

.daemon.OutgoingCallReceiver

android.intent.action.NEW_OUTGOING_CALL
android.intent.action.NEW_OUTGOING_CALL_FROM_CALLMASTER

.daemon.IncomingCallReceiver

android.intent.action.PHONE_STATE

.daemon.CallMasterEventReceiver

com.blovestorm.action.UPDATE_THREAD

.daemon.DndReceiver

com.blovestorm.donkey.dnd.ALARM_ALERT

.daemon.AutoWackupReceiver

com.blovestorm.donkey.autowakeup.NOTIFY

.daemon.UnreadMessageNotifier

com.blovestorm.unread.message.NOTIFY

.daemon.TrafficResetReceiver

com.blovestorm.donkey.TRAFFIC_RESET

.daemon.BootReceiver

android.intent.action.BOOT_COMPLETED

.ui.DataWidget

android.appwidget.action.APPWIDGET_UPDATE
com.blovestorm.intent.action.DATA_CHANGED
com.blovestorm.intent.action.Intent_REQUEST

.message.mms.SmsReceiver

com.android.mms.transaction.MESSAGE_SENT
android.intent.action.SEND_MESSAGE

.message.mms.MessageStatusReceiver

com.android.mms.transaction.MessageStatusReceiver.MESSAGE_STATUS_RECEIVED

.message.mms.PushReceiver

android.provider.Telephony.WAP_PUSH_RECEIVED

.daemon.ClearNotificationReceiver

com.blovestorm.intent.action.CLEAR_NOTIFICATION

com.blovestorm.daemon.NetworkMonitorForStartApp

android.net.conn.CONNECTIVITY_CHANGE

.toolbox.appupdate.service.AppAutoCheckReceiver

com.blovestorm.intent.action.AUTO_APP_CHECK
com.blovestorm.intent.action_MAUNAL_APP_CHECK

Services

.daemon.CallMasterD

com.blovestorm.daemon.ILocationService
CallMasterNotification.apk
.apk android

com.blovestorm.utils

.UninstPluginDialogActivity

Activities

Permissions

android.permission.MODIFY_PHONE_STATE
android.permission.RECEIVE_BOOT_COMPLETED

Receivers

.CancelNotifyBroadcastReceiver

com.blovestorm.CLEAR_MISSED_CALLS_NOTIFICATION
android.intent.action.PACKAGE_REMOVED
android.intent.action.BOOT_COMPLETED
com.blovestorm.action.WAIT_FOR_REINSTALL
Root·/RootExplorer.apk
.apk android

com.speedsoftware.rootexplorer

.RootExplorer

Activities

.RootExplorer

android.intent.action.MAIN
android.intent.action.GET_CONTENT

Permissions

android.permission.WRITE_EXTERNAL_STORAGE
Root·/Superuser.apk
.apk android

com.noshufou.android.su

HomeActivity

Activities

Permissions

com.noshufou.android.su.RESPOND
com.noshufou.android.su.provider.READ
com.noshufou.android.su.provider.WRITE
android.permission.INTERNET
android.permission.NFC
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED

Receivers

SuRequestReceiver

com.noshufou.android.su.REQUEST

SuResultReceiver

com.noshufou.android.su.RESULT
com.noshufou.android.su.NOTIFICATION

SecretCodeReceiver

android.provider.Telephony.SECRET_CODE

InstallReceiver

android.intent.action.PACKAGE_ADDED

UninstallReceiver

android.intent.action.PACKAGE_REMOVED

UpdatePermissionsReceiver

com.noshufou.android.su.UPDATE_PERMISSIONS
android.intent.action.BOOT_COMPLETED

Services
Root·/SuperuserElite.apk
.apk android

com.noshufou.android.su.elite

FeaturedAppsActivity

Activities

Permissions

com.android.vending.CHECK_LICENSE
android.permission.INTERNET
com.noshufou.android.su.provider.READ

Services

.service.LicenseService

com.noshufou.android.su.elite.LicenseChecker
Root·/USBFlash.dll
.dll windows:4 windows x86 arch:x86

e090151c8a00d97764fc7f52dbd461f7

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:05:50:17:2d:08:94:7c:d6:29:80:77:70:87:87:b9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

14/06/2007, 00:00

Not After

13/06/2010, 23:59

Subject

CN=Sony Ericsson Mobile Communications AB,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Customer Services,O=Sony Ericsson Mobile Communications AB,L=Lund,ST=Skane,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a0:02:05:e3:b1:27:2c:b6:fc:85:f1:d4:be:76:be:7b:b2:7f:16:0c
Signer

Actual PE Digest

a0:02:05:e3:b1:27:2c:b6:fc:85:f1:d4:be:76:be:7b:b2:7f:16:0c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList

kernel32

SetLastError
FlushFileBuffers
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateFileW
CloseHandle
CancelIo
GetOverlappedResult
WaitForSingleObject
GetLastError
CreateEventW
ReadFile
WriteFile
ClearCommError
DeviceIoControl
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CreateFileA

Exports

Exports

_JNI_OnLoad@8
_Java_com_sonyericsson_cs_usbflashnative_impl_USBFlashNativeImpl_clearStatusDFU@12
_Java_com_sonyericsson_cs_usbflashnative_impl_USBFlashNativeImpl_close@12
_Java_com_sonyericsson_cs_usbflashnative_impl_USBFlashNativeImpl_downloadDFU@16
_Java_com_sonyericsson_cs_usbflashnative_impl_USBFlashNativeImpl_getMaxAllowedBufferSize@8
_Java_com_sonyericsson_cs_usbflashnative_impl_USBFlashNativeImpl_getStatusDFU@12
_Java_com_sonyericsson_cs_usbflashnative_impl_USBFlashNativeImpl_openChannel@16
_Java_com_sonyericsson_cs_usbflashnative_impl_USBFlashNativeImpl_readBytes__II@16
_Java_com_sonyericsson_cs_usbflashnative_impl_USBFlashNativeImpl_readBytes__III@20
_Java_com_sonyericsson_cs_usbflashnative_impl_USBFlashNativeImpl_rxByteCount@12
_Java_com_sonyericsson_cs_usbflashnative_impl_USBFlashNativeImpl_switchToDFU@12
_Java_com_sonyericsson_cs_usbflashnative_impl_USBFlashNativeImpl_writeBytes@16

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Root·/adb
.elf linux x86
Root·/adb.exe
.exe windows:4 windows x86 arch:x86

fef6cee9d0e4eec527f09da74363e32f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateEventA
CreateFileA
CreatePipe
CreateProcessA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetFileAttributesA
GetFileSize
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathA
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
ReadFile
ResetEvent
SetConsoleCtrlHandler
SetEvent
SetFilePointer
SetHandleInformation
SetLastError
SetUnhandledExceptionFilter
Sleep
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

_access
_chmod
_getcwd
_getpid
_read
_stat
_strdup
_stricmp
_unlink
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_beginthread
_cexit
_errno
_findclose
_findfirst
_findnext
_fullpath
_iob
_isctype
_mkdir
_onexit
_pctype
_setmode
abort
atexit
atoi
calloc
exit
fflush
fgets
fopen
fprintf
fputc
free
fwrite
getenv
localeconv
malloc
memcpy
memset
perror
realloc
setvbuf
signal
sscanf
strcat
strchr
strcmp
strcpy
strerror
strlen
strncat
strncpy
strpbrk
strrchr
strtol
strtoul
wcslen

shell32

SHGetFolderPathA

ws2_32

WSACleanup
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
gethostbyname
htonl
htons
listen
recv
send
setsockopt
shutdown
socket

adbwinapi

AdbCloseHandle
AdbCreateInterfaceByName
AdbEnumInterfaces
AdbGetEndpointInformation
AdbGetInterfaceName
AdbGetSerialNumber
AdbGetUsbDeviceDescriptor
AdbGetUsbInterfaceDescriptor
AdbNextInterface
AdbOpenDefaultBulkReadEndpoint
AdbOpenDefaultBulkWriteEndpoint
AdbReadEndpointSync
AdbWriteEndpointSync

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 75KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 1024B - Virtual size: 768B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/35
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/47
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/61
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/73
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/86
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/97
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/108
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Root·/kBatteryDoctor_2.9_2000290_14824_20120914_125957_40000018_40000018.apk
.apk android

com.ijinshan.kbatterydoctor

.SplashActivity

Activities

.SplashActivity

android.intent.action.MAIN

.BatteryTabActivity

intent_action

.ShortcutBatteryInfoActivity

android.intent.action.MAIN

.ShortcutWidgetMoreActivityNew

android.intent.action.MAIN

.ShortcutWidgetMoreActivity

android.intent.action.MAIN

.ShortcutAddActivity

android.intent.action.MAIN
android.intent.action.CREATE_SHORTCUT

Permissions

android.permission.SET_WALLPAPER
android.permission.BATTERY_STATS
android.permission.WRITE_SETTINGS
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.READ_SYNC_SETTINGS
android.permission.WRITE_SYNC_SETTINGS
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.RESTART_PACKAGES
android.permission.CAMERA
android.permission.VIBRATE
android.permission.WRITE_APN_SETTINGS
android.permission.MODIFY_PHONE_STATE
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
android.permission.GET_TASKS
android.permission.SYSTEM_ALERT_WINDOW

Receivers

.alarmmode.AlarmModeReceiver

com.ijinshan.kbatterydoctor.ALARM_MODES_ALERT

.alarmmode.AlarmModeInitReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED
android.intent.action.LOCALE_CHANGED

com.ijinshan.kbatterydoctor.receiver.BatteryOptWidget

android.appwidget.action.APPWIDGET_UPDATE

com.ijinshan.kbatterydoctor.receiver.BatteryOptWidgetBig

android.appwidget.action.APPWIDGET_UPDATE
android.net.wifi.WIFI_STATE_CHANGED
android.intent.action.PROVIDER_CHANGED
android.net.conn.CONNECTIVITY_CHANGE
android.media.RINGER_MODE_CHANGED
android.media.VOLUME_CHANGED_ACTION

com.ijinshan.kbatterydoctor.receiver.ShortcutWidget

android.appwidget.action.APPWIDGET_UPDATE
android.net.wifi.WIFI_STATE_CHANGED
android.intent.action.PROVIDER_CHANGED
android.net.conn.CONNECTIVITY_CHANGE
android.media.RINGER_MODE_CHANGED
android.media.VOLUME_CHANGED_ACTION
com.ijinshan.kbatterydoctor.ACTION_SHORTCUT_CLICKED
com.ijinshan.kbatterydoctor.ACTION_SHORTCUT_CHANGED

com.ijinshan.kbatterydoctor.receiver.NetChangeedReceiver

android.net.conn.CONNECTIVITY_CHANGE

com.ijinshan.kbatterydoctor.receiver.AutoUpdateAlarm

com.ijinshan.kbatterydoctor.receiver.ACTION_AUTO_UPDATE

com.ijinshan.kbatterydoctor.receiver.CircleIntervalAlarm

com.ijinshan.kbatterydoctor.receiver.ACTION_CIRCLE_INTERVAL

com.ijinshan.kbatterydoctor.receiver.AutoStartUpReceiver

android.intent.action.BOOT_COMPLETED

.receiver.UserPresentReceiver

android.intent.action.USER_PRESENT

.receiver.ReportDataReceiver

android.intent.action.PACKAGE_ADDED

Services
Root·/oupeng-1_1785_1785111_15_1.apk
.apk android arch:arm

com.oupeng.mini.android

com.opera.mini.android.Browser

Activities

com.opera.mini.android.Browser

android.intent.action.MAIN
android.intent.action.VIEW
android.nfc.action.NDEF_DISCOVERED

Permissions

android.permission.INTERNET
android.permission.ACCESS_WIFI_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.NFC
android.permission.READ_PHONE_STATE
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.browser.permission.READ_HISTORY_BOOKMARKS

Receivers

com.opera.mini.android.NetworkChangedReceiver

android.net.conn.CONNECTIVITY_CHANGE

com.opera.mini.android.OpMiniInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

Services
Root·/qixiazi_root.apk
.apk android

com.qixiazi.market

.LoadingActivity

Activities

.LoadingActivity

android.intent.action.MAIN

Permissions

android.permission.ACCESS_NETWORK_STATE
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
com.android.launcher.permission.INSTALL_SHORTCUT

Services
Root·/su
.elf linux arm
Root·/tencentmobilemanager3.8.5_android_build0599.apk
.apk android arch:arm
qqwebdisk8.tsp
.apk android

com.tencent.qqpimsecure.plugin
Root·/zergRush
.elf linux arm
Root·/˫Root.bat

Sharing

Errors

General

Malware Config

Signatures

Files

c64cac39044626770353879245ea25e4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

kernel32

setupapi

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 79KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

fda9f9f5f569ddd0dbf3ad8a275a2eb8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

kernel32

winusb

adbwinapi

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 47KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

com.blovestorm

.application.DialerActivity

Activities

.application.CallMaster

.message.mms.NewMessageToSendActivity

.application.DialerActivity

.application.DialerActivity2

.application.more.CreateSmartdialerShortcutActivity

.application.more.CreateDonkeymessagesShortcutActivity

.application.more.CreateContactslistShortcutActivity

.toolbox.datalistener.activity.DataListenerActivity

.contact.activity.ContactDetailsActivity

.message.ucim.activity.ActivityChatting

Permissions

Receivers

.daemon.BootReceiver

.daemon.SmsReceiver

.daemon.OutgoingCallReceiver

.daemon.IncomingCallReceiver

.daemon.CallMasterEventReceiver

.daemon.DndReceiver

.daemon.AutoWackupReceiver

.daemon.UnreadMessageNotifier

.daemon.TrafficResetReceiver

.daemon.BootReceiver

.ui.DataWidget

.message.mms.SmsReceiver

.message.mms.MessageStatusReceiver

.message.mms.PushReceiver

.daemon.ClearNotificationReceiver

com.blovestorm.daemon.NetworkMonitorForStartApp

.toolbox.appupdate.service.AppAutoCheckReceiver

Services

.daemon.CallMasterD

com.blovestorm.utils

.UninstPluginDialogActivity

Activities

Permissions

Receivers

.CancelNotifyBroadcastReceiver

com.speedsoftware.rootexplorer

.text
Size: 80KB - Virtual size: 79KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB

.text
Size: 48KB - Virtual size: 47KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

08:05:50:17:2d:08:94:7c:d6:29:80:77:70:87:87:b9
Certificate

a0:02:05:e3:b1:27:2c:b6:fc:85:f1:d4:be:76:be:7b:b2:7f:16:0c
Signer

.text
Size: 56KB - Virtual size: 52KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 93KB - Virtual size: 92KB

.data
Size: 1024B - Virtual size: 668B

.rdata
Size: 31KB - Virtual size: 31KB

.bss
Size: - Virtual size: 75KB

.idata
Size: 4KB - Virtual size: 3KB

/4
Size: 1024B - Virtual size: 768B

/19
Size: 4KB - Virtual size: 4KB

/35
Size: 86KB - Virtual size: 86KB

/47
Size: 15KB - Virtual size: 14KB

/61
Size: 19KB - Virtual size: 18KB

/73
Size: 12KB - Virtual size: 12KB

/86
Size: 1KB - Virtual size: 1KB

/97
Size: 63KB - Virtual size: 63KB

/108
Size: 6KB - Virtual size: 6KB