pegasus | JaffaCakes118_78ba988e4f67b294cd4bad239a9ac2a2

Sharing

Copy URL

Twitter E-mail

Reason

error processing APK: strconv.ParseInt: parsing "0x7fffffff": invalid syntax

General

Target

JaffaCakes118_78ba988e4f67b294cd4bad239a9ac2a2
Size

17.2MB
MD5

78ba988e4f67b294cd4bad239a9ac2a2
SHA1

9de70eb8ad7933e280f712fe1ac0af420603b8d8
SHA256

1a808f82cf69a0fcf13e133151f5dd052ffe2353b1f1f77e9ce7c62edc4cbff9
SHA512

0b5ab9f98b7bb0cfe675606ace89d18f71932e6d0cfe9c1e297678ca60fd04373b1f53b9cffe6cbbc01fc1bc4a70bdf97faad64db992c4b9e694351b03cae595
SSDEEP

393216:/7VxC17f4zTk6L5iu09fnvXhm/UTsl+nV4/:xxC1D4zQfu09Xhm/UT8+V4/

Score

10^/10

pegasus

Malware Config

Signatures

Pegasus family
pegasus

Pegasus payload 1 IoCs

resource	yara_rule
static1/unpack001/S760һROOT/tencentmobilemanager3.8.5_android_build0599.apk	family_pegasus1

Requests dangerous framework permissions 16 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/S760һROOT/AdbWinApi.dll
unpack001/S760һROOT/AdbWinUsbApi.dll
unpack001/S760һROOT/adb.exe

Files

JaffaCakes118_78ba988e4f67b294cd4bad239a9ac2a2
.zip
S760һROOT/AdbWinApi.dll
.dll windows:6 windows x86 arch:x86

c64cac39044626770353879245ea25e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\code\android\donut\development\host\windows\usb\api\objfre_wxp_x86\i386\AdbWinApi.pdb

Imports

ole32

CoCreateInstance

kernel32

GetACP
SetLastError
CloseHandle
GetLastError
DeviceIoControl
WriteFile
ReadFile
GetOverlappedResult
CreateFileW
WideCharToMultiByte
Sleep
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetProcAddress
LoadLibraryW
GetFileAttributesW
GetSystemDirectoryW
RaiseException
FreeLibrary
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetCommandLineA
GetVersionExA
RtlUnwind
HeapFree
HeapAlloc
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCPInfo
GetOEMCP
OutputDebugStringA
VirtualAlloc
HeapReAlloc
HeapSize
LoadLibraryA
GetModuleHandleW
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
VirtualProtect
GetSystemInfo
VirtualQuery
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW

Exports

Exports

??0AdbEndpointObject@@QAE@ABV0@@Z
??0AdbEndpointObject@@QAE@PAVAdbInterfaceObject@@EE@Z
??0AdbIOCompletion@@QAE@ABV0@@Z
??0AdbIOCompletion@@QAE@PAVAdbEndpointObject@@KPAX@Z
??0AdbInterfaceObject@@QAE@ABV0@@Z
??0AdbInterfaceObject@@QAE@PBG@Z
??0AdbObjectHandle@@QAE@ABV0@@Z
??0AdbObjectHandle@@QAE@W4AdbObjectType@@@Z
??1AdbEndpointObject@@MAE@XZ
??1AdbIOCompletion@@MAE@XZ
??1AdbInterfaceObject@@MAE@XZ
??1AdbObjectHandle@@MAE@XZ
??4AdbEndpointObject@@QAEAAV0@ABV0@@Z
??4AdbIOCompletion@@QAEAAV0@ABV0@@Z
??4AdbInterfaceObject@@QAEAAV0@ABV0@@Z
??4AdbObjectHandle@@QAEAAV0@ABV0@@Z
??_7AdbEndpointObject@@6B@
??_7AdbIOCompletion@@6B@
??_7AdbInterfaceObject@@6B@
??_7AdbObjectHandle@@6B@
?AddRef@AdbObjectHandle@@UAEJXZ
?AsyncRead@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?AsyncWrite@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?CloseHandle@AdbObjectHandle@@UAE_NXZ
?CreateHandle@AdbObjectHandle@@UAEPAXXZ
?GetEndpointInformation@AdbEndpointObject@@UAE_NPAU_AdbEndpointInformation@@@Z
?GetInterfaceName@AdbInterfaceObject@@UAE_NPAXPAK_N@Z
?GetParentInterfaceHandle@AdbEndpointObject@@QBEPAXXZ
?GetParentObjectHandle@AdbIOCompletion@@QBEPAXXZ
?GetUsbConfigurationDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_CONFIGURATION_DESCRIPTOR@@@Z
?GetUsbDeviceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_DEVICE_DESCRIPTOR@@@Z
?GetUsbInterfaceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_INTERFACE_DESCRIPTOR@@@Z
?IsCompleted@AdbIOCompletion@@UAE_NXZ
?IsObjectOfType@AdbObjectHandle@@UBE_NW4AdbObjectType@@@Z
?IsOpened@AdbObjectHandle@@QBE_NXZ
?LastReferenceReleased@AdbObjectHandle@@MAEXXZ
?Lookup@AdbObjectHandle@@SGPAV1@PAX@Z
?Release@AdbObjectHandle@@UAEJXZ
?SyncRead@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?SyncWrite@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?Type@AdbEndpointObject@@SG?AW4AdbObjectType@@XZ
?Type@AdbIOCompletion@@SG?AW4AdbObjectType@@XZ
?Type@AdbInterfaceObject@@SG?AW4AdbObjectType@@XZ
?adb_handle@AdbObjectHandle@@QBEPAXXZ
?endpoint_id@AdbEndpointObject@@QBEEXZ
?endpoint_index@AdbEndpointObject@@QBEEXZ
?interface_name@AdbInterfaceObject@@QBEABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?object_type@AdbObjectHandle@@QBE?AW4AdbObjectType@@XZ
?overlapped@AdbIOCompletion@@QAEPAU_OVERLAPPED@@XZ
?parent_interface@AdbEndpointObject@@QBEPAVAdbInterfaceObject@@XZ
?parent_io_object@AdbIOCompletion@@QBEPAVAdbEndpointObject@@XZ
?usb_config_descriptor@AdbInterfaceObject@@QBEPBU_USB_CONFIGURATION_DESCRIPTOR@@XZ
?usb_device_descriptor@AdbInterfaceObject@@QBEPBU_USB_DEVICE_DESCRIPTOR@@XZ
?usb_interface_descriptor@AdbInterfaceObject@@QBEPBU_USB_INTERFACE_DESCRIPTOR@@XZ
AdbCloseHandle
AdbCreateInterface
AdbCreateInterfaceByName
AdbEnumInterfaces
AdbGetDefaultBulkReadEndpointInformation
AdbGetDefaultBulkWriteEndpointInformation
AdbGetEndpointInformation
AdbGetEndpointInterface
AdbGetInterfaceName
AdbGetOvelappedIoResult
AdbGetSerialNumber
AdbGetUsbConfigurationDescriptor
AdbGetUsbDeviceDescriptor
AdbGetUsbInterfaceDescriptor
AdbHasOvelappedIoComplated
AdbNextInterface
AdbOpenDefaultBulkReadEndpoint
AdbOpenDefaultBulkWriteEndpoint
AdbOpenEndpoint
AdbQueryInformationEndpoint
AdbReadEndpointAsync
AdbReadEndpointSync
AdbResetInterfaceEnum
AdbWriteEndpointAsync
AdbWriteEndpointSync

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
S760һROOT/AdbWinUsbApi.dll
.dll windows:6 windows x86 arch:x86

fda9f9f5f569ddd0dbf3ad8a275a2eb8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\code\android\donut\development\host\windows\usb\winusb\objfre_wxp_x86\i386\AdbWinUsbApi.pdb

Imports

ole32

CoCreateInstance

kernel32

TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapReAlloc
HeapSize
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
WriteFile
OutputDebugStringA
ExitProcess
LoadLibraryA
GetModuleHandleW
GetCPInfo
GetACP
GetOEMCP
GetModuleHandleA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
VirtualProtect
GetSystemInfo
VirtualQuery
GetProcAddress
HeapAlloc
HeapFree
RtlUnwind
GetVersionExA
GetCommandLineA
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
Sleep
CreateFileW
WideCharToMultiByte
CreateEventW
CloseHandle
GetLastError
SetLastError
InterlockedDecrement
GetLocaleInfoA

winusb

WinUsb_GetDescriptor
WinUsb_Free
WinUsb_QueryPipe
WinUsb_GetOverlappedResult
WinUsb_ReadPipe
WinUsb_WritePipe
WinUsb_QueryInterfaceSettings
WinUsb_GetCurrentAlternateSetting
WinUsb_Initialize
WinUsb_SetPipePolicy

adbwinapi

?IsCompleted@AdbIOCompletion@@UAE_NXZ
??0AdbIOCompletion@@QAE@PAVAdbEndpointObject@@KPAX@Z
?GetUsbConfigurationDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_CONFIGURATION_DESCRIPTOR@@@Z
?GetUsbDeviceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_DEVICE_DESCRIPTOR@@@Z
?GetInterfaceName@AdbInterfaceObject@@UAE_NPAXPAK_N@Z
??0AdbInterfaceObject@@QAE@PBG@Z
??1AdbEndpointObject@@MAE@XZ
?SyncWrite@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?SyncRead@AdbEndpointObject@@UAE_NPAXKPAKK@Z
?AsyncWrite@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?AsyncRead@AdbEndpointObject@@UAEPAXPAXKPAK0K@Z
?GetEndpointInformation@AdbEndpointObject@@UAE_NPAU_AdbEndpointInformation@@@Z
?LastReferenceReleased@AdbObjectHandle@@MAEXXZ
?IsObjectOfType@AdbObjectHandle@@UBE_NW4AdbObjectType@@@Z
?CloseHandle@AdbObjectHandle@@UAE_NXZ
?CreateHandle@AdbObjectHandle@@UAEPAXXZ
?AddRef@AdbObjectHandle@@UAEJXZ
??0AdbEndpointObject@@QAE@PAVAdbInterfaceObject@@EE@Z
??1AdbIOCompletion@@MAE@XZ
??1AdbInterfaceObject@@MAE@XZ
?GetUsbInterfaceDescriptor@AdbInterfaceObject@@UAE_NPAU_USB_INTERFACE_DESCRIPTOR@@@Z

Exports

Exports

InstantiateWinUsbInterface

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
S760һROOT/CallMaster_V4.1.2.26_Android_pf145_bi800_(Build12073017).apk
.apk android arch:arm

com.blovestorm

.application.DialerActivity

Activities

.application.CallMaster

com.blovestorm.UC_BROWSER_BLOVESTORM_COMPLETED

.message.mms.NewMessageToSendActivity

android.intent.action.SEND

.application.DialerActivity

android.intent.action.MAIN
android.intent.action.MAIN
android.intent.action.MAIN
com.blovestorm.action.START_SMART_DIALER
com.blovestorm.action.VIEW_MISS_VOIP_CALL
com.blovestorm.action.VIEW_CONVERSATION
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.CALL_BUTTON
android.intent.action.DIAL
android.intent.action.VIEW
android.intent.action.DIAL

.application.DialerActivity2

android.intent.action.MAIN

.application.more.CreateSmartdialerShortcutActivity

android.intent.action.CREATE_SHORTCUT

.application.more.CreateDonkeymessagesShortcutActivity

android.intent.action.CREATE_SHORTCUT

.application.more.CreateContactslistShortcutActivity

android.intent.action.CREATE_SHORTCUT

.toolbox.datalistener.activity.DataListenerActivity

android.intent.action.DEFAULT
com.blovestorm.action.SHOW_AUTOADJUST_DIALOG

.contact.activity.ContactDetailsActivity

android.intent.action.VIEW

.message.ucim.activity.ActivityChatting

android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.SENDTO

Permissions

android.permission.RECEIVE_BOOT_COMPLETED
android.permission.READ_PHONE_STATE
android.permission.MODIFY_PHONE_STATE
android.permission.PROCESS_OUTGOING_CALLS
android.permission.CALL_PHONE
android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_CONTACTS
android.permission.WRITE_CONTACTS
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.RECEIVE_SMS
android.permission.VIBRATE
android.permission.SEND_SMS
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.RECEIVE_MMS
android.permission.RESTART_PACKAGES
android.permission.RAISED_THREAD_PRIORITY
com.android.launcher.permission.INSTALL_SHORTCUT
Intent.FLAG_GRANT_READ_URI_PERMISSION
Intent.FLAG_GRANT_WRITE_URI_PERMISSION
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.WAKE_LOCK
android.permission.READ_LOGS
android.permission.WRITE_SETTINGS
android.permission.GET_TASKS
android.permission.PERSISTENT_ACTIVITY
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.RECORD_VIDEO
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION

Receivers

.daemon.BootReceiver

android.intent.action.BOOT_COMPLETED

.daemon.SmsReceiver

android.provider.Telephony.SMS_RECEIVED

.daemon.OutgoingCallReceiver

android.intent.action.NEW_OUTGOING_CALL
android.intent.action.NEW_OUTGOING_CALL_FROM_CALLMASTER

.daemon.IncomingCallReceiver

android.intent.action.PHONE_STATE

.daemon.CallMasterEventReceiver

com.blovestorm.action.UPDATE_THREAD

.daemon.DndReceiver

com.blovestorm.donkey.dnd.ALARM_ALERT

.daemon.AutoWackupReceiver

com.blovestorm.donkey.autowakeup.NOTIFY

.daemon.UnreadMessageNotifier

com.blovestorm.unread.message.NOTIFY

.daemon.TrafficResetReceiver

com.blovestorm.donkey.TRAFFIC_RESET

.daemon.BootReceiver

android.intent.action.BOOT_COMPLETED

.ui.DataWidget

android.appwidget.action.APPWIDGET_UPDATE
com.blovestorm.intent.action.DATA_CHANGED
com.blovestorm.intent.action.Intent_REQUEST

.message.mms.SmsReceiver

com.android.mms.transaction.MESSAGE_SENT
android.intent.action.SEND_MESSAGE

.message.mms.MessageStatusReceiver

com.android.mms.transaction.MessageStatusReceiver.MESSAGE_STATUS_RECEIVED

.message.mms.PushReceiver

android.provider.Telephony.WAP_PUSH_RECEIVED

.daemon.ClearNotificationReceiver

com.blovestorm.intent.action.CLEAR_NOTIFICATION

com.blovestorm.daemon.NetworkMonitorForStartApp

android.net.conn.CONNECTIVITY_CHANGE

.toolbox.appupdate.service.AppAutoCheckReceiver

com.blovestorm.intent.action.AUTO_APP_CHECK
com.blovestorm.intent.action_MAUNAL_APP_CHECK

Services

.daemon.CallMasterD

com.blovestorm.daemon.ILocationService
CallMasterNotification.apk
.apk android

com.blovestorm.utils

.UninstPluginDialogActivity

Activities

Permissions

android.permission.MODIFY_PHONE_STATE
android.permission.RECEIVE_BOOT_COMPLETED

Receivers

.CancelNotifyBroadcastReceiver

com.blovestorm.CLEAR_MISSED_CALLS_NOTIFICATION
android.intent.action.PACKAGE_REMOVED
android.intent.action.BOOT_COMPLETED
com.blovestorm.action.WAIT_FOR_REINSTALL
S760һROOT/GingerBreak
.tar
GingerBreak2/743c.jpg
.jpg
GingerBreak2/GingerBreak
.elf linux arm
GingerBreak2/GingerBreak.c
GingerBreak2/README
GingerBreak2/gingerbreak.jpg
.jpg
S760һROOT/ROOT.bat
S760һROOT/Superuser.apk
.apk android

com.noshufou.android.su

HomeActivity

Activities

Permissions

com.noshufou.android.su.RESPOND
com.noshufou.android.su.provider.READ
com.noshufou.android.su.provider.WRITE
android.permission.INTERNET
android.permission.NFC
android.permission.WRITE_EXTERNAL_STORAGE

Receivers

SuRequestReceiver

com.noshufou.android.su.REQUEST

SuResultReceiver

com.noshufou.android.su.RESULT
com.noshufou.android.su.NOTIFICATION

SecretCodeReceiver

android.provider.Telephony.SECRET_CODE

InstallReceiver

android.intent.action.PACKAGE_ADDED

UninstallReceiver

android.intent.action.PACKAGE_REMOVED

Services
S760һROOT/SuperuserElite.apk
.apk android

com.noshufou.android.su.elite

FeaturedAppsActivity

Activities

Permissions

com.android.vending.CHECK_LICENSE
android.permission.INTERNET
com.noshufou.android.su.provider.READ

Services

.service.LicenseService

com.noshufou.android.su.elite.LicenseChecker
S760һROOT/adb.exe
.exe windows:4 windows x86 arch:x86

4f3742319a48385a4bf6c6624a9ad1e1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_access
_chmod
_getcwd
_getpid
_read
_stat
_strdup
_stricmp
_unlink
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_beginthread
_cexit
_errno
_findclose
_findfirst
_findnext
_fullpath
_iob
_isctype
_mkdir
_onexit
_pctype
_setmode
_winmajor
abort
atexit
atoi
calloc
exit
fflush
fgets
fopen
fprintf
fputc
free
fwrite
getenv
localeconv
malloc
memcpy
memset
perror
realloc
setvbuf
signal
sscanf
strcat
strchr
strcmp
strcpy
strerror
strlen
strncat
strpbrk
strrchr
strtol
strtoul
vfprintf
wcslen

kernel32

CloseHandle
CreateEventA
CreateFileA
CreatePipe
CreateProcessA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeLibrary
GetFileAttributesA
GetFileSize
GetLastError
GetModuleFileNameA
GetProcAddress
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathA
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
ReadFile
ResetEvent
SetConsoleCtrlHandler
SetEvent
SetFilePointer
SetHandleInformation
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile

shell32

SHGetFolderPathA

ws2_32

WSACleanup
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
gethostbyname
htonl
htons
listen
recv
send
setsockopt
shutdown
socket

adbwinapi

AdbCloseHandle
AdbCreateInterfaceByName
AdbEnumInterfaces
AdbGetEndpointInformation
AdbGetInterfaceName
AdbGetSerialNumber
AdbGetUsbDeviceDescriptor
AdbGetUsbInterfaceDescriptor
AdbNextInterface
AdbOpenDefaultBulkReadEndpoint
AdbOpenDefaultBulkWriteEndpoint
AdbReadEndpointSync
AdbWriteEndpointSync

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 75KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.stab
Size: 423KB - Virtual size: 423KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.stabstr
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
S760һROOT/busybox
.elf linux arm
S760һROOT/kBatteryDoctor_2.9_2000290_14824_20120914_125957_40000018_40000018.apk
.apk android

com.ijinshan.kbatterydoctor

.SplashActivity

Activities

.SplashActivity

android.intent.action.MAIN

.BatteryTabActivity

intent_action

.ShortcutBatteryInfoActivity

android.intent.action.MAIN

.ShortcutWidgetMoreActivityNew

android.intent.action.MAIN

.ShortcutWidgetMoreActivity

android.intent.action.MAIN

.ShortcutAddActivity

android.intent.action.MAIN
android.intent.action.CREATE_SHORTCUT

Permissions

android.permission.SET_WALLPAPER
android.permission.BATTERY_STATS
android.permission.WRITE_SETTINGS
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.READ_SYNC_SETTINGS
android.permission.WRITE_SYNC_SETTINGS
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.RESTART_PACKAGES
android.permission.CAMERA
android.permission.VIBRATE
android.permission.WRITE_APN_SETTINGS
android.permission.MODIFY_PHONE_STATE
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
android.permission.GET_TASKS
android.permission.SYSTEM_ALERT_WINDOW

Receivers

.alarmmode.AlarmModeReceiver

com.ijinshan.kbatterydoctor.ALARM_MODES_ALERT

.alarmmode.AlarmModeInitReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED
android.intent.action.LOCALE_CHANGED

com.ijinshan.kbatterydoctor.receiver.BatteryOptWidget

android.appwidget.action.APPWIDGET_UPDATE

com.ijinshan.kbatterydoctor.receiver.BatteryOptWidgetBig

android.appwidget.action.APPWIDGET_UPDATE
android.net.wifi.WIFI_STATE_CHANGED
android.intent.action.PROVIDER_CHANGED
android.net.conn.CONNECTIVITY_CHANGE
android.media.RINGER_MODE_CHANGED
android.media.VOLUME_CHANGED_ACTION

com.ijinshan.kbatterydoctor.receiver.ShortcutWidget

android.appwidget.action.APPWIDGET_UPDATE
android.net.wifi.WIFI_STATE_CHANGED
android.intent.action.PROVIDER_CHANGED
android.net.conn.CONNECTIVITY_CHANGE
android.media.RINGER_MODE_CHANGED
android.media.VOLUME_CHANGED_ACTION
com.ijinshan.kbatterydoctor.ACTION_SHORTCUT_CLICKED
com.ijinshan.kbatterydoctor.ACTION_SHORTCUT_CHANGED

com.ijinshan.kbatterydoctor.receiver.NetChangeedReceiver

android.net.conn.CONNECTIVITY_CHANGE

com.ijinshan.kbatterydoctor.receiver.AutoUpdateAlarm

com.ijinshan.kbatterydoctor.receiver.ACTION_AUTO_UPDATE

com.ijinshan.kbatterydoctor.receiver.CircleIntervalAlarm

com.ijinshan.kbatterydoctor.receiver.ACTION_CIRCLE_INTERVAL

com.ijinshan.kbatterydoctor.receiver.AutoStartUpReceiver

android.intent.action.BOOT_COMPLETED

.receiver.UserPresentReceiver

android.intent.action.USER_PRESENT

.receiver.ReportDataReceiver

android.intent.action.PACKAGE_ADDED

Services
S760һROOT/oupeng-1_1785_1785111_15_1.apk
.apk android arch:arm

com.oupeng.mini.android

com.opera.mini.android.Browser

Activities

com.opera.mini.android.Browser

android.intent.action.MAIN
android.intent.action.VIEW
android.nfc.action.NDEF_DISCOVERED

Permissions

android.permission.INTERNET
android.permission.ACCESS_WIFI_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.NFC
android.permission.READ_PHONE_STATE
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.browser.permission.READ_HISTORY_BOOKMARKS

Receivers

com.opera.mini.android.NetworkChangedReceiver

android.net.conn.CONNECTIVITY_CHANGE

com.opera.mini.android.OpMiniInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

Services
S760һROOT/qixiazi_root.apk
.apk android

com.qixiazi.market

.LoadingActivity

Activities

.LoadingActivity

android.intent.action.MAIN

Permissions

android.permission.ACCESS_NETWORK_STATE
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
com.android.launcher.permission.INSTALL_SHORTCUT

Services
S760һROOT/su
.elf linux arm
S760һROOT/system@[email protected]@classes.dex
.dex
S760һROOT/system@[email protected]@classes.dex
.dex
S760һROOT/tencentmobilemanager3.8.5_android_build0599.apk
.apk android arch:arm
qqwebdisk8.tsp
.apk android

com.tencent.qqpimsecure.plugin
S760һROOT/zR
.elf linux arm

Sharing

Errors

General

Malware Config

Signatures

Files

c64cac39044626770353879245ea25e4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

kernel32

setupapi

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 79KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

fda9f9f5f569ddd0dbf3ad8a275a2eb8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

kernel32

winusb

adbwinapi

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 47KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

com.blovestorm

.application.DialerActivity

Activities

.application.CallMaster

.message.mms.NewMessageToSendActivity

.application.DialerActivity

.application.DialerActivity2

.application.more.CreateSmartdialerShortcutActivity

.application.more.CreateDonkeymessagesShortcutActivity

.application.more.CreateContactslistShortcutActivity

.toolbox.datalistener.activity.DataListenerActivity

.contact.activity.ContactDetailsActivity

.message.ucim.activity.ActivityChatting

Permissions

Receivers

.daemon.BootReceiver

.daemon.SmsReceiver

.daemon.OutgoingCallReceiver

.daemon.IncomingCallReceiver

.daemon.CallMasterEventReceiver

.daemon.DndReceiver

.daemon.AutoWackupReceiver

.daemon.UnreadMessageNotifier

.daemon.TrafficResetReceiver

.daemon.BootReceiver

.ui.DataWidget

.message.mms.SmsReceiver

.message.mms.MessageStatusReceiver

.message.mms.PushReceiver

.daemon.ClearNotificationReceiver

com.blovestorm.daemon.NetworkMonitorForStartApp

.toolbox.appupdate.service.AppAutoCheckReceiver

Services

.daemon.CallMasterD

com.blovestorm.utils

.UninstPluginDialogActivity

Activities

Permissions

Receivers

.CancelNotifyBroadcastReceiver

com.noshufou.android.su

.text
Size: 80KB - Virtual size: 79KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB

.text
Size: 48KB - Virtual size: 47KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 101KB - Virtual size: 100KB

.data
Size: 31KB - Virtual size: 30KB

.bss
Size: - Virtual size: 75KB

.idata
Size: 4KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

.stab
Size: 423KB - Virtual size: 423KB

.stabstr
Size: 1.8MB - Virtual size: 1.8MB