d9d5a8c86a0f620da36f9a14f04185cb5b966830141a5b6103b489d2a66e0f07

Analysis

max time kernel
2s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
05/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
com.pdflabs.pdfscanner.apk
Size 12.8MB
Sample260705-sdvdqsgx5p
SHA256 d9d5a8c86a0f620da36f9a14f04185cb5b966830141a5b6103b489d2a66e0f07
MD5 409dd9c69e1334d6ce9af6714a18ffa3
SHA1 de1e1111953fdcd112332e6d7e73903bdc34d4bd
SHA512 1b0e121e5590fce6801441992a642f56f2db58365c3e14545b54e191baf2d7c50da111d1d07431c24af2e10914fdb8694f39486f083ed82637b66579493ae7be
SSDEEP 393216:OfZMfhplvBt7ThIauqfXWHhzDIVD6bcAv6J+7C:KMfxZYDquBDyDUG
TLSH
T115D6239AE348913FD43B14324DBE636146575D07CC83AB43A628722C6ABB6C45F1EFD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.pdflabs.pdfscanner

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.pdflabs.pdfscanner

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.pdflabs.pdfscanner

com.pdflabs.pdfscanner
1⤵
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:5138

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.pdflabs.pdfscanner/databases/com.google.android.datatransport.events
Size 40KB
SHA256 e802fdc1ccd833b91d80bb1d8f54cab2b585393e6a07622c4d9feaab07633370
MD5 15d5b92dcbda7ef7f9ca327a903e46e4
SHA1 ca153b66028a58d90346ff8abadbdf01b95c37b1
SHA512 2352f167ee5aa37cb3438a0a7df8f632771a1d019c5cd120fe62313fb73aed6d0e09186a9bf306a564371b846a8da020f6acd7aede0cc47ca50701611fa84aca
SSDEEP 48:Tf+3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPS:z+3KMEX0xIyNYMa
TLSH
T1E703F05D4A202611C2BE083FD7E257531B3CE35F5B2387612E904CF6DDC68B6B831998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pdflabs.pdfscanner/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 a193f10ec189edbc34f513d12b3e00c2a3e0795941d2d05bc6864e24fe6dcbef
MD5 a5a7892189396ce3a89a732081b3d83c
SHA1 a90801fc46a3c0c2cac89e87607800d4a96a82b4
SHA512 6d137faaba77fe16092b818e4d789529b1d69c231fb9c31eb2f329a1f385e87523c93bff7db63ade991dfd0db8aa14487d95d83cb5dfd1d1f6da9b2b6d39555e
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pdflabs.pdfscanner/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 a839bc27d2c9cbfce8bc72a9f5ce2d4c28fd6b3bbf077d972dbbe9e734a22950
MD5 d995d4f372f173ab86e9c75bcea2ae87
SHA1 6a37576fd649423f4842b9e3775fd185d28685b8
SHA512 8e1b4d4529e4d098b9a185782549714aeea8a1bbe3bc49b2572958fa73d8a5c4438dacb508dc96e041dde222d5b41fee927b1860abe52e8ecc0b29bd68349009
SSDEEP 6:7+/l9oo/gn1gong9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK8l:7+tZhwqLiuWdwRmBEyPb7
TLSH
T15A022289ABC01923C81A16B7D4D883880D30E71A8672CB4B156008983D034CCE4A4E84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pdflabs.pdfscanner/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 8e25e3fa01259d1b1ac6d9e5ad812041cebebbb837fb9522b67dd9ae2ad1a29b
MD5 6acbeef10f8cb6d802df0a19d7a2a0bc
SHA1 ca7440085e3de9bf171aa21bd49f5338ba978802
SHA512 9835d51c1082a1f1ce50e3bec1d5747b9c80e938a6bc62a0177ef4fbb41d5399c515b77efb22935402273d34e22fd7f8386a11461204e7f12f690a8b9ed8dc01
SSDEEP 6:7+/l9D0GPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKE//bU:7+t+6qLJdTRmBEyPbXbU
TLSH
T19002129967810A23C56967B7A0D993552E90F7158267CF571560089CBC4A6CCA890E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pdflabs.pdfscanner/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 3b46a825217cb541b2204c298e158d7e7ab7521ad28825c9cec5b373580500f7
MD5 7867edff941cf61f8b47fc7e6d97b0d0
SHA1 589752ff38b3a4fa6dd92f8bf70e9aa8d05b589f
SHA512 2ad4171c246d6826c4bfa56ee1b3ce81e92ef97fa7e889f862c8412607000a80ce95aa4958973dc68c4dc03f7245df9769e9220259eec6cd4825b153794ce131
SSDEEP 3:WllNllv/fll2uFll2OlNll2slNll2pfll:c3E
TLSH
T1AF92093648100036CC1F407C4EED0014263D0188D8F310C010071DF004461138B73C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scanner_db

Path /data/data/com.pdflabs.pdfscanner/databases/scanner_db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

scanner_db-journal

Path /data/data/com.pdflabs.pdfscanner/databases/scanner_db-journal
Size 512B
SHA256 3adc16aa5875c10c9d0e714587871082af6408ee3c6f54e98824f0c775844fa9
MD5 6e614901221d6522a992a2b9396384ae
SHA1 a676a3dbaf0979015e444781bc04600ca768b86c
SHA512 f3dc4e8b0a50b90a4f38f46f02c8dd4368323c25c96de0032e869566e6984fc56b46e3088af7037c400f5e4a14a465073f4e2aafb96cb65cbe4904ca4a1dfd48
MD5 SHA1 SHA512

Submit Download

scanner_db-wal

Path /data/data/com.pdflabs.pdfscanner/databases/scanner_db-wal
Size 16KB
SHA256 f446b36535d65427d66358f9e46e8ef551bf46f049c69e4013c082dc323f1016
MD5 681817bd26cf98feef5198f077f6625b
SHA1 5540159683a899924eab21e19e9b769b87e3e357
SHA512 ffcb5235ff9f594a78bbef6848043baaf7413560ee953cb8ee405b4d3b63f051ea0acde362f4d8488ae44a7f84ae013c6c01dff2bf25f8ef33e5b3c31c6fdf87
SSDEEP 6:K1TfDGfuWRg9FZdrlOERX4PBX4ogLugMBX4suuK+/P91EtfKIqOqiOw2:KxBWRqzdTRmBEyPbP/FKfKIqOTOw2
TLSH
T19772C264A3800717C21503F660C8F3412EE15A1D4712CB4B351E145B7C822CCA491F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-shm

Path /data/data/com.pdflabs.pdfscanner/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads