Microsoft_Word_v16[.]0[.]18324[.]20086-Mod-5mod[.]ru[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
Microsoft_Word_v16.0.18324.20086-Mod-5mod.ru.apk
Size 228.5MB
Sample260809-qcv8jaae46
SHA256 fc208f7ef44e4e5dc9abb83bab4d945fa2f4fe77304fe503a535746401c5cf88
MD5 1866c18ce20e1146d8e7414bac911352
SHA1 765c0ef8bb9648b959bb03fedc08b569a852f0c3
SHA512 ab950badbecc44ca4939cb2e5bca7b24911fe9db0c67dc6aef4b8cbcb48aaa218004e20b8000fb322cdbc3894ac21e9b4bb362f29952c5a9942122f20685a892
SSDEEP 1572864:NchTmzCkWrzYsKF1f03X1gFHjnQPsF67ET61nVyGfM9imkkSIcGb:NMTmzCxw70VgFHjoswgQc+k3cGb
TLSH
T1C9B87E04B6CD741AF6CAB0FC9E5A06D1712F7D501A20C1AE3832A60DDDB26F947B97E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Microsoft_Word_v16.0.18324.20086-Mod-5mod.ru.apk

File Explorer

Microsoft_Word_v16.0.18324.20086-Mod-5mod.ru.apk

.apk 228.5MB

Microsoft_Word_v16.0.18324.20086-Mod-5mod.ru.apk

SHA256 fc208f7ef44e4e5dc9abb83bab4d945fa2f4fe77304fe503a535746401c5cf88
MD5 1866c18ce20e1146d8e7414bac911352
SHA1 765c0ef8bb9648b959bb03fedc08b569a852f0c3
SHA512 ab950badbecc44ca4939cb2e5bca7b24911fe9db0c67dc6aef4b8cbcb48aaa218004e20b8000fb322cdbc3894ac21e9b4bb362f29952c5a9942122f20685a892
SSDEEP 1572864:NchTmzCkWrzYsKF1f03X1gFHjnQPsF67ET61nVyGfM9imkkSIcGb:NMTmzCxw70VgFHjoswgQc+k3cGb
TLSH
T1C9B87E04B6CD741AF6CAB0FC9E5A06D1712F7D501A20C1AE3832A60DDDB26F947B97E1
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

e7ca10c700deacd0486d9a9d84176c26cb963689b70da34ab964c1b65db6b470

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Hemant Singh Raghuvanshi,OU=ELA,O=ELA OFFICIAL,L=IN,ST=MP,C=In

com.microsoft.office.word

com.facebook.react.devsupport.DevSettingsActivity

com.microsoft.office.word.WordActivity

android.intent.action.VIEW android.intent.action.MAIN android.intent.action.VIEW android.intent.action.EDIT com.dropbox.android.intent.action.DBXC_EDIT com.dropbox.android.intent.action.DBXC_VIEW android.intent.action.VIEW android.intent.action.EDIT com.dropbox.android.intent.action.DBXC_EDIT com.dropbox.android.intent.action.DBXC_VIEW android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW

com.microsoft.office.hockeyapp.activities.HockeyWebViewActivity

net.hockeyapp.android.UpdateActivity

net.hockeyapp.android.FeedbackActivity

com.microsoft.office.word.ScanToDocumentActivity

com.microsoft.office.msohttp.AddAccountInSettingsActivity

com.dropbox.client2.android.AuthActivity

android.intent.action.VIEW

com.microsoft.aad.adal.AuthenticationActivity

com.microsoft.identity.common.internal.providers.oauth2.AuthorizationActivity

com.microsoft.identity.common.internal.providers.oauth2.CurrentTaskAuthorizationActivity

com.microsoft.identity.common.internal.broker.BrokerActivity

com.microsoft.identity.common.internal.broker.InstallCertActivityLauncher

com.microsoft.office.feedback.inapp.MainActivity

com.android.billingclient.api.ProxyBillingActivity

com.android.billingclient.api.ProxyBillingActivityV2

androidx.compose.ui.tooling.PreviewActivity

androidx.credentials.playservices.HiddenActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.common.api.GoogleApiActivity

com.microsoft.intune.mam.client.app.offline.OfflineStartupBlockedActivity

com.microsoft.intune.mam.client.app.offline.OfflineRestartRequiredActivity

com.microsoft.intune.mam.client.app.startup.MAMStartupActivity

com.microsoft.intune.mam.client.app.resolver.MAMResolverActivity

com.microsoft.intune.mam.client.app.offline.OfflineInstallCompanyPortalDialogActivity

com.microsoft.intune.mam.client.app.offline.OfflineNotifyWipeActivity

com.microsoft.intune.mam.client.app.startup.MAMComplianceBlockActivity

com.microsoft.o365suite.o365shell.applauncher.activities.AppLauncherActivity

com.microsoft.office.onecopilotmobile.integration.keyhighlights.KeyHighlightsActivity

com.microsoft.android.crosssell.activities.PowerpointCrossSellHandlerActivity

android.intent.action.VIEW android.intent.action.EDIT com.dropbox.android.intent.action.DBXC_EDIT com.dropbox.android.intent.action.DBXC_VIEW android.intent.action.VIEW

com.microsoft.android.crosssell.activities.ExcelCrossSellHandlerActivity

android.intent.action.VIEW android.intent.action.EDIT com.dropbox.android.intent.action.DBXC_EDIT com.dropbox.android.intent.action.DBXC_VIEW android.intent.action.VIEW

com.microsoft.android.crosssell.activities.WordCrossSellHandlerActivity

android.intent.action.VIEW android.intent.action.VIEW android.intent.action.EDIT com.dropbox.android.intent.action.DBXC_EDIT com.dropbox.android.intent.action.DBXC_VIEW android.intent.action.VIEW

com.microsoft.android.crosssell.activities.PdfCrossSellHandlerActivity

android.intent.action.VIEW android.intent.action.VIEW android.intent.action.EDIT com.dropbox.android.intent.action.DBXC_EDIT com.dropbox.android.intent.action.DBXC_VIEW

com.microsoft.office.sharecontrollauncher.ShareIntentLauncher$ChooserActivity

com.microsoft.authentication.internal.OneAuthNavigationActivity

com.microsoft.authentication.internal.SignInActivity

com.microsoft.moderninput.voiceactivity.voicesettings.LanguageSettingsActivity

com.microsoft.moderninput.voiceactivity.voicesettings.SettingsActivity

com.microsoft.moderninput.voiceactivity.HelpPageActivity

androidx.test.core.app.InstrumentationActivityInvoker$BootstrapActivity

androidx.test.core.app.InstrumentationActivityInvoker$EmptyActivity

androidx.test.core.app.InstrumentationActivityInvoker$EmptyFloatingActivity

com.microsoft.office.lens.lenscommon.ui.LensActivity

com.microsoft.office.lens.lensgallery.immersivegallery.ImmersiveGalleryActivity

com.microsoft.mobile.paywallsdk.ui.PaywallActivity

com.microsoft.mobile.paywallsdk.ui.compliance.PaywallPrivacyActivity

com.google.android.play.core.common.PlayCoreDialogWrapperActivity

com.yubico.yubikit.android.ui.OtpActivity

com.yubico.yubikit.android.ui.YubiKeyPromptActivity

com.microsoft.office.playStoreDownloadManager.DownloaderServiceImp

com.microsoft.office.word.readaloud.ReadAloudNotificationService

com.microsoft.office.msohttp.keystore.OfficeAuthenticationService

android.accounts.AccountAuthenticator

com.microsoft.office.onepipe.OnepipeFirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.microsoft.office.plat.sharedprefservice.SharedPrefService

com.microsoft.office.plat.sharedprefservice.BIND

androidx.work.multiprocess.RemoteWorkManagerService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.components.ComponentDiscoveryService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

androidx.credentials.playservices.CredentialProviderMetadataHolder

com.google.android.gms.auth.api.signin.RevocationBoundService

androidx.camera.core.impl.MetadataHolderService

com.microsoft.intune.mam.client.notification.MAMNotificationReceiverService

com.microsoft.intune.mam.client.service.MAMBackgroundService

com.microsoft.intune.mam.client.service.MAMBackgroundJobService

com.microsoft.office.appwarmup.service.WarmUpService

com.microsoft.android.crosssell.CrossSellAgentMarker

com.microsoft.android.crosssell.action.AGENT_CHECK

com.microsoft.office.BackgroundTaskHost.BackgroundTaskService

com.microsoft.tokenshare.TokenSharingService

com.microsoft.office.playStoreDownloadManager.BroadcastReceiverImp

com.microsoft.office.officehub.util.OHubBroadcastReceiver

com.android.vending.INSTALL_REFERRER

com.microsoft.office.asyncdatapointreporting.InstallBroadcastReceiver

android.intent.action.PACKAGE_FULLY_REMOVED

com.microsoft.office.onepipe.NotificationDismissedReceiver

com.microsoft.office.BackgroundTasks.FileSuggestionNotifierBackgroundTask

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

com.microsoft.intune.mam.client.service.MAMBackgroundReceiver

android.intent.action.DOWNLOAD_COMPLETE

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

com.microsoft.office.appwarmup.service.AppWarmUpBroadcastReceiver

com.microsoft.office.appwarmup.action.WARMUP

com.microsoft.android.crosssell.CrossSellReceiver

com.microsoft.android.crosssell.action.REFRESH_CROSS_SELL com.microsoft.android.crosssell.action.STOP_CROSS_SELL

com.microsoft.android.crosssell.PackageStateReceiver

android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_CHANGED android.intent.action.PACKAGE_FULLY_REMOVED

com.microsoft.android.crosssell.SelfReplacementReceiver

android.intent.action.MY_PACKAGE_REPLACED

com.microsoft.office.BackgroundTaskHost.SystemBroadcastReceiver

android.intent.action.MY_PACKAGE_REPLACED com.microsoft.office.Notification.ACTION_APP_FIRST_LAUNCH android.intent.action.BOOT_COMPLETED com.microsoft.office.Notification.ACTION_AUTOMATION_RUN com.microsoft.office.Notification.DELAYED_PACKAGE_UPGRADE com.microsoft.office.action.OFF_PEAK_HOURS_DAILY

com.microsoft.office.messagingirispush.IrisPushNotificationDismissHandler

Android Permissions

Microsoft_Word_v16.0.18324.20086-Mod-5mod.ru.apk

Permissions

android.permission.POST_NOTIFICATIONS

android.permission.READ_MEDIA_IMAGES

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.ACCESS_WIFI_STATE

android.permission.RECORD_AUDIO

android.permission.CAMERA

com.android.vending.CHECK_LICENSE

com.android.launcher.permission.INSTALL_SHORTCUT

com.google.android.c2dm.permission.RECEIVE

com.microsoft.office.word.permission.C2D_MESSAGE

android.permission.WAKE_LOCK

com.android.vending.BILLING

android.permission.READ_PHONE_STATE

android.permission.READ_EXTERNAL_STORAGE

com.microsoft.office.word.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.GET_PACKAGE_SIZE

android.permission.SYSTEM_ALERT_WINDOW

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.BLUETOOTH

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.VIBRATE

android.permission.READ_MEDIA_VIDEO

android.permission.READ_MEDIA_VISUAL_USER_SELECTED

android.permission.NFC