Analysis
- max time kernel
125s - max time network
137s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
19/08/2026, 01:53
Behavioral task
behavioral1
Sample
eb46541e2991a20c20fca66e51a705a309e6576296c435126ac369ba41e6bff5.apk
Resource
android-x86-arm-20260325-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
eb46541e2991a20c20fca66e51a705a309e6576296c435126ac369ba41e6bff5.apk
Resource
android-x64-20260325-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
eb46541e2991a20c20fca66e51a705a309e6576296c435126ac369ba41e6bff5.apk
Resource
android-x64-arm64-20260325-en
7 signatures
150 seconds
General
- Target eb46541e2991a20c20fca66e51a705a309e6576296c435126ac369ba41e6bff5.apk
- Size 10.6MB
- Sample260819-cbg3mack2s
- SHA256 eb46541e2991a20c20fca66e51a705a309e6576296c435126ac369ba41e6bff5
- MD5 1e288142a45ebe7244ab899798cea643
- SHA1 078295d1cda8319ed69f64b5443e4d89705d8523
- SHA512 0509d443761eb56aa9f53ca552f06ea1202917fa5daf8b0475da247b031677d363ad95e381065a09939bc2681aaf77abf82869c3d0256afea55f3d145e056d7b
- SSDEEP 196608:+Ubrdcg+Cnp2yJqiHLu5OOERwQDAvpilOV8YJ/ywk3muPFoeDb7uYoeDzGOjCx:+UbJcg++p2yJ5Ligw0CswBCmuP2eLuvn
- TLSH T155B612A3F768599DC8F69371487A5631557BCD208743A78B2808B739787B7E48F88BC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 1 IoCs
ioc Process /system/app/Superuser.apk com.pdfdocuments.quickscannerapp - Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.pdfdocuments.quickscannerapp/cache/1582435991586.jar 5045 com.pdfdocuments.quickscannerapp - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.pdfdocuments.quickscannerapp - Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.pdfdocuments.quickscannerapp - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.pdfdocuments.quickscannerapp - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.pdfdocuments.quickscannerapp - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.pdfdocuments.quickscannerapp - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.pdfdocuments.quickscannerapp - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.pdfdocuments.quickscannerapp
Processes
-
com.pdfdocuments.quickscannerapp1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5045
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.pdfdocuments.quickscannerapp/cache/1582435991586.jar
- Size 9KB
- SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
- MD5 e8e0527a01aefdb89afd2c508f131da1
- SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
- SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
- SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
- TLSH T1C412AEB4BF77093CD0DB0DB8CA67E800A05F25841AA7D514E0656066BFD47B5F1E315A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.pdfdocuments.quickscannerapp/cache/oat/1582435991586.jar.cur.prof
- Size 148B
- SHA256 c5e6754556dbe01b055066f23c28ddaaf5fe67cee4baed00d59dc993335b3d97
- MD5 a3b78d197d786c13687c3f0f89703bd8
- SHA1 9967f0726b6b1ed3f198904547b81920f8329621
- SHA512 9a47c9bb977edec9d29d22f280e0078ca931a722eaecc2b085c6b5aaf6246d17a6ad07c9faca45070bb5b89a3ee6cf896f5e2c7e73fb033e3ac57471df70a8b1
- TLSH T16DC08C5B1321A254E7FD459806F22213D98A50C222503236C37C639042A2050CCE2D39
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db
- Size 12KB
- SHA256 885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
- MD5 ea628e04765adaf4238a5dcdff4bbd51
- SHA1 a801947619ea8c368efe9c006a324dc6339ac60b
- SHA512 c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe
- SSDEEP 6:l9bNFlLdrlOERX4PBX4ogLugMBX4suuKTqiOw2:TLJdTRmBEyPbsOw2
- TLSH T1B74280D5E3401503C515577790C5C3951DA0A72D8733C74B656008547C437CCF890D48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db
- Size 4KB
- SHA256 edfa4ae4b326ad2b092ea797a2d596bd23b01ee2c47cea9cb9a451e6001a912f
- MD5 28322998fd5d3911c5c892e19daf9b83
- SHA1 67ff2566bc9e0377570856d21bfb8f3cf5c9bfc2
- SHA512 80e08b3e20d45aa0986c08ae8a5c3483c067b4aeb1365a29c480226e7251b63ce1e07aa56ec4b214ccac85c36c865b1d1eb328b83eeca1b3fbc2c3610a925c4a
- TLSH T16F812B85B3C00D43C11943B3A0C9C3440D01B329C231CB4B2A710CB8BC439CCF4D0E04
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db-journal
- Size 512B
- SHA256 e33be5485138d263b20d4a0dada27681a873067d5887f1ca0add2cfd83575911
- MD5 85720abd33f1e704d915de9f4035eb10
- SHA1 00a93b8b79daedb7b51368cd8de2f5bfcb567317
- SHA512 144dfc7ed4dbe9c5d5a9e66520ea014659db8cc557232724ed2321497db7ef5fa6f43e5cf1b7a390c4f91ca80206372c510ef09adb4bb1ac95910204c93b0521
- MD5 SHA1 SHA512
- Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db-journal
- Size 8KB
- SHA256 efa16434cb44a298b11c65ac95da6e865d74848e10981ed1f46335a8a04649c7
- MD5 9224de6bf10d0506f5fc6129a618ad09
- SHA1 edf70552942173926b16beac7741cf47d37b4b70
- SHA512 886cfb0fded6dcfc5622a31c2671730b867f5a8c3bb034cd9cac1be83859baf14ddd57a8210e5229a92db56f544785e4d49fccd356a133c5441fbb8e47d617d1
- SSDEEP 6:7+/l9P0/SFn18vng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK5:7+ttCvqLiuWdwRmBEyPbe
- TLSH T13E0222C963800823C82E16BF90D483401D00F719C771CB27157008D83C034CCA4A0D1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db-journal
- Size 4KB
- SHA256 3f5216bdded40cd68445206172c729d4c3eb00eb820fc11bb3f0696cec149d53
- MD5 a9b28ed62c974c292108e513acbbd0eb
- SHA1 5baf5ef3a331cd0eab7f8aea4529a4fea7ccb0a9
- SHA512 3c46adc0ae675de21c804d311a776034c558f1996492c02e48b98c8f0575a5089768f4fa3c382c16d45eaf141ce9ef487611e28b13224bec35c896573693c54a
- SSDEEP 6:7+/lG8HPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKyn:7+tG8vqLJdTRmBEyPbhn
- TLSH T1D29180C9A7810933C52D5BBB90D583951E51E715D373CF5B15600D987D47ACCE490E44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db-wal
- Size 4KB
- SHA256 cc6329cd98b9c991c7b316790fef82bb8b308b81b94fbc7e36bc4a58b3428ab9
- MD5 8edd2f8868a93a8afe32c5c4e78d7f04
- SHA1 1126e81f24f23c13fc6be2e95324aad2427d3818
- SHA512 7acac88aa1bd470d7b5e31fd7c56213424ddb9d8ed9b8372042058677d46a6e4ce4bd465171694ea81139ff99b7c5875df2570fd282077b9a5ce65112f098f91
- SSDEEP 6:K2MuY1j9FwlYKtsulOERX4PBX4ogLugMBX4suuKK:K2HKpyWRQRmBEyPbV
- TLSH T1CB8122A5B3800A52C00A8773E4CA83600C72A7288130CF0B1E211CB67CC6BC8E0E1E08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/1582435991586.jar
- Size 20KB
- SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
- MD5 fde2ee00cbd121cfab5290b078aa3ceb
- SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
- SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
- SSDEEP 384:Za0jn+huC5sMvRuvypj6f2ZzJgm+poK+l8m4qxXpj/7wyxBLBiok+9VQ3AKm8:ZU5sMvu/f2/gm+pDAPzj/Dip+9y3AK7
- TLSH T1D592A457B3918563D57CCD3F3A3ED390EB20B210CA23970728459AAEBDEA3D525D1AC4
- MD5 SHA1 SHA512 SSDEEP TLSH