eb46541e2991a20c20fca66e51a705a309e6576296c435126ac369ba41e6bff5

Analysis

max time kernel
125s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
19/08/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb46541e2991a20c20fca66e51a705a309e6576296c435126ac369ba41e6bff5.apk
Size 10.6MB
Sample260819-cbg3mack2s
SHA256 eb46541e2991a20c20fca66e51a705a309e6576296c435126ac369ba41e6bff5
MD5 1e288142a45ebe7244ab899798cea643
SHA1 078295d1cda8319ed69f64b5443e4d89705d8523
SHA512 0509d443761eb56aa9f53ca552f06ea1202917fa5daf8b0475da247b031677d363ad95e381065a09939bc2681aaf77abf82869c3d0256afea55f3d145e056d7b
SSDEEP 196608:+Ubrdcg+Cnp2yJqiHLu5OOERwQDAvpilOV8YJ/ywk3muPFoeDb7uYoeDzGOjCx:+UbJcg++p2yJ5Ligw0CswBCmuP2eLuvn
TLSH
T155B612A3F768599DC8F69371487A5631557BCD208743A78B2808B739787B7E48F88BC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.pdfdocuments.quickscannerapp

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.pdfdocuments.quickscannerapp/cache/1582435991586.jar	4870	com.pdfdocuments.quickscannerapp

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.pdfdocuments.quickscannerapp

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.pdfdocuments.quickscannerapp

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pdfdocuments.quickscannerapp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pdfdocuments.quickscannerapp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pdfdocuments.quickscannerapp

com.pdfdocuments.quickscannerapp
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4870

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1582435991586.jar

Path /data/data/com.pdfdocuments.quickscannerapp/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
TLSH
T1C412AEB4BF77093CD0DB0DB8CA67E800A05F25841AA7D514E0656066BFD47B5F1E315A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1582435991586.jar.cur.prof

Path /data/data/com.pdfdocuments.quickscannerapp/cache/oat/1582435991586.jar.cur.prof
Size 153B
SHA256 48409024aacda3669e2112419ca8742dedca12f5310521730db60c8387710616
MD5 f9431a0cde5766b6a47fe517f0dbe91f
SHA1 41ebffb9e03db4e211961286e6c233726d1c704f
SHA512 3102a350b8cdbfe686564eb79892a609f3cccd74d4b420f831156b1c57b736853f1cba0988d4dea7bf728f341e3ed2b997274684726afa2d97d31115e5213382
TLSH
T141C08C0125842D04817F51A03706638772AF5A4524FCCBFB811E0756E99ACA0BB26728
MD5 SHA1 SHA512 TLSH

Submit Download

pdf.db

Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db
Size 12KB
SHA256 d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e
MD5 171aedf968e17a2744d2585715606cb9
SHA1 bbeddeb3b89fcf809619c35b4a318a80e7d5b029
SHA512 78a0f517ee3d21c153dda6dbfec4187ebaee9d520d7b1b63f358bcb125d08aea53f26943907a56fdeba40161d9fc7e4fd63f9ae3154dd2ad887ba0162738285b
SSDEEP 6:l9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKTqiOw2:TLJdeWRmBEyPbsOw2
TLSH
T1104280D5E3401503C5255777A0C5C3940D60673D5733C74B669108547C437CCF890D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdf.db

Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db
Size 4KB
SHA256 fb2d2d7f4ccb2251604003206df006b69f41705f0b265ddec061ac6beb30dd95
MD5 b9e10ce4641ac1eb042b25c43bc3d8f3
SHA1 85c15efa83a28a083b900375dd8d8f90b307f22c
SHA512 ae8944f77dc535d10cde4970cd9966500686c4aecd3411d9eaa5d8d5d548e36a9e6be7225f30fadcf0d2d893fe976966ead7ea391bd89e2bcbbc55feeffa7ccc
TLSH
T120818C84A3C00D42C12A4273A0C983440D0162299221CB4B2AA20864BC439CCE4D0E04
MD5 SHA1 SHA512 TLSH

Submit Download

pdf.db-journal

Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db-journal
Size 512B
SHA256 96a3933414e24f2770ac9158ce9febb694139729bcbc7da4c5a201ec14090761
MD5 292f18eb6fa0d73f2a9e8dd02383e919
SHA1 9c3277b5fb30a32ef098ef539410ba380080c03a
SHA512 af2d45bf5a83e8e47396f20137aa7d6bbde659f3c5e09d6caf69d74e6f73a58f79c9cf8e9cbbf38aa1b50f8bcdb8db8adda09c248b4d4ac9318ed55e20a34995
MD5 SHA1 SHA512

Submit Download

pdf.db-journal

Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db-journal
Size 8KB
SHA256 e2698e778254259a82d6f040f6eea3cf898c858d959bab42352d7e37e42a2bd7
MD5 2907fcb5c6df753f591256c0f2ec52c7
SHA1 0d7c47793a3286b41dbb6967894131ebc9d0854b
SHA512 b6a930eb2e37faee5c44fed1a173cc9092f5cb2a2a86c3e59a72f7e41512a30a127c9f80a041f52e4fadc167db913d603756a748bd7866ba13b4f2ec1428f3e7
SSDEEP 6:7+/l9Dn1wpg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK+2:7+tMqLiuWdYRmBEyPbP2
TLSH
T1BA02228A63802813C82E267BA0D883500D00A7288172CBA716D008D4BC0B8CCA8A1D14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdf.db-journal

Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db-journal
Size 4KB
SHA256 a1fdd6a9cb4c3132e1822040c0de49669cf1eb9fa2683f65ec7e572bff283606
MD5 d1b3110b0749d0e3354cdf03f5830f3e
SHA1 1d95ff3c9c63d0c363acdb3414c67e24e6060f6e
SHA512 0b2a1314caa4e626d28efe25824abdbbd6101e86e435995a1dcba5ee299ef2d3bd4eeee6b196dc4bef85a46d9c7f3ffc2b36d3db9ed40efaa7f5d15401c12d1c
SSDEEP 6:7+/lI4Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK8:7+tIwqLJdeWRmBEyPb3
TLSH
T1D491808967811913C52A5F7FF0D5C3541D1467399373CB6716D10D547D476CCE8D1D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdf.db-shm

Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdf.db-wal

Path /data/data/com.pdfdocuments.quickscannerapp/databases/pdf.db-wal
Size 4KB
SHA256 b1da38b05e1302583a64fff56a2e0ab984af3ddbc80a5e0f4c25e8d0e39aebbc
MD5 26a2c1304d59b94f46a195acd44d064c
SHA1 ef2f5862c2483a3214690cde9ac13c999c202d62
SHA512 2b8c732b6a9a21d9194f8b1167133a91bb160520bd4b136789fee2aa95a5f8253b72f71b7efbe2087ab3d21bfb21427269d6c22d733451d7a4b388898f4fb146
SSDEEP 6:Kywb4M38IYMy9FwlYKtskPlOERX4PBX4ogLugMBX4suuKK:Kl4sKyWKRmBEyPbV
TLSH
T1C38122C0BB411512D039423390CA83800D4062285720CB8F3A920C956D1F9CCF0E2E0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1582435991586.jar

Path /data/user/0/com.pdfdocuments.quickscannerapp/cache/1582435991586.jar
Size 20KB
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
SSDEEP 384:Za0jn+huC5sMvRuvypj6f2ZzJgm+poK+l8m4qxXpj/7wyxBLBiok+9VQ3AKm8:ZU5sMvu/f2/gm+pDAPzj/Dip+9y3AK7
TLSH
T1D592A457B3918563D57CCD3F3A3ED390EB20B210CA23970728459AAEBDEA3D525D1AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads