edd287922777dcf3470268015ffa0ceee836f1469fda7b995517aa9666f04806[.]apk

Analysis

custom tags

packerobfuscated

Sharing

Copy URL Twitter E-mail

General

Target
edd287922777dcf3470268015ffa0ceee836f1469fda7b995517aa9666f04806.apk
Size 10.3MB
Sample260819-cdeqaack5v
SHA256 edd287922777dcf3470268015ffa0ceee836f1469fda7b995517aa9666f04806
MD5 dc84f225fdb1c21071ee70d43af39224
SHA1 9769a6a9f74ef6fc277fe1d2ae3cf15e18083d27
SHA512 92248b999a2519a54418e7a7afffde7de2278e3b389ae1c3ee24b8fd769340be463b76e00e9e7e80bae1aa892eee0ad3556f9b2998a519730090195f0af62dfc
SSDEEP 196608:g9NXrB9C9myGIJWW7BgqOd538EkxEM04/VZvcDvH4cy7ioF:g9NXnCYyGIvi1DhMRZkvHSioF
TLSH
T1A0B60283E769693ED8B28433499962364539DE048A53D34B7A0CB71D3B779EC6B84FC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

packer obfuscated

Malware Config

Signatures

Android commercial packer/protector detected 1 IoCs

Stub loader for a known Android packer. The visible DEX is a shim; real logic is decrypted at runtime from native code or an encrypted asset. Treat static findings as incomplete and rely on behavioural analysis and memory artifacts.

packer obfuscated

resource	yara_rule
sample	ANDROID_Packer_Protector_Present

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS
Required by chooser target services to bind with the system. Allows apps to modify targets that handle user actions.	android.permission.BIND_CHOOSER_TARGET_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
edd287922777dcf3470268015ffa0ceee836f1469fda7b995517aa9666f04806.apk

File Explorer

edd287922777dcf3470268015ffa0ceee836f1469fda7b995517aa9666f04806.apk

.apk 10.3MB

edd287922777dcf3470268015ffa0ceee836f1469fda7b995517aa9666f04806.apk

SHA256 edd287922777dcf3470268015ffa0ceee836f1469fda7b995517aa9666f04806
MD5 dc84f225fdb1c21071ee70d43af39224
SHA1 9769a6a9f74ef6fc277fe1d2ae3cf15e18083d27
SHA512 92248b999a2519a54418e7a7afffde7de2278e3b389ae1c3ee24b8fd769340be463b76e00e9e7e80bae1aa892eee0ad3556f9b2998a519730090195f0af62dfc
SSDEEP 196608:g9NXrB9C9myGIJWW7BgqOd538EkxEM04/VZvcDvH4cy7ioF:g9NXnCYyGIvi1DhMRZkvHSioF
TLSH
T1A0B60283E769693ED8B28433499962364539DE048A53D34B7A0CB71D3B779EC6B84FC0
MD5 SHA1 SHA512 SSDEEP TLSH

android

Android commercial packer/protector detected

Stub loader for a known Android packer. The visible DEX is a shim; real logic is decrypted at runtime from native code or an encrypted asset. Treat static findings as incomplete and rely on behavioural analysis and memory artifacts.

packer obfuscated
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

ff179dd30775ebaaef62eb27c38e951fea832686cebaae26691629883eb6edf5145b457cc872a2fa83ebcdcf488650c14f6213969ab283d6c3f6ba72f2789201

Digest Algorithm

sha512

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Google Inc.,L=Mountain View,ST=California,C=US

com.dekics.chat.message

com.moez.QKSMS.receiver.BootReceiver

android.intent.action.BOOT_COMPLETED

com.moez.QKSMS.receiver.DefaultSmsChangedReceiver

android.provider.action.DEFAULT_SMS_PACKAGE_CHANGED

com.moez.QKSMS.receiver.DeleteMessagesReceiver

com.moez.QKSMS.receiver.SmsReceiver

android.provider.Telephony.SMS_DELIVER

com.moez.QKSMS.receiver.MmsReceiver

android.provider.Telephony.WAP_PUSH_DELIVER

com.moez.QKSMS.receiver.SmsSentReceiver

com.moez.QKSMS.receiver.SmsDeliveredReceiver

com.moez.QKSMS.receiver.MmsSentReceiver

com.moez.QKSMS.receiver.MmsUpdatedReceiver

com.moez.QKSMS.receiver.MmsReceivedReceiver

com.moez.QKSMS.receiver.MarkSeenReceiver

com.moez.QKSMS.receiver.MarkReadReceiver

com.moez.QKSMS.receiver.RemoteMessagingReceiver

com.moez.QKSMS.receiver.NightModeReceiver

com.moez.QKSMS.receiver.SmsProviderChangedReceiver

android.provider.action.EXTERNAL_PROVIDER_CHANGE

com.moez.QKSMS.receiver.SendScheduledMessageReceiver

com.origin.sms.feature.widget.WidgetProvider

android.appwidget.action.APPWIDGET_UPDATE com.moez.QKSMS.intent.action.ACTION_NOTIFY_DATASET_CHANGED

com.moez.QKSMS.receiver.SendSmsReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

com.google.android.gms.measurement.AppMeasurementReceiver

Android Permissions

edd287922777dcf3470268015ffa0ceee836f1469fda7b995517aa9666f04806.apk

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.FOREGROUND_SERVICE

android.permission.INTERNET

android.permission.READ_CONTACTS

android.permission.READ_SMS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.RECEIVE_MMS

android.permission.RECEIVE_SMS

android.permission.CHANGE_NETWORK_STATE

android.permission.SEND_SMS

android.permission.WAKE_LOCK

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_SMS

com.android.vending.BILLING

com.sec.android.provider.badge.permission.READ

com.sec.android.provider.badge.permission.WRITE

com.htc.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.UPDATE_SHORTCUT

com.sonyericsson.home.permission.BROADCAST_BADGE

com.sonymobile.home.permission.PROVIDER_INSERT_BADGE

com.anddoes.launcher.permission.UPDATE_COUNT

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

com.majeur.launcher.permission.UPDATE_BADGE

com.huawei.android.launcher.permission.CHANGE_BADGE

com.huawei.android.launcher.permission.READ_SETTINGS

com.huawei.android.launcher.permission.WRITE_SETTINGS

android.permission.READ_APP_BADGE

com.oppo.launcher.permission.READ_SETTINGS

com.oppo.launcher.permission.WRITE_SETTINGS

me.everything.badger.permission.BADGE_COUNT_READ

me.everything.badger.permission.BADGE_COUNT_WRITE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.READ_PHONE_STATE

Analysis

Sharing

General

Malware Config

Signatures

File Explorer

edd287922777dcf3470268015ffa0ceee836f1469fda7b995517aa9666f04806.apk

File Signature issue

com.origin.sms.feature.splash.SplashActivity_lunch

com.origin.sms.feature.permission.Activity_Permission_on

com.origin.sms.feature.main.MainActivity

com.origin.sms.feature.compose.ComposeActivity

com.origin.sms.feature.settings.SettingsActivity

com.origin.sms.feature.plus.PlusActivity

com.origin.sms.feature.gallery.GalleryActivity

com.origin.sms.feature.conversationinfo.ConversationInfoActivity

com.origin.sms.feature.notificationprefs.NotificationPrefsActivity

com.origin.sms.feature.blocking.BlockingActivity

com.origin.sms.feature.qkreply.QkReplyActivity

com.origin.sms.feature.scheduled.ScheduledActivity

com.origin.sms.feature.backup.BackupActivity

com.origin.sms.feature.contacts.ContactsActivity

com.origin.sms.feature.market.Exite_Activity

com.android.billingclient.api.ProxyBillingActivity

com.facebook.ads.AudienceNetworkActivity

com.google.android.gms.ads.AdActivity

com.android.mms.transaction.TransactionService

com.origin.sms.feature.backup.RestoreBackupService

com.origin.sms.feature.widget.WidgetService

com.moez.QKSMS.service.HeadlessSmsSendService

com.origin.sms.common.util.QkChooserTargetService

com.google.firebase.components.ComponentDiscoveryService

com.google.android.gms.ads.AdService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

androidx.room.MultiInstanceInvalidationService

com.moez.QKSMS.receiver.BootReceiver

com.moez.QKSMS.receiver.DefaultSmsChangedReceiver

com.moez.QKSMS.receiver.DeleteMessagesReceiver

com.moez.QKSMS.receiver.SmsReceiver

com.moez.QKSMS.receiver.MmsReceiver

com.moez.QKSMS.receiver.SmsSentReceiver

com.moez.QKSMS.receiver.SmsDeliveredReceiver

com.moez.QKSMS.receiver.MmsSentReceiver

com.moez.QKSMS.receiver.MmsUpdatedReceiver

com.moez.QKSMS.receiver.MmsReceivedReceiver

com.moez.QKSMS.receiver.MarkSeenReceiver

com.moez.QKSMS.receiver.MarkReadReceiver

com.moez.QKSMS.receiver.RemoteMessagingReceiver

com.moez.QKSMS.receiver.NightModeReceiver

com.moez.QKSMS.receiver.SmsProviderChangedReceiver

com.moez.QKSMS.receiver.SendScheduledMessageReceiver

com.origin.sms.feature.widget.WidgetProvider

com.moez.QKSMS.receiver.SendSmsReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

com.google.android.gms.measurement.AppMeasurementReceiver

androidx.core.content.FileProvider

com.klinker.android.send_message.MmsFileProvider

com.facebook.ads.AudienceNetworkContentProvider

androidx.lifecycle.ProcessLifecycleOwnerInitializer

com.google.android.gms.ads.MobileAdsInitProvider

androidx.work.impl.WorkManagerInitializer

com.google.firebase.provider.FirebaseInitProvider

Android Permissions

edd287922777dcf3470268015ffa0ceee836f1469fda7b995517aa9666f04806.apk