Overview

overview

10

Static

static

10

d93def97d5...e6.apk

android-9-x86

1

d93def97d5...e6.apk

android-10-x64

1

d93def97d5...e6.apk

android-11-x64

7

Analysis

  • custom tags

    evasionantivmobfuscated

Sharing

Copy URL Twitter E-mail

General

  • Target
    d93def97d593c453ec9065294b985b6ccb0e49535daa82dec415503094f277e6.apk
  • Size 6.1MB
  • Sample260820-pmzs2ack71
  • SHA256 d93def97d593c453ec9065294b985b6ccb0e49535daa82dec415503094f277e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
evasionantivmobfuscated

Malware Config

Signatures

  • Root, emulator and instrumentation-framework detection 1 IoCs

    Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.

    evasionantivm
  • Runtime string decryption with reflective method dispatch 1 IoCs

    Combines symmetric decryption or base64 decoding of embedded string tables with reflective class and method resolution, so sensitive API names never appear in plaintext. This defeats naive string-based detection and indicates deliberate anti-analysis engineering.

    obfuscatedevasion
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 3 IoCs
  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • d93def97d593c453ec9065294b985b6ccb0e49535daa82dec415503094f277e6.apk
    .apk 6.1MB

d93def97d593c453ec9065294b985b6ccb0e49535daa82dec415503094f277e6.apk

  • SHA256 d93def97d593c453ec9065294b985b6ccb0e49535daa82dec415503094f277e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
android

  • Root, emulator and instrumentation-framework detection

    Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.

    evasionantivm

  • Runtime string decryption with reflective method dispatch

    Combines symmetric decryption or base64 decoding of embedded string tables with reflective class and method resolution, so sensitive API names never appear in plaintext. This defeats naive string-based detection and indicates deliberate anti-analysis engineering.

    obfuscatedevasion

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

File Signature issue

Digest
feb4bb9da4584ee4d57b76263907f5a99ef7616dff18e9e34e6549ca73c795df3c0cba66673756e9581ac79e08ac36a69545903574152f833af153aed08ab714
Digest Algorithm
sha512
Digest Matches
Trusted
Not trusted
Signer
CN=Android,OU=Android,O=Google Inc.,L=Mountain View,ST=California,C=US
com.barbarahenrietta.livewallpaper

Android Permissions

d93def97d593c453ec9065294b985b6ccb0e49535daa82dec415503094f277e6.apk

Permissions

android.permission.SET_WALLPAPER

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

com.google.android.gms.permission.AD_ID

android.permission.FOREGROUND_SERVICE

com.barbarahenrietta.livewallpaper.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.CHANGE_NETWORK_STATE

android.permission.READ_CONTACTS