jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]AndroidOS[.]Ewind[.]lr[.]92acca827b8315c6328c84ed98118321

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.lr.92acca827b8315c6328c84ed98118321
Size 2.6MB
Sample261009-tec2hsgt7l
SHA256 6a54fb729a14f1e664c96818e8767c4f3615c2ab409d81169a37460747590bdb
MD5 92acca827b8315c6328c84ed98118321
SHA1 7995f73a815fe76a0a6d0743e54b468a8ae7a9dc
SHA512 e58e6104eb84d41f356a8653e18f3aec0cd7cf500d76e62ca5a626cd62d21f4254e59e42a9c14437f155e83ed4e7009e9fd6f064b9b48f3a3acdb7dc16b1b3b8
SSDEEP 49152:+ZHX5rL1+7mV6apTPGVR84z334MHc5ZVKqNkYeN+npAQPUjvjzssdIdNb7E8:uX5rp+7mVvtGVie3dHiOqesnizfswI7X
TLSH
T18CC53360B55E153BECEBAE329FDA12A9D9F2678441CFAFBB0112D01D05137C96B1D238
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.lr.92acca827b8315c6328c84ed98118321

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.lr.92acca827b8315c6328c84ed98118321

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.lr.92acca827b8315c6328c84ed98118321

.apk 2.6MB

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.lr.92acca827b8315c6328c84ed98118321

SHA256 6a54fb729a14f1e664c96818e8767c4f3615c2ab409d81169a37460747590bdb
MD5 92acca827b8315c6328c84ed98118321
SHA1 7995f73a815fe76a0a6d0743e54b468a8ae7a9dc
SHA512 e58e6104eb84d41f356a8653e18f3aec0cd7cf500d76e62ca5a626cd62d21f4254e59e42a9c14437f155e83ed4e7009e9fd6f064b9b48f3a3acdb7dc16b1b3b8
SSDEEP 49152:+ZHX5rL1+7mV6apTPGVR84z334MHc5ZVKqNkYeN+npAQPUjvjzssdIdNb7E8:uX5rp+7mVvtGVie3dHiOqesnizfswI7X
TLSH
T18CC53360B55E153BECEBAE329FDA12A9D9F2678441CFAFBB0112D01D05137C96B1D238
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

5c8aa62a02c4fa487be226b381d243a43ca756a7

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=cu,OU=lo,O=bj,L=bj,ST=bj,C=01

Chains

Jan 1, 0001

com.uc.addon.processkiller

com.xiaomi.push.service.XMPushService

com.xiaomi.push.service.XMJobService

com.xiaomi.mipush.sdk.PushMessageHandler

com.xiaomi.mipush.sdk.MessageHandleService

com.umeng.message.UmengService

com.uc.addon.processkiller.intent.action.START com.uc.addon.processkiller.intent.action.COCKROACH org.agoo.android.intent.action.PING_V4

com.umeng.message.UmengIntentService

com.umeng.message.UmengMessageIntentReceiverService

org.android.agoo.client.MessageReceiverService org.android.agoo.client.ElectionReceiverService

com.umeng.message.UmengMessageCallbackHandlerService

com.umeng.messge.registercallback.action com.umeng.message.unregistercallback.action com.umeng.message.message.handler.action com.umeng.message.autoupdate.handler.action

com.umeng.message.UmengDownloadResourceService

com.umeng.message.local.UmengLocalNotificationService

com.igexin.sdk.PushService

com.igexin.sdk.action.service.message

com.igexin.download.DownloadService

com.uc.addon.processkiller.task.GetuiIntentService

com.uc.addon.processkiller.task.GetuiService

cn.jpush.android.service.DownloadService

cn.jpush.android.service.PushService

cn.jpush.android.intent.REGISTER cn.jpush.android.intent.REPORT cn.jpush.android.intent.PushService cn.jpush.android.intent.PUSH_TIME

cn.jpush.android.service.DaemonService

cn.jpush.android.intent.DaemonService

com.baidu.android.pushservice.PushService

com.baidu.android.pushservice.action.PUSH_SERVICE

com.baidu.android.pushservice.CommandService

com.baidu.location.f

com.uc.addon.processkiller.task.MainService

com.uc.addon.processkiller.task.TaskService

com.uc.addon.processkiller.task.ActivityService

com.uc.addon.processkiller.task.LauncherService

com.uc.addon.processkiller.task.RequestTaskService

com.uc.addon.sdk.remote.AddonService

com.uc.browser.action.Addon

com.uc.addon.processkiller.task.AliveService

com.uc.addon.processkiller.task.AliveService$GrayInnerService

com.uc.addon.processkiller.task.DaemonService

com.uc.addon.processkiller.task.WifiPwdTaskService

com.uc.addon.processkiller.task.WiFiUpLoadMsgService

com.xiaomi.push.service.receivers.NetworkStatusReceiver

android.net.conn.CONNECTIVITY_CHANGE

com.xiaomi.push.service.receivers.PingReceiver

com.xiaomi.push.PING_TIMER

com.uc.addon.processkiller.receiver.MIPushReceiver

com.xiaomi.mipush.RECEIVE_MESSAGE com.xiaomi.mipush.MESSAGE_ARRIVED com.xiaomi.mipush.ERROR

com.umeng.message.NotificationProxyBroadcastReceiver

com.umeng.message.SystemReceiver

android.net.conn.CONNECTIVITY_CHANGE android.intent.action.PACKAGE_REMOVED

com.umeng.message.MessageReceiver

org.agoo.android.intent.action.RECEIVE

com.umeng.message.ElectionReceiver

org.agoo.android.intent.action.ELECTION_RESULT_V4

com.umeng.message.RegistrationReceiver

com.uc.addon.processkiller.intent.action.COMMAND

com.igexin.sdk.PushReceiver

android.net.conn.CONNECTIVITY_CHANGE android.intent.action.USER_PRESENT com.igexin.sdk.action.refreshls android.intent.action.MEDIA_MOUNTED android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

com.igexin.download.DownloadReceiver

android.net.conn.CONNECTIVITY_CHANGE

cn.jpush.android.service.PushReceiver

cn.jpush.android.intent.NOTIFICATION_RECEIVED_PROXY android.intent.action.USER_PRESENT android.net.conn.CONNECTIVITY_CHANGE android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED

cn.jpush.android.service.AlarmReceiver

com.uc.addon.processkiller.receiver.JPushReceiver

cn.jpush.android.intent.REGISTRATION cn.jpush.android.intent.MESSAGE_RECEIVED cn.jpush.android.intent.NOTIFICATION_RECEIVED cn.jpush.android.intent.NOTIFICATION_OPENED cn.jpush.android.intent.ACTION_RICHPUSH_CALLBACK cn.jpush.android.intent.CONNECTION

com.uc.addon.processkiller.receiver.BaiduPushReceiver

com.baidu.android.pushservice.action.MESSAGE com.baidu.android.pushservice.action.RECEIVE com.baidu.android.pushservice.action.notification.CLICK

com.baidu.android.pushservice.PushServiceReceiver

android.net.conn.CONNECTIVITY_CHANGE com.baidu.android.pushservice.action.notification.SHOW com.baidu.android.pushservice.action.media.CLICK android.intent.action.MEDIA_MOUNTED android.intent.action.USER_PRESENT android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

com.baidu.android.pushservice.RegistrationReceiver

com.baidu.android.pushservice.action.METHOD com.baidu.android.pushservice.action.BIND_SYNC android.intent.action.PACKAGE_REMOVED

com.uc.addon.processkiller.receiver.ScreenReceiver

android.intent.action.SCREEN_ON android.intent.action.SCREEN_OFF android.intent.action.USER_PRESENT

com.uc.addon.processkiller.receiver.WifiReceiver

android.net.conn.CONNECTIVITY_CHANGE android.net.wifi.WIFI_STATE_CHANGED android.net.wifi.STATE_CHANGE

com.uc.addon.processkiller.receiver.OtherReceiver

android.intent.action.USER_PRESENT android.net.conn.CONNECTIVITY_CHANGE android.intent.action.MEDIA_MOUNTED android.intent.action.MEDIA_UNMOUNTED android.net.wifi.RSSI_CHANGED android.net.wifi.STATE_CHANGE android.net.wifi.WIFI_STATE_CHANGED android.intent.action.BATTERY_CHANGED

Android Permissions

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.lr.92acca827b8315c6328c84ed98118321

Permissions

android.permission.ACCESS_WIFI_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.VIBRATE

android.permission.WAKE_LOCK

android.permission.WRITE_SETTINGS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.GET_ACCOUNTS

android.permission.ACCESS_NETWORK_STATE

android.permission.GET_TASKS

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECEIVE_USER_PRESENT

android.permission.READ_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

getui.permission.GetuiService.com.uc.addon.processkiller

com.uc.addon.processkiller.permission.MIPUSH_RECEIVE

com.uc.addon.processkiller.permission.JPUSH_MESSAGE

baidu.push.permission.WRITE_PUSHINFOPROVIDER.com.uc.addon.processkiller

android.permission.DISABLE_KEYGUARD

android.permission.EXPAND_STATUS_BAR

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.lr.92acca827b8315c6328c84ed98118321

File Signature issue

com.uc.addon.processkiller.MainActivity

com.igexin.sdk.PushActivity

com.igexin.sdk.GActivity

cn.jpush.android.ui.PopWinActivity

cn.jpush.android.ui.PushActivity

com.baidu.android.pushservice.richmedia.MediaViewActivity

com.baidu.android.pushservice.richmedia.MediaListActivity

com.uc.addon.processkiller.ui.BrowserActivity

com.uc.addon.processkiller.ui.BrowserLockActivity

com.uc.addon.processkiller.ui.BrowserLockScreenActivity

com.uc.addon.processkiller.ui.DaemonActivity

com.uc.addon.processkiller.ui.DpLockActivity

com.xiaomi.push.service.XMPushService

com.xiaomi.push.service.XMJobService

com.xiaomi.mipush.sdk.PushMessageHandler

com.xiaomi.mipush.sdk.MessageHandleService

com.umeng.message.UmengService

com.umeng.message.UmengIntentService

com.umeng.message.UmengMessageIntentReceiverService

com.umeng.message.UmengMessageCallbackHandlerService

com.umeng.message.UmengDownloadResourceService

com.umeng.message.local.UmengLocalNotificationService

com.igexin.sdk.PushService

com.igexin.download.DownloadService

com.uc.addon.processkiller.task.GetuiIntentService

com.uc.addon.processkiller.task.GetuiService

cn.jpush.android.service.DownloadService

cn.jpush.android.service.PushService

cn.jpush.android.service.DaemonService

com.baidu.android.pushservice.PushService

com.baidu.android.pushservice.CommandService

com.baidu.location.f

com.uc.addon.processkiller.task.MainService

com.uc.addon.processkiller.task.TaskService

com.uc.addon.processkiller.task.ActivityService

com.uc.addon.processkiller.task.LauncherService

com.uc.addon.processkiller.task.RequestTaskService

com.uc.addon.sdk.remote.AddonService

com.uc.addon.processkiller.task.AliveService

com.uc.addon.processkiller.task.AliveService$GrayInnerService

com.uc.addon.processkiller.task.DaemonService

com.uc.addon.processkiller.task.WifiPwdTaskService

com.uc.addon.processkiller.task.WiFiUpLoadMsgService

com.xiaomi.push.service.receivers.NetworkStatusReceiver

com.xiaomi.push.service.receivers.PingReceiver

com.uc.addon.processkiller.receiver.MIPushReceiver

com.umeng.message.NotificationProxyBroadcastReceiver

com.umeng.message.SystemReceiver

com.umeng.message.MessageReceiver

com.umeng.message.ElectionReceiver

com.umeng.message.RegistrationReceiver

com.igexin.sdk.PushReceiver

com.igexin.download.DownloadReceiver

cn.jpush.android.service.PushReceiver

cn.jpush.android.service.AlarmReceiver

com.uc.addon.processkiller.receiver.JPushReceiver

com.uc.addon.processkiller.receiver.BaiduPushReceiver

com.baidu.android.pushservice.PushServiceReceiver

com.baidu.android.pushservice.RegistrationReceiver

com.uc.addon.processkiller.receiver.ScreenReceiver

com.uc.addon.processkiller.receiver.WifiReceiver

com.uc.addon.processkiller.receiver.OtherReceiver

com.igexin.download.DownloadProvider

com.baidu.android.pushservice.PushInfoProvider

Android Permissions

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.lr.92acca827b8315c6328c84ed98118321