jaffacakes118_not-a-virus[.]HEUR[.]RiskTool[.]AndroidOS[.]SMSreg[.]pf[.]9741ac37813cf02a71c9a00f03ad5b46

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.9741ac37813cf02a71c9a00f03ad5b46
Size 1.6MB
Sample261012-3d3efsgx3s
SHA256 ef687eb0dadcdc604999e14d95be4fe61deff3469400470616af9c560ad191bf
MD5 9741ac37813cf02a71c9a00f03ad5b46
SHA1 10663c54c9710d48fd7582036e6122b810b40aa5
SHA512 31e4770734b0597e60fb046e9629495ac908ebc5e5be3b5c4d6f9bead280047b1ed9273957a2288a12160f50db7cd0382f235f7d2135e691e6794d3b4e428dd2
SSDEEP 24576:6NInGZiDV28O0X3LZe1DVaMAtKD9tUnOSkCEZZ/yTiUYeunaBN/pTq73AV3Lt/Nz:JGZiQchKDgQyTDYeun2N/xg3w3x/qe4U
TLSH
T12C853355B3A59DB0F92AE4B6ED34577322A04D844E48E30B4E5631D4FE7AD924F88F0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.9741ac37813cf02a71c9a00f03ad5b46

Unsigned APK 2 IoCs

Checks for missing APK codesign signature.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.9741ac37813cf02a71c9a00f03ad5b46
unpack001/dERlZG

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.9741ac37813cf02a71c9a00f03ad5b46

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.9741ac37813cf02a71c9a00f03ad5b46

.apk 1.6MB
dERlZG

.apk 98KB

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.9741ac37813cf02a71c9a00f03ad5b46

SHA256 ef687eb0dadcdc604999e14d95be4fe61deff3469400470616af9c560ad191bf
MD5 9741ac37813cf02a71c9a00f03ad5b46
SHA1 10663c54c9710d48fd7582036e6122b810b40aa5
SHA512 31e4770734b0597e60fb046e9629495ac908ebc5e5be3b5c4d6f9bead280047b1ed9273957a2288a12160f50db7cd0382f235f7d2135e691e6794d3b4e428dd2
SSDEEP 24576:6NInGZiDV28O0X3LZe1DVaMAtKD9tUnOSkCEZZ/yTiUYeunaBN/pTq73AV3Lt/Nz:JGZiQchKDgQyTDYeun2N/xg3w3x/qe4U
TLSH
T12C853355B3A59DB0F92AE4B6ED34577322A04D844E48E30B4E5631D4FE7AD924F88F0C
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Unsigned APK

Checks for missing APK codesign signature.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

e468e3f04e1e02284f36dd4ad71f1c5d53be5879

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Unknown,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown

Chains

Jan 1, 0001

com.forty.agricultural

dERlZG

SHA256 70059ae56f8f2a613be7aec1c17ef1f1518922ebbab9f3852918cd44f20956b5
MD5 d109ad66893b0de714cedfdb9f4a8dbb
SHA1 cac2b8bb7473138104de29ab87d7c3cdda2a45d2
SHA512 fdedabece69784dcdaf0af44ccc77ebc983a6e4def5cca4f6a6c4b4618427a2967c70c27906ce4117b265ae672f69d4630e88f0bf3275851c7e13b1cf4ba1fd6
SSDEEP 3072:AjHAv7dAeoBQS5clmB2x9VVFZAkGwZue1mTf:+HAGeIQSEFzVEkGwZuumD
TLSH
T114A3129813591984EE7274B8BB15AF2CE163428CDCD0326F0FD5B1B48EB4E8D671E80E
MD5 SHA1 SHA512 SSDEEP TLSH

android

Unsigned APK

Checks for missing APK codesign signature.

com.door.pay.sdk

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.9741ac37813cf02a71c9a00f03ad5b46

Permissions

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.READ_SMS

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.WRITE_SMS

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.GET_TASKS

com.android.launcher.permission.INSTALL_SHORTCUT

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.9741ac37813cf02a71c9a00f03ad5b46

File Signature issue

com.games.ckduer.SActivity

com.games.ckduer.GActivity

com.games.ckduer.MActivity

com.mobile.bumptech.ordinary.miniSDK.SDK.intf.MActivity

com.j2y.p2.JSActivity

com.games.ckduer.HActivity

com.comment.one.service.DmService

com.game.absent.MySer

com.j2y.p2.sjs.CRService

com.j2y.p2.sjs.CLService

com.games.ckduer.HService

cn.cuter.main.MyService

com.mn.kt.rs.RsSe

com.pay.service.PayCoreService

com.wchen.jiezf.srv.InitSrv

com.cn.lvchuang.pay.service.LlcServoceOne

com.comment.one.receiver.EBooReceiver

com.pay.receiver.SmsReceiver

com.wchen.jiezf.rever.JRever

com.cn.lvchuang.pay.service.LlcReceiverOne

dERlZG

com.door.pay.sdk.impl.MainActivity

com.door.pay.sdk.impl.testActivity

com.door.pay.sdk.sms.impl.testService

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.9741ac37813cf02a71c9a00f03ad5b46

File Signature issue

com.games.ckduer.SActivity

com.games.ckduer.GActivity

com.games.ckduer.MActivity

com.mobile.bumptech.ordinary.miniSDK.SDK.intf.MActivity

com.j2y.p2.JSActivity

com.games.ckduer.HActivity

com.comment.one.service.DmService

com.game.absent.MySer

com.j2y.p2.sjs.CRService

com.j2y.p2.sjs.CLService

com.games.ckduer.HService

cn.cuter.main.MyService

com.mn.kt.rs.RsSe

com.pay.service.PayCoreService

com.wchen.jiezf.srv.InitSrv

com.cn.lvchuang.pay.service.LlcServoceOne

com.comment.one.receiver.EBooReceiver

com.pay.receiver.SmsReceiver

com.wchen.jiezf.rever.JRever

com.cn.lvchuang.pay.service.LlcReceiverOne

dERlZG

com.door.pay.sdk.impl.MainActivity

com.door.pay.sdk.impl.testActivity

com.door.pay.sdk.sms.impl.testService

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.9741ac37813cf02a71c9a00f03ad5b46