jaffacakes118_not-a-virus[.]HEUR[.]RiskTool[.]AndroidOS[.]SMSreg[.]pf[.]c7be3fb80e24d23c8bba96c64c8b4e36

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.c7be3fb80e24d23c8bba96c64c8b4e36
Size 1.6MB
Sample261012-3ja76act2k
SHA256 0d4bf6233f8227e5006b5261da3e5ea4566b2bf255e2cbff79620f0b18d21e42
MD5 c7be3fb80e24d23c8bba96c64c8b4e36
SHA1 fc0b8e366575f79351f3919d3cc16a0f7ae3c646
SHA512 384ee70ccfbaeb9a2e50ec5d201de24c865e94104e4adbd4ed39378b7e36951f460961a2eaff903abe44875bae2ccaf2b183ad7fb4909262e484e030fe47c42c
SSDEEP 49152:mkTfjUmE9TuzGZiQ1yTDRweun2N/xg3w3x/qe4H:mkTdEZiQ1yTF4n2x/9S
TLSH
T156853348B393DAE0D9AACB3AB73055A7A7104D4859C5E3870D10B5C8EDBEE454F8CE2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.c7be3fb80e24d23c8bba96c64c8b4e36

Unsigned APK 2 IoCs

Checks for missing APK codesign signature.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.c7be3fb80e24d23c8bba96c64c8b4e36
unpack001/dERlZG

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.c7be3fb80e24d23c8bba96c64c8b4e36

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.c7be3fb80e24d23c8bba96c64c8b4e36

.apk 1.6MB
dERlZG

.apk 98KB

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.c7be3fb80e24d23c8bba96c64c8b4e36

SHA256 0d4bf6233f8227e5006b5261da3e5ea4566b2bf255e2cbff79620f0b18d21e42
MD5 c7be3fb80e24d23c8bba96c64c8b4e36
SHA1 fc0b8e366575f79351f3919d3cc16a0f7ae3c646
SHA512 384ee70ccfbaeb9a2e50ec5d201de24c865e94104e4adbd4ed39378b7e36951f460961a2eaff903abe44875bae2ccaf2b183ad7fb4909262e484e030fe47c42c
SSDEEP 49152:mkTfjUmE9TuzGZiQ1yTDRweun2N/xg3w3x/qe4H:mkTdEZiQ1yTF4n2x/9S
TLSH
T156853348B393DAE0D9AACB3AB73055A7A7104D4859C5E3870D10B5C8EDBEE454F8CE2D
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Unsigned APK

Checks for missing APK codesign signature.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

b5c805191d46f8c943307c47017760dd68792c6b

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Unknown,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown

Chains

Jan 1, 0001

com.appointing.hindered.selfpossession

dERlZG

SHA256 70059ae56f8f2a613be7aec1c17ef1f1518922ebbab9f3852918cd44f20956b5
MD5 d109ad66893b0de714cedfdb9f4a8dbb
SHA1 cac2b8bb7473138104de29ab87d7c3cdda2a45d2
SHA512 fdedabece69784dcdaf0af44ccc77ebc983a6e4def5cca4f6a6c4b4618427a2967c70c27906ce4117b265ae672f69d4630e88f0bf3275851c7e13b1cf4ba1fd6
SSDEEP 3072:AjHAv7dAeoBQS5clmB2x9VVFZAkGwZue1mTf:+HAGeIQSEFzVEkGwZuumD
TLSH
T114A3129813591984EE7274B8BB15AF2CE163428CDCD0326F0FD5B1B48EB4E8D671E80E
MD5 SHA1 SHA512 SSDEEP TLSH

android

Unsigned APK

Checks for missing APK codesign signature.

com.door.pay.sdk

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.c7be3fb80e24d23c8bba96c64c8b4e36

Permissions

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.READ_SMS

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.WRITE_SMS

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.GET_TASKS

com.android.launcher.permission.INSTALL_SHORTCUT

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.c7be3fb80e24d23c8bba96c64c8b4e36

File Signature issue

com.games.xhobe.SActivity

com.games.xhobe.GActivity

com.games.xhobe.MActivity

com.mobile.bumptech.ordinary.miniSDK.SDK.intf.MActivity

com.j2y.p2.JSActivity

com.games.xhobe.HActivity

com.comment.one.service.DmService

com.game.absent.MySer

com.j2y.p2.sjs.CRService

com.j2y.p2.sjs.CLService

com.games.xhobe.HService

cn.cuter.main.MyService

com.mn.kt.rs.RsSe

com.pay.service.PayCoreService

com.wchen.jiezf.srv.InitSrv

com.cn.lvchuang.pay.service.LlcServoceOne

com.comment.one.receiver.EBooReceiver

com.pay.receiver.SmsReceiver

com.wchen.jiezf.rever.JRever

com.cn.lvchuang.pay.service.LlcReceiverOne

dERlZG

com.door.pay.sdk.impl.MainActivity

com.door.pay.sdk.impl.testActivity

com.door.pay.sdk.sms.impl.testService

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.c7be3fb80e24d23c8bba96c64c8b4e36

File Signature issue

com.games.xhobe.SActivity

com.games.xhobe.GActivity

com.games.xhobe.MActivity

com.mobile.bumptech.ordinary.miniSDK.SDK.intf.MActivity

com.j2y.p2.JSActivity

com.games.xhobe.HActivity

com.comment.one.service.DmService

com.game.absent.MySer

com.j2y.p2.sjs.CRService

com.j2y.p2.sjs.CLService

com.games.xhobe.HService

cn.cuter.main.MyService

com.mn.kt.rs.RsSe

com.pay.service.PayCoreService

com.wchen.jiezf.srv.InitSrv

com.cn.lvchuang.pay.service.LlcServoceOne

com.comment.one.receiver.EBooReceiver

com.pay.receiver.SmsReceiver

com.wchen.jiezf.rever.JRever

com.cn.lvchuang.pay.service.LlcReceiverOne

dERlZG

com.door.pay.sdk.impl.MainActivity

com.door.pay.sdk.impl.testActivity

com.door.pay.sdk.sms.impl.testService

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.c7be3fb80e24d23c8bba96c64c8b4e36