jaffacakes118_not-a-virus[.]HEUR[.]RiskTool[.]AndroidOS[.]Skymobi[.]e[.]06732f3f6265fe1f8da411750c6c6fda

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.e.06732f3f6265fe1f8da411750c6c6fda
Size 8.2MB
Sample261012-3rynesfe42
SHA256 ceac6479974eda54493f7e4588955f4d0ee91c4ab63e72e56e0378cd3fba5371
MD5 06732f3f6265fe1f8da411750c6c6fda
SHA1 1c18aeafe47a4742a8694611a57b88b42826758d
SHA512 391cf2f5d3bb315f47ea3486123ccd92b53e6896f9496dcd43f5db8fea0b931518df792e9a365dc1b8290dffef595607d1a89b89b86f54e6705edadafc0c7956
SSDEEP 196608:U+kOqtnOjZX2I+wnXlarL/+Ub2Ftleb7+5SakuXwr:/khtnONXswUrL9elebuSUXM
TLSH
T1B6863338BB689AB1F12B5039F5494A66E671DE540443F7FE8052772C8ABFE400B05E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.e.06732f3f6265fe1f8da411750c6c6fda

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.e.06732f3f6265fe1f8da411750c6c6fda

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.e.06732f3f6265fe1f8da411750c6c6fda

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.e.06732f3f6265fe1f8da411750c6c6fda

.apk 8.2MB

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.e.06732f3f6265fe1f8da411750c6c6fda

SHA256 ceac6479974eda54493f7e4588955f4d0ee91c4ab63e72e56e0378cd3fba5371
MD5 06732f3f6265fe1f8da411750c6c6fda
SHA1 1c18aeafe47a4742a8694611a57b88b42826758d
SHA512 391cf2f5d3bb315f47ea3486123ccd92b53e6896f9496dcd43f5db8fea0b931518df792e9a365dc1b8290dffef595607d1a89b89b86f54e6705edadafc0c7956
SSDEEP 196608:U+kOqtnOjZX2I+wnXlarL/+Ub2Ftleb7+5SakuXwr:/khtnONXswUrL9elebuSUXM
TLSH
T1B6863338BB689AB1F12B5039F5494A66E671DE540443F7FE8052772C8ABFE400B05E7E
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm

Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

0f534c4bc262a4ad1472b51ddf09b5c53ed66f6c

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

com.sparkgame.PopKaolaXianXia

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.e.06732f3f6265fe1f8da411750c6c6fda

Permissions

android.permission.INTERNET

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.READ_PHONE_STATE

android.permission.WRITE_SMS

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.RECEIVE_USER_PRESENT

android.permission.GET_TASKS

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.DISABLE_KEYGUARD

android.permission.SYSTEM_ALERT_WINDOW

android.permission.CALL_PHONE

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.e.06732f3f6265fe1f8da411750c6c6fda

File Signature issue

org.cocos2dx.cpp.AppActivity

cn.cmgame.billing.api.GameOpenActivity

com.door.pay.sdk.DnPayActivity

com.alipay.android.app.sdk.WapPayActivity

com.sparkgame.PopKaolaXianXia.wxapi.WXPayEntryActivity

cn.yulefu.billing.api.CoreService

com.ostrich.pay.OstrichService

com.door.pay.sdk.sms.SmsService

com.door.pay.sdk.sms.SmsReceiver

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.e.06732f3f6265fe1f8da411750c6c6fda

File Signature issue

org.cocos2dx.cpp.AppActivity

cn.cmgame.billing.api.GameOpenActivity

com.door.pay.sdk.DnPayActivity

com.alipay.android.app.sdk.WapPayActivity

com.sparkgame.PopKaolaXianXia.wxapi.WXPayEntryActivity

cn.yulefu.billing.api.CoreService

com.ostrich.pay.OstrichService

com.door.pay.sdk.sms.SmsService

com.door.pay.sdk.sms.SmsReceiver

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.e.06732f3f6265fe1f8da411750c6c6fda