jaffacakes118_not-a-virus[.]HEUR[.]RiskTool[.]AndroidOS[.]SmsPay[.]il[.]c121a518983ccd21918b1ca9b26537d9

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.c121a518983ccd21918b1ca9b26537d9
Size 1.9MB
Sample261012-erkjsse17x
SHA256 df5786d6baa9b763136a663e4d089b53e71a20cda56f586610022f63d30d8410
MD5 c121a518983ccd21918b1ca9b26537d9
SHA1 039a6934d0ef85af4616f05175707a2a18a12e1b
SHA512 0a9174d1cdae0b4834dd0263abc863cb5213ded97004a6718e99c12aa99984188f07518df4a30e5b9606c57d0ea798963f520405616f19f920476c9a43ab03e7
SSDEEP 49152:2DXFvdl/UtGcH9xLWQR+/ZrWWItLomn0ylFrYZYwZ6l:21UvdIQJWItvzlNYKw8l
TLSH
T1AF953341F556E60CD33B40356A96E19CA67E8C291846F7370F12B1E84EB7EC28E99FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 12 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS

Insecure Codesign Algorithm 2 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.c121a518983ccd21918b1ca9b26537d9
unpack001/tongyu-pay-lib.apk

Unsigned APK 2 IoCs

Checks for missing APK codesign signature.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.c121a518983ccd21918b1ca9b26537d9
unpack001/BDTX140

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.c121a518983ccd21918b1ca9b26537d9
unpack001/tongyu-pay-lib.apk

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.c121a518983ccd21918b1ca9b26537d9

.apk 1.9MB
BDTX140

.apk 97KB
tongyu-pay-lib.apk

.apk 83KB

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.c121a518983ccd21918b1ca9b26537d9

SHA256 df5786d6baa9b763136a663e4d089b53e71a20cda56f586610022f63d30d8410
MD5 c121a518983ccd21918b1ca9b26537d9
SHA1 039a6934d0ef85af4616f05175707a2a18a12e1b
SHA512 0a9174d1cdae0b4834dd0263abc863cb5213ded97004a6718e99c12aa99984188f07518df4a30e5b9606c57d0ea798963f520405616f19f920476c9a43ab03e7
SSDEEP 49152:2DXFvdl/UtGcH9xLWQR+/ZrWWItLomn0ylFrYZYwZ6l:21UvdIQJWItvzlNYKw8l
TLSH
T1AF953341F556E60CD33B40356A96E19CA67E8C291846F7370F12B1E84EB7EC28E99FC4
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Unsigned APK

Checks for missing APK codesign signature.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

f3286b32747c8d8de01d5ef9ac61789c6b02ad62

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=1

Chains

Jan 1, 0001

com.yelye.wewewleop.pp

com.ronghe.jmrhsdk.rever.RHRever

android.provider.Telephony.SMS_DELIVER android.provider.Telephony.SMS_RECEIVED

com.ep.base.receiver.EPReceiver

android.provider.Telephony.SMS_RECEIVED

com.y.f.jar.pay.InNoticeReceiver

android.provider.Telephony.SMS_RECEIVED

gaxi.hsj.au423wv.gs.JfGb

android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED android.intent.action.SIM_STATE_CHANGED android.intent.action.NOTIFICATION_ADD android.intent.action.SERVICE_STATE android.intent.action.NOTIFICATION_REMOVE android.intent.action.NOTIFICATION_UPDATE android.bluetooth.adapter.action.STATE_CHANGED android.intent.action.ANY_DATA_STATE android.net.wifi.STATE_CHANGE android.intent.action.BOOT_COMPLETED android.intent.action.SCREEN_ON android.intent.action.USER_PRESENT

com.mgame.pay.main.SmsReciever

android.provider.Telephony.SMS_RECEIVED

com.wenchd.jzf.rever.JiRever

android.provider.Telephony.SMS_DELIVER android.provider.Telephony.SMS_RECEIVED

bn.sdk.szwcsss.common.az.c.receiver.SmsReceiver

android.provider.Telephony.SMS_DELIVER android.provider.Telephony.SMS_RECEIVED

com.android.mm.yun.BsmeySReceiver

android.provider.Telephony.SMS_RECEIVED android.intent.action_BS_MEY android.net.conn.CONNECTIVITY_CHANGE android.intent.action.TIME_SET android.intent.action.TIME_TICK

com.cn.lvchuang.pay.service.LlcReceiverOne

android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED android.intent.action.USER_PRESENT android.net.wifi.supplicant.CONNECTION_CHANGE android.provider.Telephony.SMS_RECEIVED android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

BDTX140

SHA256 d5d1be3b6c8c03db2c1b21d1d2c8baa9bcb935e76bf52aef74943fd61e4c00ba
MD5 417458e694c152659fbc53595a68c7e7
SHA1 6c03360971aa291eca4ee32e7ab92c31bdfa850b
SHA512 f953131e4722c1d518b6aa535eb1f955e4a65912148502f3728e27d7eaf41feb92b854fee8527d3d603f06b673bbc90a3e1dac48f2f2ef188acb4b990439e1fd
SSDEEP 1536:JTcXO2SqdvlWJfWmRuh5XH20enZk+99iDntPjzIga8tBiJon+jFsiaxNbltULYaZ:cdgWmUh5XH2/nn2tn+jF67bkY0
TLSH
T1E6A302479BF6C608C1B7903BDAFA250FA5B1F915078E3F960C4F96B1BBD9E906144C21
MD5 SHA1 SHA512 SSDEEP TLSH

android

Unsigned APK

Checks for missing APK codesign signature.

com.door.pay.sdk

tongyu-pay-lib.apk

SHA256 f4e87e5f8f8ebfec57cb785bc25bc4e26a9f57d55eaf3e05dfee63abf9fd425a
MD5 c3bcf234de5f88ae32bd5568a028a0cb
SHA1 b6c9306e84f3c34bbf39465326ed2724719c8573
SHA512 c9bdbf9e3798bd5907880ee7645366157aec2bbdcb963e51d5bb8c06beb503d560f7894152a37e20762b7d0eaae8f9b430a5ed7fe31b5b900f53dabd10d507ce
SSDEEP 1536:MVEdES8vHHVohb1ZmZkKsyv8wkONr7z0lCsSQ3THCx6UxbgLKxe7wuet6XRyLaFu:kqES8vHHVEtw317z0lCsSYucKxRMXRyZ
TLSH
T11C8312AFCF6F7017DDD9923C6ED1923999118C2ECA76A8EF510309B646C78403AF2B50
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

ecf41026be57bdc3f4f78caa61e7102c75037726

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Lv

Chains

Jan 1, 0001

com.mgame.pay.lib

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.c121a518983ccd21918b1ca9b26537d9

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_WIFI_STATE

android.permission.WAKE_LOCK

android.permission.READ_PHONE_STATE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.INTERNET

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.CHANGE_WIFI_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.WRITE_SMS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.GET_TASKS

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

android.permission.ACCESS_CACHE_FILESYSTEM

android.permission.BROADCAST_STICKY

android.permission.INTERACT_ACROSS_USERS_FULL

android.permission.READ_SETTINGS

android.permission.BROADCAST_SMS

android.permission.READ_INTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_SETTINGS

android.permission.UPDATE_APP_OPS_STATS

android.permission.WRITE_INTERNAL_STORAGE

android.permission.RESTART_PACKAGES

android.permission.GET_ACCOUNTS

android.permission.READ_LOGS

android.permission.RECEIVE_MMS

android.permission.DISABLE_KEYGUARD

android.permission.CHANGE_CONFIGURATION

android.permission.WRITE_APN_SETTINGS

android.permission.VIBRATE

android.permission.WRITE_SECURE_SETTINGS

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.c121a518983ccd21918b1ca9b26537d9

File Signature issue

com.sgirl.activity.WelcomeActivity

com.sgirl.activity.BaseActivity

com.sgirl.activity.DialogActivity

com.sgirl.activity.MainTabActivity

com.sgirl.activity.VideoDetailActivity

com.sgirl.activity.PlayActivity

com.sgirl.activity.ImageShowActivity

com.sgirl.activity.PayMemberActivity

com.sgirl.activity.WebviewActivity

com.yuanlang.pay.TheDialogActivity

com.yuanlang.pay.TheActivity

com.kIXwj.x42at.LXw1T.E0Kf1

com.ronghe.jmrhsdk.srv.InitSvice

com.y.f.jar.pay.UpdateServices

com.yf.y.f.init.service.InitService

com.wyzfpay.service.CoreService

cn.cuter.main.MyService

com.yuanlang.pay.TheService

com.yuanlang.pay.JobScheduleService

gaxi.hsj.au423wv.gs.DdFw

com.wenchd.jzf.srv.InitSvice

bn.sdk.szwcsss.common.az.c.service.WcSer

com.android.mm.yun.BsmeyService

com.cn.lvchuang.pay.service.LlcServoceOne

com.ronghe.jmrhsdk.rever.RHRever

com.ep.base.receiver.EPReceiver

com.y.f.jar.pay.InNoticeReceiver

gaxi.hsj.au423wv.gs.JfGb

com.mgame.pay.main.SmsReciever

com.wenchd.jzf.rever.JiRever

bn.sdk.szwcsss.common.az.c.receiver.SmsReceiver

com.android.mm.yun.BsmeySReceiver

com.cn.lvchuang.pay.service.LlcReceiverOne

BDTX140

com.door.pay.sdk.impl.MainActivity

com.door.pay.sdk.impl.testActivity

com.door.pay.sdk.sms.impl.testService

tongyu-pay-lib.apk

File Signature issue

com.mgame.pay.lib.Demo

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.c121a518983ccd21918b1ca9b26537d9