jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]AndroidOS[.]Kuguo[.]p[.]462510047654ef6c0dd41ffb47370d37

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Kuguo.p.462510047654ef6c0dd41ffb47370d37
Size 5.6MB
Sample261015-ddkrzaew4v
SHA256 824be6a2922230cdc8e87ba0c64526312d87b02e7690e0161263bc395fefa3f0
MD5 462510047654ef6c0dd41ffb47370d37
SHA1 d8c63059abbba4e0e6eee0f7f522c4d277cba0b6
SHA512 ed84d7866a11898df0e7134c28b11c268af473e983e5315884fee84ce6222e61b3d2a54d7e461063cdd40640cb1bdda6f55bd41c895ef7a0d1e7c66a0f24e057
SSDEEP 98304:SzJaKoqa5IJXx+EoNP6KUxfdltXSA7B7viohQxuZIVV+UyDYBQtdHc/JlrZN:Eo1q5twP67xFLX7B76ohQMZUFpqX0PN
TLSH
T163562382E70DF862E9F3D231DA768127A5798C714346BA573809763C4BF7BC09B48E85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 20 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Kuguo.p.462510047654ef6c0dd41ffb47370d37

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Kuguo.p.462510047654ef6c0dd41ffb47370d37

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Kuguo.p.462510047654ef6c0dd41ffb47370d37

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Kuguo.p.462510047654ef6c0dd41ffb47370d37

.apk 5.6MB

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Kuguo.p.462510047654ef6c0dd41ffb47370d37

SHA256 824be6a2922230cdc8e87ba0c64526312d87b02e7690e0161263bc395fefa3f0
MD5 462510047654ef6c0dd41ffb47370d37
SHA1 d8c63059abbba4e0e6eee0f7f522c4d277cba0b6
SHA512 ed84d7866a11898df0e7134c28b11c268af473e983e5315884fee84ce6222e61b3d2a54d7e461063cdd40640cb1bdda6f55bd41c895ef7a0d1e7c66a0f24e057
SSDEEP 98304:SzJaKoqa5IJXx+EoNP6KUxfdltXSA7B7viohQxuZIVV+UyDYBQtdHc/JlrZN:Eo1q5twP67xFLX7B76ohQMZUFpqX0PN
TLSH
T163562382E70DF862E9F3D231DA768127A5798C714346BA573809763C4BF7BC09B48E85
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm arch:x86

Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

d958ecee0d4bdc031582db19b59894d62db4c083

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=kh,OU=vn,O=hj,L=bj,ST=sh,C=86

Chains

Jan 1, 0001

com.mfw.voiceguidezwewkyj

android.permission.INTERNET android.permission.READ_PHONE_STATE android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_COARSE_LOCATION android.permission.WRITE_EXTERNAL_STORAGE android.permission.ACCESS_WIFI_STATE android.permission.SYSTEM_ALERT_WINDOW android.permission.INTERNET android.permission.WAKE_LOCK android.permission.READ_PHONE_STATE android.permission.ACCESS_NETWORK_STATE android.permission.WRITE_EXTERNAL_STORAGE android.permission.ACCESS_WIFI_STATE android.permission.SYSTEM_ALERT_WINDOW com.android.launcher.permission.INSTALL_SHORTCUT android.permission.GET_TASKS android.permission.INTERNET android.permission.WAKE_LOCK android.permission.READ_PHONE_STATE android.permission.ACCESS_NETWORK_STATE android.permission.WRITE_EXTERNAL_STORAGE android.permission.ACCESS_WIFI_STATE android.permission.SYSTEM_ALERT_WINDOW com.android.launcher.permission.INSTALL_SHORTCUT android.permission.GET_TASKS android.permission.INTERNET android.permission.WAKE_LOCK android.permission.READ_PHONE_STATE android.permission.ACCESS_NETWORK_STATE android.permission.WRITE_EXTERNAL_STORAGE android.permission.ACCESS_WIFI_STATE android.permission.SYSTEM_ALERT_WINDOW com.android.launcher.permission.INSTALL_SHORTCUT android.permission.GET_TASKS android.permission.RECEIVE_BOOT_COMPLETED android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.WRITE_EXTERNAL_STORAGE android.permission.INTERNET android.permission.READ_PHONE_STATE android.permission.ACCESS_NETWORK_STATE android.permission.READ_LOGS android.permission.RECORD_AUDIO android.permission.ACCESS_WIFI_STATE android.permission.VIBRATE android.permission.CHANGE_NETWORK_STATE android.permission.CHANGE_WIFI_STATE android.permission.RECORD_AUDIO android.permission.WAKE_LOCK android.permission.BROADCAST_STICKY android.permission.GET_TASKS android.permission.READ_CONTACTS android.permission.WRITE_CONTACTS android.permission.WRITE_SETTINGS com.android.launcher.permission.INSTALL_SHORTCUT

com.mfw.voiceguide.ui.StartCover

android.intent.action.MAIN

com.mfw.voiceguide.ui.MainTab

com.mfw.voiceguide.ui.official.CatPanel

com.mfw.voiceguide.ui.official.VoicePanel

com.mfw.voiceguide.ui.official.PreviewPanel

com.mfw.voiceguide.corret.CorrectErrorActivity

com.mfw.voiceguide.morepage.MoreActivity

com.mfw.voiceguide.morepage.about.AboutActivity

com.mfw.voiceguide.account.AccountActivity

android.intent.action.VIEW

com.mfw.voiceguide.search.SearchActivity

com.mfw.voiceguide.appwall.AppWallActivity

com.mfw.voiceguide.feedback.FeedBackActivity

com.mfw.voiceguide.msgs.MsgListActivity

com.mfw.voiceguide.comments.CommentsActivity

com.mfw.voiceguide.web.WebViewActivity

com.mfw.voiceguide.ui.translate.TransHistoryPanel

com.exchange.View.PearlCurtainActivity

com.exchange.View.ListCurtainActivity

com.exchange.View.LandingWebViewActivity

com.tencent.tauth.TAuthView

android.intent.action.VIEW

com.baidu.push.update.UpdateActivity

com.mfw.voiceguide.ui.share.sdk.ShareAuthActivity

cn.sharesdk.framework.AuthorizeActivity

cn.sharesdk.onekeyshare.ShareAllGird

cn.sharesdk.onekeyshare.SharePage

com.mfw.voiceguide.wxapi.WXEntryActivity

cn.sharesdk.onekeyshare.QieZiShareActivity

com.lenovo.anyshare.ApMainActivity

com.lenovo.anyshare.action.MAIN

com.lenovo.anyshare.apexpress.ApContentsPickActivity

com.lenovo.anyshare.action.START_SEND

com.lenovo.anyshare.apexpress.ExternalShareActivity

android.intent.action.SEND android.intent.action.SEND_MULTIPLE

com.lenovo.anyshare.apexpress.ApDiscoverActivity

com.lenovo.anyshare.apexpress.SendProgressActivity

com.lenovo.anyshare.apexpress.ReceiveProgressActivity

com.lenovo.anyshare.intent.RECEIVE com.lenovo.anyshare.action.START_RECEIVE

com.lenovo.anyshare.history.HistoryActivity

com.lenovo.anyshare.activity.AccountDialogActivity

com.mfw.voiceguide.ui.f.Lj

com.mfw.voiceguide.ui.a.Dkc

com.mfw.voiceguide.ui.x.Qhfa

android.intent.action.CREATE_SHORTCUT

com.mfw.voiceguide.ui.e.Gw

com.mfw.voiceguide.ui.m.Wgit

com.mfw.voiceguide.ui.v.Gza

com.mfw.voiceguide.ui.u.Wiwe

android.intent.action.CREATE_SHORTCUT

com.mfw.voiceguide.ui.l.Aay

com.mfw.voiceguide.ui.g.Lvoi

com.mfw.voiceguide.ui.c.Ccu

com.mfw.voiceguide.ui.d.Nlc

android.intent.action.CREATE_SHORTCUT

com.mfw.voiceguide.ui.h.Pdi

aoy.gzy.jd.jun

android.intent.action.CREATE_SHORTCUT

com.lenovo.analytics.AnalyticsReceiver

android.net.conn.CONNECTIVITY_CHANGE

com.mfw.voiceguide.push.BootBroadcast

android.intent.action.BOOT_COMPLETED com.mfw.voiceguide.start