c987a9a7de445be423e0a3b6df338ce97bb28c6483cfaa1b5a51a0795106cd80

Resubmissions

24/10/2026, 13:54

261024-q7wsjsat2s7

24/10/2026, 06:30

261024-g9v5csgt217

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
204s
max time network
207s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
24/10/2026, 06:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SexSearch.apk
Size 306KB
Sample261024-g9v5csgt21
SHA256 c987a9a7de445be423e0a3b6df338ce97bb28c6483cfaa1b5a51a0795106cd80
MD5 5644365eb8417e54b358ad91e95cac04
SHA1 11c36a083d3d3c084ba6c489d7323997a657b58f
SHA512 21b5ef9dc378a4a56f1a5ccacc0a4177eafdc7b8109a306315856c1be5670eadc359990008a482ca5a4504561bf272c4c0ac770cefbffc42bba920a64846663f
SSDEEP 6144:Sj0CWKivnwGrWYFsL2CuRgKVdssHzYrsL28uRgKVdssL:ShWvvLiCzVdJ1SzVdZ
TLSH
T105641209EE9C0F56DC3A493E84A39F84DE4C2A813E42EB79F45942C48C579D1DF87C9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.pdfstash

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.pdfstash

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.pdfstash

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.pdfstash

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an app to turn on the screen on, e.g. with PowerManager.ACQUIRE_CAUSES_WAKEUP.	android.permission.TURN_SCREEN_ON
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pdfstash

com.pdfstash
1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
- Checks memory information
PID:3242

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3242.tmp

Path /data/data/com.pdfstash/cache/oat_primary/x86_64/base.3242.tmp
Size 16KB
SHA256 30f0fa87f3936c61fed2994c72f8b45a8158b91e55aee75a94923b8c33148509
MD5 c43801462e27c091e81327791908f30c
SHA1 bd562c14f16e545deb05746824ccc04e7b0d7c01
SHA512 2c521786cd381f3f19ce8d95eb1cb24618a996b513644d0036ab51fabb93884fcba21f4de8d7ed83a60c26dd1b186f0b32886552f559a66dcdb20145229cf506
SSDEEP 96:gC4SaCU/sfvXwirnCEOZ17QP2V8BpIY6n9ebDP/C6o:gvBsAirCHr0P0EBK9ebzLo
TLSH
T11A721E2F635054D1C1A7B0FC8ACA0A25DA6702A21A693F069C76C33F7C60B155FA7BD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload-preview.apk

Path /data/data/com.pdfstash/cache/payload-preview.apk
Size 1.0MB
SHA256 05275506074b2aad68bc5792a63e8f90745decb95eab277faf21c996af51a5c9
MD5 425740178eec8a42444c47cde7132630
SHA1 3e10d7daf8b20518b09929eb839e5142534a99b6
SHA512 4b6ff30df46bba81c4f36121fd8b60892facdaa8c1f12f2e59ce0d26b85c0adba903c4f1daeb2d72dfb24af5516580c22bf77da507f9c24a23545a18979f8789
SSDEEP 12288:Sh+HGMJcSZL7InXk8KaZntkOyr5BvXQ4BiMS/bBNNw7LYs3028mWTiT7:ukcZXxNRWOyVB/Q7MST940hZT+7
TLSH
T1ED25BE4AF201C927ECB6A175482783504B3BDF908EE1BBC3B644B279BDA31D67D52748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads