gfh[.]apk | Triage™

General

Target
gfh.apk
Size 65KB
Sample261113-txrbvsxz7n
SHA256 05036d7685cf9ac7dbfc96a03f007cd76921b4c52d8f5d647ef94e9e9012fae9
MD5 21633761408be853c6386f9e94c7f402
SHA1 93b4c933ff96bce85e7ea4f20b20a11746533a43
SHA512 8f83a34e7dc924a6d98a822734bf8be7a119dffd3266695d0dca5e80a6567bf8194e4e01081b311d7779eef6f197170b963e1d2874fb2149cb91280add82552d
SSDEEP 1536:5K6v7+YEKIjYAduDsqm+dRK1atm/syRn20:5Xv7+YFIYHQ/+nwTt
TLSH
T1DC53F1D7ABDCEA1FD9F549BB8B6909B734B1CAC453F32CAA9408A6445889385C93047C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 17 IoCs

description	ioc
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
gfh.apk

File Explorer

gfh.apk

.apk 65KB

gfh.apk

SHA256 05036d7685cf9ac7dbfc96a03f007cd76921b4c52d8f5d647ef94e9e9012fae9
MD5 21633761408be853c6386f9e94c7f402
SHA1 93b4c933ff96bce85e7ea4f20b20a11746533a43
SHA512 8f83a34e7dc924a6d98a822734bf8be7a119dffd3266695d0dca5e80a6567bf8194e4e01081b311d7779eef6f197170b963e1d2874fb2149cb91280add82552d
SSDEEP 1536:5K6v7+YEKIjYAduDsqm+dRK1atm/syRn20:5Xv7+YFIYHQ/+nwTt
TLSH
T1DC53F1D7ABDCEA1FD9F549BB8B6909B734B1CAC453F32CAA9408A6445889385C93047C
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

eda7cce506173360140bebcf6d122195c7495eefb902b3234ca0e55063d9cfe7

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Cobalt Works,OU=Mobile,O=Cobalt Works,L=Portland,ST=OR,C=US

com.sync.imkdwd

Android Permissions

gfh.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_VIDEO

android.permission.READ_MEDIA_AUDIO

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WAKE_LOCK

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.FOREGROUND_SERVICE_CAMERA

android.permission.FOREGROUND_SERVICE_MICROPHONE

android.permission.FOREGROUND_SERVICE_LOCATION

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.POST_NOTIFICATIONS

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.READ_CONTACTS

android.permission.READ_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_BACKGROUND_LOCATION

android.permission.CAMERA

android.permission.RECORD_AUDIO

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.VIBRATE

android.permission.FLASHLIGHT

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.SCHEDULE_EXACT_ALARM

android.permission.USE_EXACT_ALARM

gfh.apk

File Signature issue

.ana

.ofj

.xll

.eii

.rcr

.nur

.cxg

Sharing

General

Malware Config

Signatures

File Explorer

gfh.apk

File Signature issue

.ana

.ofj

.xll

.eii

.rcr

.nur

.cxg

Android Permissions

gfh.apk