SUSPICIOUS — 3f8b0a71ff75439d9a322e3b6e9d1bc64ed1351ba65cca67dcd3b5bec5ab8d1d

SUSPICIOUS — 3f8b0a71ff75439d9a322e3b6e9d1bc64ed1351ba65cca67dcd3b5bec5ab8d1d is a apk sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 3f8b0a71ff75439d9a322e3b6e9d1bc64ed1351ba65cca67dcd3b5bec5ab8d1d
• SHA-1: 11f064b7591c94677b55a5937631a5b7f883cc0a
• MD5: 0c2cad230389b2f47b8db2c94944bfb1
• ssdeep: 393216:PL/ERpvybeczfBtYtrDqmTJ9chVP2ah+AMV8:LskasTArOmXch6w
• TLSH: T11E6F33E92FBEBD80C4F4F720B150D09D6EB82428617418ED9248693274F85772A735AF
• Submitted as: 3f8b0a71ff75439d9a322e3b6e9d1bc64ed1351ba65cca67dcd3b5bec5ab8d1d
• File type: apk · Size: 15116708 bytes
• Verdict: suspicious (58/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• androguard (APK/DEX analysis): androguard:8 dangerous permissions

Why this verdict

The suspicious score of 58/100 is the fusion of 3 weighted signals:

• APK requests 11 dangerous permissions: android.permission.WRITE_CONTACTS, android.permission.ACCESS_COARSE_LOCATION, android.permission.ACCESS_FINE_LOCATION, android.permission.READ_PHONE_STATE, android.permission.CAMERA - static signal, weight 0.50, confidence 0.70
• androguard (APK/DEX analysis) flagged androguard:8 dangerous permissions (rule androguard:8 dangerous permissions) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Archive contents (15 executables)

This apk carries 15 extracted members, each analyzed as its own sample (listing truncated):

• libjiagu.so - 070dd5d1e2f711b5a5fa8ef464e3282239413770fed0685cb871697e4dbb92d1
• libjiagu_a64.so - 2f2b363b18177629a324b1f8269cf23cf62f31190dbf1a32136370824e232500
• libjiagu_x64.so - 06324b824ec2167ca2a081ebe46a93d3c2a749086bf6ee9692f044243c7ce25c
• libjiagu_x86.so - 2f23bbae04cb5c6dea52e9c02762a5872c3999796a2fd127a7b77374cc37e936
• libbitmaps.so - e86d2eafcba9ecd2a33ab5f15c92903636641b2d99140772d98b116bae106672
• libcocklogic-1.1.3.so - 01ab8e75618b5186ff2261070fcae0948c91eeb77d4516f5e2f9fad560fdf645
• libgifimage.so - e5c269fe47425b0216aec5f89f245c8ae69ea3d58a04ffd66393aac7f2160573
• libimagepipeline.so - 3171b2039e4aeba74c42882d59e40698d03f77a4ff49aa5195d61eed1a9df85e
• libmemchunk.so - 5919cf0baa5e6a54a1bcb16e647f3d28f0a12fe9c5fbd28f24fc762269c54e76
• libtnet-3.1.7.so - 98df1946ec953c45666bf130b9a2196f91292a5d3b6a4e79471c255a783e2b57
• libwebp.so - 57442dd59f01629161cf00e7e01c2752e689ab0f78359b1ac750511514d6fea9
• libwebpimage.so - 041def77b65a166f180d721f8ae904189c89d4151f1dd99214cbadd81d947f98
• libbitmaps.so - a550da82905cfed0e5b24a4d72df98cec29f9f6ac349b628c9762b14b4bf6374
• libcocklogic-1.1.3.so - 3c4a5a07d0c3a2e397ec8d654df2b8c528222351ce47e688b3912566525ae7a7
• libgifimage.so - 6558c7b09113a575ddc0bd08d47b10296f61d6a327d069d9abc61e66a2272ca0

Dynamic analysis

This apk is a container, so it was not detonated itself. Its extracted members were re-submitted and analyzed as their own samples, and the runtime behaviour lives on those reports.

Embedded domains

• 6.au
• 4.it
• v.nl
• g.eu
• 8.sh
• 95.me
• p.fr
• uf.pl

File paths

• U:\h/
• H:\,

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report