MALICIOUS — classes3.dex
MALICIOUS — classes3.dex is a unknown sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (71/100), attributed to the Group10 family. 1 of 53 detection engines flagged it.
Identification
- SHA-256:
9770c6953f7ecc3779c474a7ebd7416a4acde3d7af21b57542071fc8b924c4d4 - SHA-1:
f529436e074d1e581b67db5068a68d6ecb3eb717 - MD5:
febca836040f094f1be8996d53254613 - ssdeep:
49152:SrpGHEpr6mKoH79p7fnf2VyFEE0/C9BZnYDYXg4ixF8iklGwCKnAVLHDZVqD3Saq:SrZ6EH5hf28San48iX2AYCaq - TLSH:
T16E697DD660692A01EFF467E66C306C6D6B47952B21BB06CC12C0CA97E8B537711B633C - Submitted as: classes3.dex
- File type: unknown · Size: 8442980 bytes
- Verdict: malicious (71/100) · Family: Group10
Detections (1 of 53 engines)
- YARA: ESET research: IIS_Group10
Why this verdict
The malicious score of 71/100 is the fusion of 3 weighted signals:
- YARA: ESET research flagged IIS_Group10 (rule
IIS_Group10) - engine signal, weight 0.70, confidence 0.70 - Embedded executable payload carved at offset 3098440 - static signal, weight 0.40, confidence 0.70
- Embedded network infrastructure: https://www.moondownload.com/faq.html, https://192.168.1.100:8080/opds, https://opds-spec.org - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://www.moondownload.com/faq.html
- https://192.168.1.100:8080/opds
- https://opds-spec.org
- http://www.w3.org/1999/xhtml
- http://opds-spec.org/cover
- http://opds-spec.org/image
- http://opds-spec.org/image/thumbnail
- http://opds-spec.org/opds-cover-image-thumbnail
- http://opds-spec.org/sort/
- http://opds-spec.org/thumbnail
- http://www.android.com/
- http://www.moondownload.com/faq.html
- http://www.w3.org/1999/xlink
- http://www.w3.org/2000/svg
- http://www.w3.org/TR/SVG11/feature#
- http://www.yunci4.com/
- http://xml.org/sax/properties/lexical-handler
- http://xmlpull.org/v1/doc/features.html#process-namespaces
- https://pic.sogou.com/pics?ie=utf8&query=
- https://readwise.io
- https://readwise.io/access_token
- https://readwise.io/api/v2/highlights/
- https://search.douban.com/book/subject_search?search_text=
- https://search.yahoo.com/search?p=
- https://twitter.com/search/
Embedded domains
- feedbooks.com
- wikipedia.org
- s.es
- www.moondownload.com
- opds-spec.org
- www.w3.org
- a.link
- cd.mx
- cttnitfomtinotasr.fi
- drinkmalk.com
- gutenberg.org
- www.android.com
- www.ccil.org
- www.yunci4.com
- xml.org
- xmlpull.org
- baike.baidu.com
- dictionary.com
- images.search.yahoo.com
- pic.sogou.com
- readwise.io
- search.douban.com
- search.yahoo.com
- translate.google.com
- twitter.com
Embedded IP addresses
- 192.168.1.100
File paths
- P:\test\heapdumpc
- P:\test\heapdumpj
More Group10 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report