MALICIOUS — 9ecede410af5879dd0a23445ddbcf6d56daf8c19164c2715302741a9c2f6c262

MALICIOUS — 9ecede410af5879dd0a23445ddbcf6d56daf8c19164c2715302741a9c2f6c262 is a apk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 9ecede410af5879dd0a23445ddbcf6d56daf8c19164c2715302741a9c2f6c262
• SHA-1: 7ca6dea37ea2f6d19433a68565d95fbd40ab6c39
• MD5: 91400476794e41e8a1b2f5493635fabe
• ssdeep: 393216:FED6xpe/RTTG1uIDO0ABDAj3EHOPEDWvm75EMF7Ws06jsf6lkMZV9BHv9Kp:FED6nCdTsnu8bPxIVxWsfjsfw9W
• TLSH: T1BA70128A2BBCF490E5F577317910A09D19BC3464CC1421FAA3587C3178ED67BACB606A
• Submitted as: 9ecede410af5879dd0a23445ddbcf6d56daf8c19164c2715302741a9c2f6c262
• File type: apk · Size: 17423935 bytes
• Verdict: malicious (95/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Foxhole.JS_Zip_21.UNOFFICIAL
• androguard (APK/DEX analysis): androguard:12 dangerous permissions

Why this verdict

The malicious score of 95/100 is the fusion of 5 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Foxhole.JS_Zip_21.UNOFFICIAL (rule Sanesecurity.Foxhole.JS_Zip_21.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• APK requests 16 dangerous permissions: android.permission.READ_PHONE_STATE, android.permission.RECORD_AUDIO, android.permission.RECEIVE_BOOT_COMPLETED, android.permission.SEND_SMS, android.permission.ACCESS_COARSE_LOCATION - static signal, weight 0.50, confidence 0.70
• androguard (APK/DEX analysis) flagged androguard:12 dangerous permissions (rule androguard:12 dangerous permissions) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://purl.org/dc/elements/1.1/ - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Archive contents (15 executables)

This apk carries 15 extracted members, each analyzed as its own sample (listing truncated):

• libwbsafeedit - 11910c7acc239a471007493ff918212c8213a5bef046d5967021447d6b4b70e0
• com.baidu.appsearch.swanapp.jar - dd10c388b6d54e0be5e4fcf7ef5d5281040d2786a5810a46d1de9be641a07e00
• libAndroidEmulator.so - ca79e87ae2f01cf563008f044ce39a5cd839109dd182d7a1799c57f3ec7fd8a8
• libAsyncSdk_v1.so - 9352b9879362aeaa53d811014520be6793a1fbbe69d18b7fe5f7b215d8b01ca8
• libBdOEMAlgo_V1_0.so - 17429e182a48a487342128af71744db30ffa00bb66351570d4093754a60f6e3c
• libFaceSDK.so - af2fc07d95310012f5c487a5ed28c5f182aac9e34d19682c1b10474c4da81548
• libMD5_v2.so - a9457aea1d0f191069e5ae147aa7bf3125e86d118e3149d80032e3573b66b2da
• libaes_v2.so - 7a4570f44f50fd7353a696541084ca5198d2e4ea6039707bc7b0c441dc2045d7
• libappsearch_utils.so - 10e67bf40b5c2e22870488b6f9b8da68a9adefbe411b160e82a16088b4938a16
• libasAES_v2.so - a8df59273861c63c7facc2f5f9564beab16957ef2bbc9f2c6aadee3ed77dfb67
• libbase64encoder_v1_4.so - 3afab867da9225749f87de38a2466d0045cdf4f7fc42687510f052d5b8b2b055
• libbd_idl_pass_token.so - 208d07af2aa151784b548a0ddac8d2400c42b9eb82f3750cbd16a7a8f44fb513
• libbdpush_V2_7.so - dbb212148b20474382f0d8fb3e832ee7f122b8cd239b8113db1a17c90d989f12
• libbdssohash_v1.so - 546df6e2a928ba1a64d4647b3d29620ea541a233e7e7a270d481f9075a49735e
• libcompressbitmap.so - 9dab6a574167a570f41cdde75ab9bd71c1fc1ff960b02991bb630defdc9c43c1

Dynamic analysis

This apk is a container, so it was not detonated itself. Its extracted members were re-submitted and analyzed as their own samples, and the runtime behaviour lives on those reports.

Embedded URLs

• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://ns.adobe.com/tiff/1.0/
• http://ns.adobe.com/exif/1.0/
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/photoshop/1.0/
• http://ns.adobe.com/xap/1.0/sType/ResourceRef#

Embedded domains

• www.w3.org
• ns.adobe.com
• purl.org
• t.fr
• 9f.in
• 5.co
• 8.kr
• b.kr
• 2.net

File paths

• Y:\_w
• u:\z
• n:\LW
• X:\ko
• e:\Or=y
• b:\;j
• U:\V

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report