SUSPICIOUS — x3329.apk
SUSPICIOUS — x3329.apk is a apk sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 52 detection engines flagged it.
Identification
- SHA-256:
d7156295bd1fef9c679d0a1f388d81e9572297ee0f8e6da12342e16d07604b3e - SHA-1:
ba6e49584d4b4bc2b393771548eff28c4cd2ec2c - MD5:
5854f2f978eec77370e394f023f613bd - ssdeep:
393216:wKwrQi3eLcSAG0VXKm4VqJk+kfrfWQUE0WvWZcv3d1LCYM1koYdgDDSRWhbL+VPn:wHXyRbPbWXiWZc/3RDoSWDac+fTF - TLSH:
T1FA7433D43BF86260CFFD9A201A60A80D2EE5041D393C65E5C65E6C76B1B6837D13326E - Submitted as: x3329.apk
- File type: apk · Size: 25654360 bytes
- Verdict: suspicious (35/100)
Detections (1 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Archive contents (9 executables)
This apk carries 9 extracted members, each analyzed as its own sample:
- web_support.js -
e506f90ca27a79387818c9c4fbb57e9662b362242cb06dbd1ac20ecf95c1f578 - no_sleep.js -
dce4eef0b197b640ad6aaab2228ee1ee7dccf8bd6d6b5de5484dd1bd16430a78 - libapp.so -
49292909ac653877eb5619072297449976a6c96184f37a00340bb99c93a1ed99 - libbarhopper_v3.so -
809e416b5dfdc30ba69f35d7dc7c9c884ab1ab81c8d0e1549af9f8a52cf5415a - libflutter.so -
e00f46e457f8397ae34fab69f56cc5564ceb74cf5509624f3cc673b7588e7953 - libijkffmpeg.so -
6bf0e01ac70c134d0bc8c80767a2f0137e8d32657dd4651d68d74d05167b4678 - libijkplayer.so -
2a06b4ba07d88e3b8afa7cec1daa341ff1fca637c302f51fb1b75588625f86e1 - libijksdl.so -
fb8c021585e39a9eb8254772d2696cfea6e455ec5cd9bf7a7d952d6156027ece - libimage_processing_util_jni.so -
2ead62ff358ae3a9e9cb5b0278a1d5132a7b410288bc74add8f6356d668fdc39
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#
Embedded domains
- r.br
- www.w3.org
- ns.adobe.com
- df4.co
- www.inkscape.org
- f.me
- 9.it
- 4e.fi
- a0.hk
- 3n.de
- g.se
- 2.be
- 9t.us
- y.de
- fp.ir
- k.kr
- a.ua
File paths
- H:\-[=
- B:\G)
- Q:\5~
- Y:\$Df
- f:\Q-rM
- v:\[L
- M:\c
- e:\wb
- P:\H;
- d:\&Y
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report