0/62
Threat
Analyzed on 2022-05-27T13:30:53.442285
| MD5 | 469a8c7537c6a53ca50ce034bfcff084 | |
| SHA1 | 1dd5f03f2fbc45e37c2eeb0fd76a9b04b8bc5048 | |
| SHA256 | 0839d7f1f0a51f85903fa7f54c6b924746ec9db5d9810d23308215fac72ed8ec | |
| Size | 8.63MB |
Information computed with APKiD.
| /tmp/tmpvaabs7cr!classes.dex | |
| yara_issue |
|
| anti_vm |
|
| compiler |
|
Information computed with ssdeep.
| APK file | 98304:91weAzMMKESynpBZA6ivL5rCjVyrAmzyonUKnJWZAhGa82xZvY5i6liYmRt9pA//:9Kc5rJ1RUIBf8Q25igJmNpA/Uu26jtkK | |
| Manifest | 768:sqnUrBgFpiSlav+k8Bb/1ZRIFtAUn6y1LmE43O3H3T3c3mE5DgK/Ux3zwP81ePAA:… | |
| classes.dex | 49152:5M+uhU5fzKtOqmEZOdtjJEukUwb2UaZlOt61x9s7lrAO2YSTkoZQfNND/YUIRB8… |
Information computed with AndroGuard and Pithus.
Information computed with AndroGuard.
Information computed with MobSF.
| Findings | Files |
|---|---|
| Certificate/Key files hardcoded inside the app. |
SEC-INF/buildConfirm.crt |
Information computed with MobSF.
| Low | App is direct-boot aware [android:directBootAware=true] This app can run before the user unlocks the device. If you're using a custom subclass of Application, and if any component inside your application is direct - boot aware, then your entire custom application is considered to be direct - boot aware.During Direct Boot, your application can only access the data that is stored in device protected storage. |
| High | Service (SystemUIDesktopService) is not Protected. [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| Low | Service (SystemUISecondaryUserService) is Protected by a permission.Permission: com.samsung.desktopsystemui.permission.SELFprotectionLevel: signature[android:exported=true] A Service is found to be exported, but is protected by permission. |
| High | Service (.ImageWallpaper) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.BIND_WALLPAPER [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Activity (.tuner.TunerActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Activity-Alias (.tuner.TunerSettingLink) is not Protected.An intent-filter exists. An Activity-Alias is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity-Alias is explicitly exported. |
| High | Activity (.usb.UsbConfirmActivity) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.MANAGE_USB [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Activity (.usb.UsbPermissionActivity) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.MANAGE_USB [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Activity (.usb.UsbResolverActivity) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.MANAGE_USB [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Activity (.usb.UsbAccessoryUriActivity) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.MANAGE_USB [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Service (.keyguard.KeyguardService) is not Protected. [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Service (.doze.DozeService) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.BIND_DREAM_SERVICE [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
Information computed with AndroGuard.
|
Information computed with AndroGuard.
|
| Oldest file found in APK | Jan. 1, 2009, midnight |
| Latest file found in APK | Jan. 1, 2009, midnight |
| Certificate valid not before | June 22, 2011, 12:25 p.m. |
| First submission on VT | April 27, 2021, 4:03 a.m. |
| Last submission on VT | April 27, 2021, 4:03 a.m. |
| Upload on Pithus | May 27, 2022, 1:30 p.m. |
| Certificate valid not after | Nov. 7, 2038, 12:25 p.m. |
| Score | 0/62 |
| Report | https://www.virustotal.com/gui/file/0839d7f1f0a51f85903fa7f54c6b924746ec9db5d9810d23308215fac72ed8ec/detection |
Information computed with MobSF.
| FCS_RBG_EXT.1.1 | The application invoke platform-provided DRBG functionality for its cryptographic operations. Random Bit Generation Services |
| FCS_STO_EXT.1.1 | The application invoke the functionality provided by the platform to securely store credentials to non-volatile memory. Storage of Credentials |
| FCS_CKM_EXT.1.1 | The application generate no asymmetric cryptographic keys. Cryptographic Key Generation Services |
| FDP_DEC_EXT.1.1 | The application has access to ['location', 'bluetooth', 'camera', 'network connectivity']. Access to Platform Resources |
| FDP_DEC_EXT.1.2 | The application has access to ['call lists', 'address book', 'calendar']. Access to Platform Resources |
| FDP_NET_EXT.1.1 | The application has no network communications. Network Communications |
| FDP_DAR_EXT.1.1 | The application implement functionality to encrypt sensitive data in non-volatile memory. Encryption Of Sensitive Application Data |
| FMT_MEC_EXT.1.1 | The application invoke the mechanisms recommended by the platform vendor for storing and setting configuration options. Supported Configuration Mechanism |
| FTP_DIT_EXT.1.1 | The application does encrypt some transmitted data with HTTPS/TLS/SSH between itself and another trusted IT product. Protection of Data in Transit |
| FCS_RBG_EXT.2.1 FCS_RBG_EXT.2.2 |
The application perform all deterministic random bit generation (DRBG) services in accordance with NIST Special Publication 800-90A using Hash_DRBG. The deterministic RBG is seeded by an entropy source that accumulates entropy from a platform-based DRBG and a software-based noise source, with a minimum of 256 bits of entropy at least equal to the greatest security strength (according to NIST SP 800-57) of the keys and hashes that it will generate. Random Bit Generation from Application |
| FCS_COP.1.1(1) | The application perform encryption/decryption in accordance with a specified cryptographic algorithm AES-CBC (as defined in NIST SP 800-38A) mode or AES-GCM (as defined in NIST SP 800-38D) and cryptographic key sizes 256-bit/128-bit. Cryptographic Operation - Encryption/Decryption |
| FCS_COP.1.1(2) | The application perform cryptographic hashing services in accordance with a specified cryptographic algorithm SHA-1/SHA-256/SHA-384/SHA-512 and message digest sizes 160/256/384/512 bits. Cryptographic Operation - Hashing |
| FCS_HTTPS_EXT.1.1 | The application implement the HTTPS protocol that complies with RFC 2818. HTTPS Protocol |
| FCS_HTTPS_EXT.1.2 | The application implement HTTPS using TLS. HTTPS Protocol |
| FIA_X509_EXT.2.1 | The application use X.509v3 certificates as defined by RFC 5280 to support authentication for HTTPS , TLS. X.509 Certificate Authentication |
Information computed with MobSF.
Map computed by Pithus.
Information computed with MobSF.
Information computed with MobSF.
|
http://xml.org/sax/properties/lexical-handler http://www.w3.org/2000/svg http://www.w3.org/1999/xlink http://www.w3.org/TR/SVG11/feature# Defined in com/caverock/androidsvg/SVGParser.java |
|
|
http://xml.org/sax/properties/lexical-handler http://www.w3.org/2000/svg http://www.w3.org/1999/xlink http://www.w3.org/TR/SVG11/feature# Defined in com/caverock/androidsvg/SVGParser.java |
|
|
http://xml.org/sax/properties/lexical-handler http://www.w3.org/2000/svg http://www.w3.org/1999/xlink http://www.w3.org/TR/SVG11/feature# Defined in com/caverock/androidsvg/SVGParser.java |
|
|
http://xml.org/sax/properties/lexical-handler http://www.w3.org/2000/svg http://www.w3.org/1999/xlink http://www.w3.org/TR/SVG11/feature# Defined in com/caverock/androidsvg/SVGParser.java |
|
|
https://stg-api.di.atlas.samsung.com https://regi.di.atlas.samsung.com https://dc.di.atlas.samsung.com Defined in com/samsung/context/sdk/samsunganalytics/internal/connection/Domain.java |
|
|
https://stg-api.di.atlas.samsung.com https://regi.di.atlas.samsung.com https://dc.di.atlas.samsung.com Defined in com/samsung/context/sdk/samsunganalytics/internal/connection/Domain.java |
|
|
https://stg-api.di.atlas.samsung.com https://regi.di.atlas.samsung.com https://dc.di.atlas.samsung.com Defined in com/samsung/context/sdk/samsunganalytics/internal/connection/Domain.java |
|
|
https://help.content.samsung.com/csweb/auth/gosupport.do?serviceCd=sdex&targetUrl=%s&chnlCd=ODC&_common_country=%s&_common_lang=%s Defined in com/samsung/desktopsystemui/statusbar/phone/taskbar/views/ContextMenuLayout.java |
|
|
https://www.example.com/proxy.pac https://xfinitymobile.com/activate www.orange.pl/wificalling. Defined in Android String Resource |
|
|
https://www.example.com/proxy.pac https://xfinitymobile.com/activate www.orange.pl/wificalling. Defined in Android String Resource |
Information computed with MobSF.