0/64
Threat
Analyzed on 2021-05-12T08:12:13.351076
| MD5 | e377031c4851f9b876ea2887a36d33b9 | |
| SHA1 | b3d119fa55e705aec6bd86549375495b7bc7bcd5 | |
| SHA256 | 2595621445cd0ae397ef2207b02c1d04996a41428f0afb2da89278487cbb8a2a | |
| Size | 10.79MB |
Information computed with APKiD.
| /tmp/tmpqcg76ph0!assets/audience_network.dex | |
| anti_vm |
|
| anti_debug |
|
| compiler |
|
| /tmp/tmpqcg76ph0!classes.dex | |
| anti_vm |
|
| anti_debug |
|
| compiler |
|
| /tmp/tmpqcg76ph0!classes2.dex | |
| anti_vm |
|
| anti_debug |
|
| compiler |
|
Information computed with ssdeep.
| APK file | 196608:gTzqgG5BSxtgfGn63nDXfcoR4oYCqgWx7f3WEIdduEdYx7BaRB7C:4q3SD2Gn63DX7gRWPdupr | |
| Manifest | 768:euKrKUQRxcKE6Xq9md4hLSbn9HUQtKaTMaCLo9/SeH/Lt3oFuJ/C/A93yDQwBavV:… | |
| classes.dex | 98304:ZlEvvCAVQkWjW16LLQypqvhPVSeO9OVz80He0pgLi:UCcQkW66oypqvU9f0He0p7 | |
| classes2.dex | 49152:dZ2iGi+3pbfMk0Ts/Kp7WFgPBmtJjH1NAL/23mxT6:dPtgRfM/T2KpBgpNAzKmx2 |
Information computed with Dexofuzzy.
Information computed with AndroGuard and Pithus.
Information computed with AndroGuard.
Information computed with MobSF.
| Findings | Files |
|---|---|
| Certificate/Key files hardcoded inside the app. |
stamp-cert-sha256 |
Information computed with MobSF.
| Low | App has a Network Security Configuration[android:networkSecurityConfig=@xml/network_security_config] The Network Security Configuration feature lets apps customize their network security settings in a safe, declarative configuration file without modifying app code. These settings can be configured for specific domains and for a specific app. |
| High | Broadcast Receiver (com.safecleaner.notification.foreground.NotificationForegroundReceiver) is not Protected. [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Service (de.blinkt.openvpn.core.OpenVPNService) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.BIND_VPN_SERVICE [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Broadcast Receiver (com.safecleaner.foregroundnotification.KeepAliveBroadcastReceiver) is not Protected.An intent-filter exists. A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported. |
| High | Broadcast Receiver (com.safecleaner.foregroundnotification.WakeUpReceiver2) is not Protected.An intent-filter exists. A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported. |
| High | Broadcast Receiver (com.safecleaner.foregroundnotification.WakeUpReceiver2$WakeUpAutoStartReceiver) is not Protected.An intent-filter exists. A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported. |
| High | Broadcast Receiver (com.safecleaner.foregroundnotification.WakeUpReceiver) is not Protected.An intent-filter exists. A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported. |
| High | Broadcast Receiver (com.safecleaner.foregroundnotification.WakeUpReceiver$WakeUpAutoStartReceiver) is not Protected.An intent-filter exists. A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported. |
| High | Service (com.safecleaner.foregroundnotification.JobSchedulerService) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.BIND_JOB_SERVICE [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Broadcast Receiver (com.boolbird.keepalive.AutoBootReceiver) is not Protected.An intent-filter exists. A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported. |
| High | Service (com.yandex.metrica.MetricaService) is not Protected. [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Broadcast Receiver (com.yandex.metrica.MetricaEventHandler) is not Protected. [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Broadcast Receiver (com.yandex.metrica.ConfigurationServiceReceiver) is not Protected. [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Content Provider (com.yandex.metrica.PreloadInfoContentProvider) is not Protected. [android:exported=true] A Content Provider is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Service (androidx.work.impl.background.systemjob.SystemJobService) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.BIND_JOB_SERVICE [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Broadcast Receiver (androidx.work.impl.diagnostics.DiagnosticsReceiver) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.DUMP [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
Information computed with AndroGuard.
|
Information computed with AndroGuard.
|
Information computed with AndroGuard.
|
Information computed with AndroGuard.
|
| Certificate valid not before | July 14, 2020, 9:15 p.m. |
| First submission on VT | April 15, 2021, 12:38 p.m. |
| Upload on Pithus | May 12, 2021, 8:12 a.m. |
| Last submission on VT | May 13, 2021, 7:37 a.m. |
| Certificate valid not after | July 2, 2070, 9:15 p.m. |
| Score | 0/64 |
| Report | https://www.virustotal.com/gui/file/2595621445cd0ae397ef2207b02c1d04996a41428f0afb2da89278487cbb8a2a/detection |
Information computed with MobSF.
| FCS_RBG_EXT.1.1 | The application invoke platform-provided DRBG functionality for its cryptographic operations. Random Bit Generation Services |
| FCS_STO_EXT.1.1 | The application invoke the functionality provided by the platform to securely store credentials to non-volatile memory. Storage of Credentials |
| FCS_CKM_EXT.1.1 | The application implement asymmetric key generation. Cryptographic Key Generation Services |
| FDP_DEC_EXT.1.1 | The application has access to ['bluetooth', 'location', 'network connectivity']. Access to Platform Resources |
| FDP_DEC_EXT.1.2 | The application has access to no sensitive information repositories. Access to Platform Resources |
| FDP_NET_EXT.1.1 | The application has user/application initiated network communications. Network Communications |
| FDP_DAR_EXT.1.1 | The application implement functionality to encrypt sensitive data in non-volatile memory. Encryption Of Sensitive Application Data |
| FMT_MEC_EXT.1.1 | The application invoke the mechanisms recommended by the platform vendor for storing and setting configuration options. Supported Configuration Mechanism |
| FTP_DIT_EXT.1.1 | The application does encrypt some transmitted data with HTTPS/TLS/SSH between itself and another trusted IT product. Protection of Data in Transit |
| FCS_RBG_EXT.2.1 FCS_RBG_EXT.2.2 |
The application perform all deterministic random bit generation (DRBG) services in accordance with NIST Special Publication 800-90A using Hash_DRBG. The deterministic RBG is seeded by an entropy source that accumulates entropy from a platform-based DRBG and a software-based noise source, with a minimum of 256 bits of entropy at least equal to the greatest security strength (according to NIST SP 800-57) of the keys and hashes that it will generate. Random Bit Generation from Application |
| FCS_COP.1.1(1) | The application perform encryption/decryption in accordance with a specified cryptographic algorithm AES-CBC (as defined in NIST SP 800-38A) mode or AES-GCM (as defined in NIST SP 800-38D) and cryptographic key sizes 256-bit/128-bit. Cryptographic Operation - Encryption/Decryption |
| FCS_COP.1.1(2) | The application perform cryptographic hashing services not in accordance with FCS_COP.1.1(2) and uses the cryptographic algorithm RC2/RC4/MD4/MD5. Cryptographic Operation - Hashing |
| FCS_COP.1.1(3) | The application perform cryptographic signature services (generation and verification) in accordance with a specified cryptographic algorithm RSA schemes using cryptographic key sizes of 2048-bit or greater. Cryptographic Operation - Signing |
| FCS_COP.1.1(4) | The application perform keyed-hash message authentication with cryptographic algorithm ['HMAC-SHA1'] . Cryptographic Operation - Keyed-Hash Message Authentication |
| FCS_HTTPS_EXT.1.1 | The application implement the HTTPS protocol that complies with RFC 2818. HTTPS Protocol |
| FCS_HTTPS_EXT.1.2 | The application implement HTTPS using TLS. HTTPS Protocol |
| FCS_HTTPS_EXT.1.3 | The application notify the user and not establish the connection or request application authorization to establish the connection if the peer certificate is deemed invalid. HTTPS Protocol |
| FIA_X509_EXT.1.1 | The application invoked platform-provided functionality to validate certificates in accordance with the following rules: ['The certificate path must terminate with a trusted CA certificate']. X.509 Certificate Validation |
| FIA_X509_EXT.2.1 | The application use X.509v3 certificates as defined by RFC 5280 to support authentication for HTTPS , TLS. X.509 Certificate Authentication |
| FPT_TUD_EXT.2.1 | The application shall be distributed using the format of the platform-supported package manager. Integrity for Installation and Update |
Information computed with MobSF.
Map computed by Pithus.
Information computed with MobSF.
| High | Domain config is insecurely configured to permit clear text traffic to these domains in scope. Scope: ['127.0.0.1'] |
| High | Domain config is insecurely configured to permit clear text traffic to these domains in scope. Scope: ['google.com'] |
Information computed with MobSF.
Information computed with MobSF.
|
https://firebase-settings.crashlytics.com/spi/v2/platforms/android/gmp/%s/settings Defined in e/i/d/m/b.java |
|
|
https://update.crashlytics.com/spi/v1/platforms/android/apps https://update.crashlytics.com/spi/v1/platforms/android/apps/%s https://reports.crashlytics.com/spi/v1/platforms/android/apps/%s/reports https://reports.crashlytics.com/sdk-api/v1/platforms/android/apps/%s/minidumps Defined in e/i/d/m/f/m/i.java |
|
|
https://firebase.google.com/support/privacy/init-options. Defined in e/i/d/s/d.java |
|
|
https://%s/%s/%s Defined in e/i/d/s/n/c.java |
|
|
http://www.example.com Defined in e/i/b/c/e/e.java |
|
|
http://www.google.com http://www.example.com Defined in e/i/b/e/d/a/ht.java |
|
|
www.google.com https://www.google.com Defined in e/i/b/e/f/a/u4.java |
|
|
https://google.com/search? Defined in e/i/b/e/f/a/t4.java |
|
|
https://www.googleadservices.com/pagead/conversion/app/deeplink?id_type=adid&sdk_version=%s&rdid=%s&bundleid=%s&retry=%s Defined in e/i/b/e/f/a/x3.java |
|
|
https://support.google.com/dfp_premium/answer/7160685#push Defined in e/i/b/e/a/e/b/i.java |
|
|
https://api2.amplitude.com/ Defined in e/d/a/g.java |
|
|
https://developer.android.com/training/articles/security-config Defined in e/f/a/d/i/a.java |
|
|
https://developer.android.com/training/articles/security-config Defined in e/f/a/d/i/e/c/c.java |
|
|
https://blank Defined in e/f/a/e/i.java |
|
|
https://ms.applovin.com/ https://ms.applvn.com/ https://vid.applovin.com/,https://pdn.applovin.com/,https://img.applovin.com/,https://d.applovin.com/,https://assets.applovin.com/,https://cdnjs.cloudflare.com/,http://vid.applovin.com/,http://pdn.applovin.com/,http://img.applovin.com/,http://d.applovin.com/,http://assets.applovin.com/,http://cdnjs.cloudflare.com/ https://prod-a.applovin.com,https://rt.applovin.com/4.0/pix, https://rt.applvn.com/4.0/pix,https://ms.applovin.com/,https://ms.applvn.com/ https://a.applovin.com/ https://a.applvn.com/ https://d.applovin.com/ https://d.applvn.com/ https://rt.applovin.com/ https://rt.applvn.com/ https://assets.applovin.com/gdpr/flow_v1/gdpr-flow-1.html Defined in e/f/a/e/l.java |
|
|
http://developer.android.com/google/play-services/setup.html. Defined in e/f/a/e/d0.java |
|
|
https://monetization-support.applovin.com/hc/en-us/articles/236114328-How-can-I-expose-verbose-logging-for-the-SDK Defined in e/f/a/e/p/a0.java |
|
|
javascript:al_onCloseButtonTapped(); Defined in e/f/a/b/n0.java |
|
|
javascript:al_onPoststitialDismiss(); javascript:al_onBackPressed(); javascript:al_onAppPaused(); javascript:al_onAppResumed(); javascript:al_muteSwitchOn(); javascript:al_muteSwitchOff(); javascript:al_onWindowFocusChanged( javascript:al_mute(); javascript:al_unmute(); javascript:al_onPoststitialShow(); Defined in e/f/a/b/a0.java |
|
|
javascript:al_onCloseTapped(); javascript:al_onBackPressed(); Defined in e/f/a/b/u.java |
|
|
javascript:al_onPoststitialShow(); Defined in e/f/a/b/f/c/d.java |
|
|
javascript:al_onPoststitialShow(); Defined in e/f/a/b/f/c/b.java |
|
|
javascript:al_muteSwitchOff(); javascript:al_muteSwitchOn(); javascript:al_onCloseButtonTapped(); javascript:al_mute(); javascript:al_unmute(); javascript:al_onWindowFocusChanged( javascript:al_onAppResumed(); javascript:al_onAppPaused(); javascript:al_onPoststitialDismiss(); Defined in e/f/a/b/f/c/a.java |
|
|
https://adc3-launch-staging.adcolony.com/v4/launch Defined in e/b/a/j.java |
|
|
https://adc3-launch.adcolony.com/v4/launch Defined in e/b/a/x0.java |
|
|
file:///android_asset/ Defined in e/b/a/m1.java |
|
|
file:/// Defined in e/b/a/b2.java |
|
|
https://wd.adcolony.com/logs Defined in e/b/a/a.java |
|
|
https://outcome-ssp.supersonicads.com/mediation?adUnit=2 Defined in e/k/d/g2/e.java |
|
|
https://outcome-ssp.supersonicads.com/mediation?adUnit=3 Defined in e/k/d/g2/f.java |
|
|
https://init.supersonicads.com/sdk/v7.0.4.1?request= Defined in e/k/d/m2/a.java |
|
|
javascript:try{ Defined in e/k/f/c/h.java |
|
|
https://www.supersonicads.com/mobile/sdk5/log?method= Defined in e/k/f/q/e.java |
|
|
https://www.supersonicads.com/mobile/sdk5/log?method=injectJavaScript https://www.supersonicads.com/mobile/sdk5/log?method= https://www.supersonicads.com/mobile/sdk5/log?method=webviewLoadBlank https://www.supersonicads.com/mobile/sdk5/log?method=webviewLoadWithPath https://www.supersonicads.com/mobile/sdk5/log?method=htmlControllerDoesNotExistOnFileSystem https://www.supersonicads.com/mobile/sdk5/log?method=webviewPause https://www.supersonicads.com/mobile/sdk5/log?method=webviewResume Defined in e/k/f/l/l0.java |
|
|
https://www.supersonicads.com/mobile/sdk5/log?method= Defined in e/k/f/j/e.java |
|
|
https://www.supersonicads.com/mobile/sdk5/log?method= Defined in e/k/f/p/a/a.java |
|
|
https://play.google.com/store/apps/details?id= Defined in e/a/b/a/a.java |
|
|
https://adservice.google.com/getconfig/pubvendors Defined in e/a/a/c.java |
|
|
https://www.supersonicads.com/mobile/sdk5/log?method= Defined in com/ironsource/sdk/controller/OpenUrlActivity.java |
|
|
https://tech.yandex.com/metrica-mobile-sdk/doc/mobile-sdk-dg/concepts/android-initialize-docpage/ Defined in com/yandex/metrica/impl/ob/uz.java |
|
|
https://startup.mobile.yandex.net/ Defined in com/yandex/metrica/impl/ob/Ur.java |
|
|
javascript:window. Defined in com/unity3d/services/core/webview/WebViewApp.java |
|
|
https://config.unityads.unitychina.cn/webview/ https://config.unityads.unity3d.com/webview/ Defined in com/unity3d/services/core/properties/SdkProperties.java |
|
|
javascript:window.nativebridge.receiveEvent( Defined in com/unity3d/services/ads/webplayer/WebPlayerView.java |
|
|
https://config.inmobi.com/config-server/v1/config/secure.cfg Defined in com/inmobi/media/fd.java |
|
|
http://www.google.com Defined in com/inmobi/media/g.java |
|
|
data:d},c)} data:a.data}};function Defined in com/inmobi/media/dy.java |
|
|
https://telemetry.sdk.inmobi.com/metrics Defined in com/inmobi/media/fm.java |