0/60
Threat
Analyzed on 2021-08-28T15:58:30.464420
| MD5 | 5d676d1606be706ebd252e17b89e34ac | |
| SHA1 | 1a6456518fe14237263371684647c0d24dd74b84 | |
| SHA256 | 26bd79156d2d0709b8cdf25b49fad221dbdc2dd833366d3626cf979b2a26dcf1 | |
| Size | 57.72MB |
Information computed with APKiD.
| /tmp/tmpm47ws6y0!classes.dex | |
| anti_vm |
|
| anti_debug |
|
| compiler |
|
Information computed with ssdeep.
| APK file | 786432:EXuJzYzxKyYw3cFvmRAXbnnfAX3ALbZ5M3iocs0lHJBw6HGdLyTXXw3n0I3w:1JzYdGw36uGTfU3AGits01Jod8nw0 | |
| Manifest | 768:GzecUIQB5YJW2t2/Rt6pcKBT6X1SbqUQBxo0/1T0b9NPmhSFaJtyDmACv9tGktJG:… | |
| classes.dex | 49152:HRGdttIp0sakKIGwz19iaGWPi/gxPfhVD+IxT1vQmByoq6tTs4qI74y/X/GxvgJ… |
Information computed with Dexofuzzy.
| APK file | 6144:0K1KH0aqwq+LBylqKUzQmEd0sEvDEWJcuBvWEtSwmBBOQYBLxvwXmGTV/pmLnQ45… | |
| classes.dex | 6144:0K1KH0aqwq+LBylqKUzQmEd0sEvDEWJcuBvWEtSwmBBOQYBLxvwXmGTV/pmLnQ45… |
Information computed with AndroGuard and Pithus.
Information computed with AndroGuard.
Information computed with MobSF.
| High | Activity (ginlemon.flower.preferences.PrefSectionActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Activity (ginlemon.flower.ExternalIntentHandler) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Activity (ginlemon.flower.preferences.showcases.MyLockScreensActivity) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
| High | Activity (ginlemon.flower.widgetPicker.WidgetPickerActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Activity (ginlemon.flower.preferences.HiddenAppsActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Activity (ginlemon.flower.preferences.FontPickerActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Activity (ginlemon.flower.preferences.showcases.MyThemesActivity) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
| High | Activity (ginlemon.flower.PreventModificationsActivity) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
| High | Activity (com.android.wallpapercropper.WallpaperCropActivity) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
| High | Activity (ginlemon.flower.preferences.BlackScreenActivity) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
| High | Activity (ginlemon.flower.preferences.ExportedActivities$RestoreBackup) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
| High | Activity (ginlemon.flower.preferences.ExportedActivities$FakeHome) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
| High | Activity (ginlemon.flower.billing.classicpaywall.PaywallActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Activity (ginlemon.flower.preferences.ExportedActivities$FakeActivity) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
| High | Activity (ginlemon.flower.DummyActivity) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
| High | Activity (ginlemon.flower.preferences.prefMenu.PrefMenuActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Activity (ginlemon.flower.shortcuts.AddDeepShortcutActivity) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
| High | Activity (ginlemon.flower.preferences.ExportedActivities$SetHomeActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Activity (ginlemon.flower.graphic.UIdemoActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Activity (ginlemon.flower.billing.newpaywall.NewPaywallActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Service (ginlemon.notifications.listener.NotificationListener) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.BIND_NOTIFICATION_LISTENER_SERVICE [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Service (ginlemon.flower.library.PanelActionService) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.BIND_ACCESSIBILITY_SERVICE [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Service (ginlemon.flower.cloudMessaging.SlFirebaseMessagingService) is not Protected.An intent-filter exists. A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Service is explicitly exported. |
| High | Content Provider (ginlemon.flower.provider.KustomProvider) is not Protected. [android:exported=true] A Content Provider is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Content Provider (ginlemon.flower.preferences.SettingsProvider) is not Protected. [android:exported=true] A Content Provider is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Broadcast Receiver (com.google.firebase.iid.FirebaseInstanceIdReceiver) is Protected by a permission, but the protection level of the permission should be checked.Permission: com.google.android.c2dm.permission.SEND [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Service (androidx.work.impl.background.systemjob.SystemJobService) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.BIND_JOB_SERVICE [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
Information computed with MobSF.
| ginlemon.flower.preferences.ExportedActivities$RestoreBackup |
Hosts: * Schemes: file:// content:// Mime types: */* application/octet-stream |
Information computed with AndroGuard.
|
Information computed with AndroGuard.
|
Information computed with AndroGuard.
|
Information computed with AndroGuard.
|
| Certificate valid not before | March 13, 2011, 3:38 p.m. |
| First submission on VT | Aug. 27, 2021, 10:35 p.m. |
| Last submission on VT | Aug. 27, 2021, 10:35 p.m. |
| Upload on Pithus | Aug. 28, 2021, 3:58 p.m. |
| Certificate valid not after | Feb. 28, 2061, 3:38 p.m. |
| Score | 0/60 |
| Report | https://www.virustotal.com/gui/file/26bd79156d2d0709b8cdf25b49fad221dbdc2dd833366d3626cf979b2a26dcf1/detection |
Information computed with MobSF.
| FCS_RBG_EXT.1.1 | The application invoke platform-provided DRBG functionality for its cryptographic operations. Random Bit Generation Services |
| FCS_STO_EXT.1.1 | The application does not store any credentials to non-volatile memory. Storage of Credentials |
| FCS_CKM_EXT.1.1 | The application generate no asymmetric cryptographic keys. Cryptographic Key Generation Services |
| FDP_DEC_EXT.1.1 | The application has access to ['location', 'network connectivity']. Access to Platform Resources |
| FDP_DEC_EXT.1.2 | The application has access to ['calender', 'address book']. Access to Platform Resources |
| FDP_NET_EXT.1.1 | The application has user/application initiated network communications. Network Communications |
| FDP_DAR_EXT.1.1 | The application implement functionality to encrypt sensitive data in non-volatile memory. Encryption Of Sensitive Application Data |
| FMT_MEC_EXT.1.1 | The application invoke the mechanisms recommended by the platform vendor for storing and setting configuration options. Supported Configuration Mechanism |
| FTP_DIT_EXT.1.1 | The application does encrypt some transmitted data with HTTPS/TLS/SSH between itself and another trusted IT product. Protection of Data in Transit |
| FCS_RBG_EXT.2.1 FCS_RBG_EXT.2.2 |
The application perform all deterministic random bit generation (DRBG) services in accordance with NIST Special Publication 800-90A using Hash_DRBG. The deterministic RBG is seeded by an entropy source that accumulates entropy from a platform-based DRBG and a software-based noise source, with a minimum of 256 bits of entropy at least equal to the greatest security strength (according to NIST SP 800-57) of the keys and hashes that it will generate. Random Bit Generation from Application |
| FCS_COP.1.1(2) | The application perform cryptographic hashing services not in accordance with FCS_COP.1.1(2) and uses the cryptographic algorithm RC2/RC4/MD4/MD5. Cryptographic Operation - Hashing |
| FCS_HTTPS_EXT.1.1 | The application implement the HTTPS protocol that complies with RFC 2818. HTTPS Protocol |
| FCS_HTTPS_EXT.1.2 | The application implement HTTPS using TLS. HTTPS Protocol |
| FCS_HTTPS_EXT.1.3 | The application notify the user and not establish the connection or request application authorization to establish the connection if the peer certificate is deemed invalid. HTTPS Protocol |
| FIA_X509_EXT.1.1 | The application invoked platform-provided functionality to validate certificates in accordance with the following rules: ['The certificate path must terminate with a trusted CA certificate']. X.509 Certificate Validation |
| FIA_X509_EXT.2.1 | The application use X.509v3 certificates as defined by RFC 5280 to support authentication for HTTPS , TLS. X.509 Certificate Authentication |
| FPT_TUD_EXT.2.1 | The application shall be distributed using the format of the platform-supported package manager. Integrity for Installation and Update |
Information computed with MobSF.
Map computed by Pithus.
Information computed with MobSF.
Information computed with MobSF.
|
https://www.twitter.com https://www.androidcentral.com https://www.xda-developers.com/ https://www.leganerd.com https://news.google.com Defined in ginlemon/flower/WebPanel.java |
|
|
https://www.reddit.com/r/smartlauncher Defined in ginlemon/flower/RatingActivity.java |
|
|
https://www.clearcellular.org/clearnav-terms-of-service.html https://www.clearcellular.org/clearnav-privacy-policy.html Defined in ginlemon/flower/welcome/SplashLayout.java |
|
|
https://www.clearcellular.org/clearnav-privacy-policy.html/ https://www.clearcellular.org/clearnav-terms-of-service.html/ Defined in ginlemon/flower/preferences/PrefSectionActivity.java |
|
|
https://api.smartlauncher.net/adv/tracking/com-vinwap-parallaxwallpaper Defined in ginlemon/flower/preferences/showcases/WallpaperSelectorActivity.java |
|
|
https://www.instagram.com/smartlauncher/ Defined in ginlemon/flower/preferences/prefMenu/PrefMenuActivity.java |
|
|
https://play.google.com/store/apps/developer?id=Smart+Launcher+Team https://static.smartlauncher.net/credits/easteregg/selfie.webp https://static.smartlauncher.net/credits/easteregg/sushi.webp https://static.smartlauncher.net/credits/easteregg/bridge.webp https://static.smartlauncher.net/credits/easteregg/germany.webp https://static.smartlauncher.net/credits/easteregg/photo_team.jpg Defined in ginlemon/flower/preferences/teamInfo/AboutActivity.java |
|
|
https://play.google.com/store/apps/details?id= Defined in ginlemon/flower/drawer/Drawer.java |
|
|
http://schemas.android.com/apk/res/android Defined in defpackage/l3.java |
|
|
https://google.com/search? Defined in defpackage/rr0.java |
|
|
https://%s/%s/%s https://firebase.google.com/support/privacy/init-options. Defined in defpackage/r51.java |
|
|
https://api.smartlauncher.net/bestapp/listAll/%s?category=%s&locale=%s&metered=%s&mode=%s Defined in defpackage/nc1.java |
|
|
https://pro.openweathermap.org/data/2.5/weather?lat= Defined in defpackage/qk2.java |
|
|
http://www. Defined in defpackage/qb2.java |
|
|
https://news.google.com Defined in defpackage/uw1.java |
|
|
https://play.google.com/store/account/subscriptions?package=ginlemon.flowerfree https://www.clearcellular.org/clearnav-privacy-policy.html/ https://play.google.com/store/apps/details?id=ginlemon.flowerfree Defined in defpackage/gi1.java |
|
|
https://static.smartlauncher.net/bestapp/thumb/ Defined in defpackage/mc1.java |
|
|
https://settings.crashlytics.com/spi/v2/platforms/android/apps/%s/settings Defined in defpackage/ro2.java |
|
|
http://play.google.com/store/apps/details https://play.google.com/store/apps/details Defined in defpackage/hc1.java |
|
|
http://schemas.android.com/apk/res/android Defined in defpackage/eh2.java |
|
|
https://clearfoundation.co.nz/ https://www.clearos.com/products/clearos-editions/clearos-mobile https://www.clearcellular.org/clearnav-terms-of-service.html/ https://www.clearcellular.org/clearnav-privacy-policy.html/ Defined in defpackage/ii1.java |
|
|
https://m.facebook.com/ads/ad_choices https://support.google.com/adsense/troubleshooter/1631343 Defined in defpackage/zb1.java |
|
|
https://www.googleadservices.com/pagead/conversion/app/deeplink?id_type=adid&sdk_version=%s&rdid=%s&bundleid=%s&retry=%s Defined in defpackage/wq0.java |
|
|
https://ac.ecosia.org/autocomplete https://www.ecosia.org/search?q= Defined in defpackage/x82.java |
|
|
https://static.smartlauncher.net/wallpapers/wall_easter_egg.png https://static.smartlauncher.net/wallpapers/wall_easter_egg_thumb.png Defined in defpackage/k32.java |
|
|
https://www.thinkclearly.news/rest/security/resetPIN Defined in defpackage/hz1.java |
|
|
http://static.smartlauncher.net/themes/thumb/ https://static.smartlauncher.net/themes/thumb/ http://static.smartlauncher.net/lockscreen/thumb/ https://static.smartlauncher.net/lockscreen/thumb/ Defined in defpackage/f32.java |
|
|
https://www.thinkclearly.news/rest/news/feed?market= Defined in defpackage/gp1.java |
|
|
https://www.google.com/search?q= https://www.g https://us.search.yahoo.com/search?fr=yhs-invalid&p= https://us.se https://yandex.ru/search/?text= https://yande https://www.baidu.com/s?wd= https://www.baidu.com/s?wd=$query https://duckduckgo.com/?q= https://duckduckgo.com/?q=$query https://www.bing.com/search?q= https://www.bing.com/search?q=$query https://www.startpage.com/do/asearch?query= https://www.s https://search.naver.com/search.naver?query= https://searc https://www.qwant.com/?q= https://www.qwant.com/?q=$query https://www.ecosia.org/search?q= https://www.e Defined in defpackage/q82.java |
|
|
https://www.smartlauncher.net/betatester/ Defined in defpackage/b0.java |
|
|
https://pagead2.googlesyndication.com/pagead/gen_204?id=gmob-apps Defined in defpackage/wx.java |
|
|
https://e.crashlytics.com/spi/v2/events Defined in defpackage/lo2.java |
|
|
https://static.smartlauncher.net/ Defined in defpackage/de1.java |
|
|
https://pro.openweathermap.org/data/2.5/weather?q= Defined in defpackage/i72.java |
|
|
https://api.smartlauncher.net/clickfail/ Defined in defpackage/ic1.java |
|
|
https://www.thinkclearly.news/rest/news/topics?market= Defined in defpackage/yp1.java |
|
|
https://api.unsplash.com https://images.unsplash.com/photo https://api.unsplash.com/photos/random Defined in defpackage/p52.java |
|
|
https://www.smartlauncher.net/bridge/ Defined in defpackage/pq1.java |
|
|
https://www.google.com/search?q= https://suggestqueries.google.com/complete/search Defined in defpackage/y82.java |
|
|
http://www.smartlauncher.net www.smartlauncher.net https://clearoslauncher.firebaseio.com Defined in Android String Resource |
Information computed with MobSF.
Information computed with Exodus-core.
| Google AdMob | https://reports.exodus-privacy.eu.org/fr/trackers/312 |
| Google CrashLytics | https://reports.exodus-privacy.eu.org/fr/trackers/27 |
| Google Firebase Analytics | https://reports.exodus-privacy.eu.org/fr/trackers/49 |
Information computed with Quark-Engine.
| Confidence:
|
Check if the network is connected |
| Confidence:
|
Start another application from current application |
| Confidence:
|
Load external class |
| Confidence:
|
Create a socket connection to the given host address |
| Confidence:
|
Implicit intent(view a web page, make a phone call, etc.) |
| Confidence:
|
Get absolute path of file and put it to JSON object |
| Confidence:
|
Find a method from given class name, usually for reflection |
| Confidence:
|
Check the active network type |
| Confidence:
|
Connect to a URL and receive input stream from the server |
| Confidence:
|
Method reflection |
| Confidence:
|
Connect to a URL and read data from it |
| Confidence:
|
Monitor data identified by a given content URI changes(SMS, MMS, etc.) |
| Confidence:
|
Create a secure socket connection to the given host address |
| Confidence:
|
Load class from given class name |
| Confidence:
|
Retrieve data from broadcast |
| Confidence:
|
Read sensitive data(SMS, CALLLOG, etc) |
| Confidence:
|
Implicit intent(view a web page, make a phone call, etc.) via setData |
| Confidence:
|
Connect to a URL and get the response code |
| Confidence:
|
Send notification |
| Confidence:
|
Monitor the broadcast action events (BOOT_COMPLETED) |
| Confidence:
|
Get Location of the device and append this info to a string |
| Confidence:
|