0/62
Threat
Analyzed on 2022-01-21T13:50:09.096926
MD5 | a143b954ba3f61a3ad8cb14d764967cb | |
SHA1 | 6019146b0e8120fe6bcb2eb7e1a4e23b371e9dd1 | |
SHA256 | 3b17cc010c2dd9b2d41141c4fe4ff0bd76046a75dd6b594eeb887602018f664b | |
Size | 7.61MB |
Information computed with APKiD.
/tmp/tmp4mc6dzhq!classes.dex | |
yara_issue |
|
anti_vm |
|
compiler |
|
Information computed with ssdeep.
APK file | 98304:lkTtFEQAimVCGH/EEw8GiUt7ZWcVzF5m3+cnJwZCIWRe5EwhblvnyLwsB0UbHTR0:lkTtTAiUTGiUtQR4hwLZDbHTen | |
Manifest | 384:hYhuRxcKE68MSaSbkTYo9OegLt3EyU67vvuU+TtrTFu0HQUszLstr+977q3qUx9I:… | |
classes.dex | 49152:ERXLVvnU7jkjXrNc0RxGv4jNWgHFptySfR3bALqspI7p6K62JghHyKImRzZtAKI… |
Information computed with AndroGuard and Pithus.
Information computed with AndroGuard.
Information computed with MobSF.
Findings | Files |
---|---|
Certificate/Key files hardcoded inside the app. |
SEC-INF/buildConfirm.crt |
Information computed with MobSF.
High | Broadcast Receiver (com.samsung.android.networkdiagnostic.receiver.NetworkDiagnosticReceiver) is not Protected. [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
High | Content Provider (com.sec.android.diagmonagent.log.provider.DiagMonProvider) is not Protected. [android:exported=true] A Content Provider is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
High | Service (androidx.work.impl.background.systemjob.SystemJobService) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.BIND_JOB_SERVICE [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
Information computed with AndroGuard.
|
Information computed with AndroGuard.
|
Oldest file found in APK | Jan. 1, 2009, midnight |
Latest file found in APK | Jan. 1, 2009, midnight |
Certificate valid not before | June 22, 2011, 12:25 p.m. |
First submission on VT | April 27, 2021, 4:06 a.m. |
Last submission on VT | April 27, 2021, 4:06 a.m. |
Upload on Pithus | Jan. 21, 2022, 1:50 p.m. |
Certificate valid not after | Nov. 7, 2038, 12:25 p.m. |
Score | 0/62 |
Report | https://www.virustotal.com/gui/file/3b17cc010c2dd9b2d41141c4fe4ff0bd76046a75dd6b594eeb887602018f664b/detection |
Information computed with MobSF.
FCS_RBG_EXT.1.1 | The application invoke platform-provided DRBG functionality for its cryptographic operations. Random Bit Generation Services |
FCS_STO_EXT.1.1 | The application does not store any credentials to non-volatile memory. Storage of Credentials |
FCS_CKM_EXT.1.1 | The application generate no asymmetric cryptographic keys. Cryptographic Key Generation Services |
FDP_DEC_EXT.1.1 | The application has access to ['location', 'bluetooth', 'network connectivity']. Access to Platform Resources |
FDP_DEC_EXT.1.2 | The application has access to no sensitive information repositories. Access to Platform Resources |
FDP_NET_EXT.1.1 | The application has user/application initiated network communications. Network Communications |
FDP_DAR_EXT.1.1 | The application implement functionality to encrypt sensitive data in non-volatile memory. Encryption Of Sensitive Application Data |
FMT_MEC_EXT.1.1 | The application invoke the mechanisms recommended by the platform vendor for storing and setting configuration options. Supported Configuration Mechanism |
FTP_DIT_EXT.1.1 | The application does encrypt some transmitted data with HTTPS/TLS/SSH between itself and another trusted IT product. Protection of Data in Transit |
FCS_RBG_EXT.2.1 FCS_RBG_EXT.2.2 |
The application perform all deterministic random bit generation (DRBG) services in accordance with NIST Special Publication 800-90A using Hash_DRBG. The deterministic RBG is seeded by an entropy source that accumulates entropy from a platform-based DRBG and a software-based noise source, with a minimum of 256 bits of entropy at least equal to the greatest security strength (according to NIST SP 800-57) of the keys and hashes that it will generate. Random Bit Generation from Application |
FCS_COP.1.1(2) | The application perform cryptographic hashing services in accordance with a specified cryptographic algorithm SHA-1/SHA-256/SHA-384/SHA-512 and message digest sizes 160/256/384/512 bits. Cryptographic Operation - Hashing |
FCS_HTTPS_EXT.1.1 | The application implement the HTTPS protocol that complies with RFC 2818. HTTPS Protocol |
FCS_HTTPS_EXT.1.2 | The application implement HTTPS using TLS. HTTPS Protocol |
FCS_HTTPS_EXT.1.3 | The application notify the user and not establish the connection or request application authorization to establish the connection if the peer certificate is deemed invalid. HTTPS Protocol |
FIA_X509_EXT.2.1 | The application use X.509v3 certificates as defined by RFC 5280 to support authentication for HTTPS , TLS. X.509 Certificate Authentication |
Information computed with MobSF.
Map computed by Pithus.
Information computed with MobSF.
Information computed with MobSF.
https://issuetracker.google.com/issues/36918154 Defined in io/realm/Realm.java |
|
https://realm.io/docs/java/latest/#rxjava Defined in io/realm/RealmObject.java |
|
https://realm.io/news/android-installation-change/ https://realm.io/docs/java/latest/#rxjava Defined in io/realm/RealmConfiguration.java |
|
https://realm.io/news/android-installation-change/ https://realm.io/docs/java/latest/#rxjava Defined in io/realm/RealmConfiguration.java |
|
https://github.com/ReactiveX/RxJava/wiki/Plugins Defined in io/reactivex/Flowable.java |
|
https://github.com/ReactiveX/RxJava/wiki/Plugins Defined in io/reactivex/Completable.java |
|
https://github.com/ReactiveX/RxJava/wiki/Plugins Defined in io/reactivex/Maybe.java |
|
https://github.com/ReactiveX/RxJava/wiki/Plugins Defined in io/reactivex/Observable.java |
|
https://github.com/ReactiveX/RxJava/wiki/Plugins Defined in io/reactivex/Single.java |
|
https://github.com/ReactiveX/RxJava/wiki/What's-different-in-2.0#error-handling Defined in io/reactivex/exceptions/UndeliverableException.java |
|
https://github.com/ReactiveX/RxJava/wiki/Error-Handling Defined in io/reactivex/exceptions/OnErrorNotImplementedException.java |
|
https://stg-api.di.atlas.samsung.com https://dc.di.atlas.samsung.com https://regi.di.atlas.samsung.com Defined in com/samsung/context/sdk/samsunganalytics/internal/connection/Domain.java |
|
https://stg-api.di.atlas.samsung.com https://dc.di.atlas.samsung.com https://regi.di.atlas.samsung.com Defined in com/samsung/context/sdk/samsunganalytics/internal/connection/Domain.java |
|
https://stg-api.di.atlas.samsung.com https://dc.di.atlas.samsung.com https://regi.di.atlas.samsung.com Defined in com/samsung/context/sdk/samsunganalytics/internal/connection/Domain.java |
|
https://eu-api.dev-samsungpositioning.com/ https://api.samsungpositioning.com/ Defined in com/samsung/android/networkdiagnostic/data/remote/PolicyServiceFactory.java |
|
https://eu-api.dev-samsungpositioning.com/ https://api.samsungpositioning.com/ Defined in com/samsung/android/networkdiagnostic/data/remote/PolicyServiceFactory.java |
|
http://usdev-celltw-api-alb.secb2b.com/ http://USQA-CELLTW-ELB-2102877179.us-west-2.elb.amazonaws.com/ https://api.samsungpositioning.com/ Defined in Android String Resource |
|
http://usdev-celltw-api-alb.secb2b.com/ http://USQA-CELLTW-ELB-2102877179.us-west-2.elb.amazonaws.com/ https://api.samsungpositioning.com/ Defined in Android String Resource |
|
http://usdev-celltw-api-alb.secb2b.com/ http://USQA-CELLTW-ELB-2102877179.us-west-2.elb.amazonaws.com/ https://api.samsungpositioning.com/ Defined in Android String Resource |
|
http://www.openssl.org/support/faq.html Defined in lib/arm64-v8a/librealm-jni.so |
Information computed with MobSF.
Information computed with Quark-Engine.
Confidence:
|
Load external class |
Confidence:
|
Find a method from given class name, usually for reflection |
Confidence:
|
Method reflection |
Confidence:
|
Retrieve data from broadcast |
Confidence:
|
Read sensitive data(SMS, CALLLOG, etc) |
Confidence:
|
Open a file from given absolute path of the file |
Confidence:
|
Check if the given path is directory |
Confidence:
|
Connect to a URL and get the response code |
Confidence:
|
Monitor the broadcast action events (BOOT_COMPLETED) |
Confidence:
|
Get absolute path of the file and store in string |
Confidence:
|
Read file from assets directory |
Confidence:
|
Method reflection |
Confidence:
|
Hide the current app's icon |
Confidence:
|
Initialize class object dynamically |
Confidence:
|
Read the input stream from given URL |
Confidence:
|
Read data and put it into a buffer stream |
Confidence:
|
Connect to a URL and receive input stream from the server |
Confidence:
|
Connect to a URL and read data from it |
Confidence:
|
Read file and put it into a stream |
Confidence:
|
Load class from given class name |
Confidence:
|
Get last known location of the device |
Confidence:
|
Get calendar information |
Confidence:
|
Check if the given file path exist |
Information computed with MobSF.
Information computed by Pithus.