At least one step of the analysis has failed, we have been notified. Don't worry, the devil is in the details.
Something seems to be broken? Contact us!
0/60
Threat
net.xinhuamm.d0233
中国三沙
Analyzed on 2022-01-12T08:14:25.489872
42
permissions
152
activities
19
services
9
receivers
11
domains
File sums
| MD5 | 23645dc96d62dc6bd7c51f27d4fd60cd | |
| SHA1 | 9fcd099dd886fa8a4198b0a3745725b208d9ac60 | |
| SHA256 | 8ed24716472bce7c9850fbac171d842a18ebe2f39927fb70457ab2dd4151e1c4 | |
| Size | 42.42MB |
APKiD
Information computed with APKiD.
| /tmp/tmp_gmf0stn | |
| packer |
|
| /tmp/tmp_gmf0stn!assets/ijm_lib/armeabi/libexec.so | |
| packer |
|
| /tmp/tmp_gmf0stn!assets/ijm_lib/armeabi/libexecmain.so | |
| packer |
|
| /tmp/tmp_gmf0stn!assets/libijmDataEncryption.so | |
| packer |
|
| /tmp/tmp_gmf0stn!classes.dex | |
| compiler |
|
| /tmp/tmp_gmf0stn!lib/armeabi-v7a/libAMapSDK_MAP_v7_5_0.so | |
| packer |
|
SSdeep
Information computed with ssdeep.
| APK file | 786432:UBmCBeQmGNGVcTElt+brz/LErIL7ut2O8PjZcAbeSePKFFUYFssMFFgiOJSTM0Tn:UBmEFmnCTpz/LEreO8PSpPKTUYKs6FvT | |
| Manifest | 768:wcyTrKqR8m4VHUQtoTYobQOegzmA5+xN/p3R3c3joTynYjAtuvQAtwKcKYODN4Ph:… | |
| classes.dex | 1536:1mwIRGjT0aKo3Dzznf6T99QjdbiYN4rzZMknPt5qlGw+2wQ09CNRW4O8DoTYlslo… |
Dexofuzzy
Information computed with Dexofuzzy.
| APK file | 48:0I67hyplfpwb7tg7He+WLWoZOkwpw5wYabjiSfWSggggAjFLDBYEviN307V:0hhypl… | |
| classes.dex | 48:0I67hyplfpwb7tg7He+WLWoZOkwpw5wYabjiSfWSggggAjFLDBYEviN307V:0hhypl… |
APK details
Information computed with AndroGuard and Pithus.
Certificate details
Information computed with AndroGuard.
Manifest analysis
Information computed with MobSF.
| High | Clear text traffic is Enabled For App[android:usesCleartextTraffic=true] The app intends to use cleartext network traffic, such as cleartext HTTP, FTP stacks, DownloadManager, and MediaPlayer. The default value for apps that target API level 27 or lower is "true". Apps that target API level 28 or higher default to "false". The key reason for avoiding cleartext traffic is the lack of confidentiality, authenticity, and protections against tampering; a network attacker can eavesdrop on transmitted data and also modify it without being detected. |
| High | Launch Mode of Activity (com.ynxhs.dznews.mvp.ui.welcome.activity.WelcomeActivity) is not standard. An Activity should not be having the launch mode attribute set to "singleTask/singleInstance" as it becomes root Activity and it is possible for other applications to read the contents of the calling Intent. So it is required to use the "standard" launch mode attribute when sensitive information is included in an Intent. |
| High | Launch Mode of Activity (com.ynxhs.dznews.mvp.ui.HomeActivity) is not standard. An Activity should not be having the launch mode attribute set to "singleTask/singleInstance" as it becomes root Activity and it is possible for other applications to read the contents of the calling Intent. So it is required to use the "standard" launch mode attribute when sensitive information is included in an Intent. |
| High | Launch Mode of Activity (com.ynxhs.dznews.mvp.ui.Home2Activity) is not standard. An Activity should not be having the launch mode attribute set to "singleTask/singleInstance" as it becomes root Activity and it is possible for other applications to read the contents of the calling Intent. So it is required to use the "standard" launch mode attribute when sensitive information is included in an Intent. |
| High | Launch Mode of Activity (com.ynxhs.dznews.mvp.ui.welcome.activity.GuideActivity) is not standard. An Activity should not be having the launch mode attribute set to "singleTask/singleInstance" as it becomes root Activity and it is possible for other applications to read the contents of the calling Intent. So it is required to use the "standard" launch mode attribute when sensitive information is included in an Intent. |
| High | TaskAffinity is set for Activity (com.ynxhs.dznews.mvp.ui.main.activity.SpeechLockActivity) If taskAffinity is set, then other application could read the Intents sent to Activities belonging to another task. Always use the default setting keeping the affinity as the package name in order to prevent sensitive information inside sent or received Intents from being read by another application. |
| High | Launch Mode of Activity (com.ynxhs.dznews.mvp.ui.main.activity.SpeechLockActivity) is not standard. An Activity should not be having the launch mode attribute set to "singleTask/singleInstance" as it becomes root Activity and it is possible for other applications to read the contents of the calling Intent. So it is required to use the "standard" launch mode attribute when sensitive information is included in an Intent. |
| High | Activity (net.xinhuamm.d0233.wxapi.WXEntryActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Launch Mode of Activity (com.tencent.tauth.AuthActivity) is not standard. An Activity should not be having the launch mode attribute set to "singleTask/singleInstance" as it becomes root Activity and it is possible for other applications to read the contents of the calling Intent. So it is required to use the "standard" launch mode attribute when sensitive information is included in an Intent. |
| High | Activity (com.tencent.tauth.AuthActivity) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
| High | Broadcast Receiver (org.matomo.sdk.extra.InstallReferrerReceiver) is not Protected. [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Service (com.xinhuamm.xinhuasdk.push.GetuiPushService) is not Protected. [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | TaskAffinity is set for Activity (com.xinhuamm.intelligentspeech.speechSynthesizer.LockActivity) If taskAffinity is set, then other application could read the Intents sent to Activities belonging to another task. Always use the default setting keeping the affinity as the package name in order to prevent sensitive information inside sent or received Intents from being read by another application. |
| High | Launch Mode of Activity (com.xinhuamm.intelligentspeech.speechSynthesizer.LockActivity) is not standard. An Activity should not be having the launch mode attribute set to "singleTask/singleInstance" as it becomes root Activity and it is possible for other applications to read the contents of the calling Intent. So it is required to use the "standard" launch mode attribute when sensitive information is included in an Intent. |
| High | Broadcast Receiver (com.huawei.hms.support.api.push.PushEventReceiver) is not Protected.An intent-filter exists. A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported. |
| High | Service (com.meizu.cloud.pushsdk.NotificationService) is not Protected. [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Broadcast Receiver (com.meizu.cloud.pushsdk.SystemReceiver) is not Protected.An intent-filter exists. A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported. |
| High | Broadcast Receiver (com.igexin.sdk.FlymePushReceiver) is not Protected.An intent-filter exists. A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported. |
| High | Service (com.xiaomi.mipush.sdk.PushMessageHandler) is not Protected. [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Broadcast Receiver (com.igexin.sdk.MiuiPushReceiver) is not Protected. [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Service (com.vivo.push.sdk.service.CommandClientService) is not Protected. [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
| High | Broadcast Receiver (com.igexin.sdk.VivoPushMessageReceiver) is not Protected.An intent-filter exists. A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported. |
| High | Service (com.igexin.sdk.OppoPushService) is not Protected.An intent-filter exists. A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Service is explicitly exported. |
| High | Launch Mode of Activity (com.sina.weibo.sdk.share.WbShareTransActivity) is not standard. An Activity should not be having the launch mode attribute set to "singleTask/singleInstance" as it becomes root Activity and it is possible for other applications to read the contents of the calling Intent. So it is required to use the "standard" launch mode attribute when sensitive information is included in an Intent. |
| High | Activity (com.sina.weibo.sdk.share.WbShareTransActivity) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
| High | Launch Mode of Activity (com.ygou.picture_edit.PictureEditActivity) is not standard. An Activity should not be having the launch mode attribute set to "singleTask/singleInstance" as it becomes root Activity and it is possible for other applications to read the contents of the calling Intent. So it is required to use the "standard" launch mode attribute when sensitive information is included in an Intent. |
| High | Service (com.igexin.sdk.PushService) is Protected by a permission, but the protection level of the permission should be checked.Permission: android.permission.BIND_JOB_SERVICE [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
| High | Broadcast Receiver (com.igexin.sdk.PushReceiver) is not Protected.An intent-filter exists. A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported. |
| High | TaskAffinity is set for Activity (com.igexin.sdk.PushActivity) If taskAffinity is set, then other application could read the Intents sent to Activities belonging to another task. Always use the default setting keeping the affinity as the package name in order to prevent sensitive information inside sent or received Intents from being read by another application. |
| High | TaskAffinity is set for Activity (com.igexin.sdk.GActivity) If taskAffinity is set, then other application could read the Intents sent to Activities belonging to another task. Always use the default setting keeping the affinity as the package name in order to prevent sensitive information inside sent or received Intents from being read by another application. |
| High | Activity (com.igexin.sdk.GActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
Browsable activities
Information computed with MobSF.
| com.ynxhs.dznews.mvp.ui.welcome.activity.WelcomeActivity |
Schemes: xinhuamm110171:// |
| com.tencent.tauth.AuthActivity |
Schemes: tencent1101817544:// |
Main Activity
Information computed with AndroGuard.
|
Activities
Information computed with AndroGuard.
|
Receivers
Information computed with AndroGuard.
|
Services
Information computed with AndroGuard.
|
Sample timeline
| Certificate valid not before | Aug. 26, 2011, 3:44 a.m. |
| First submission on VT | July 8, 2020, 10:23 a.m. |
| Last submission on VT | July 8, 2020, 10:23 a.m. |
| Upload on Pithus | Jan. 12, 2022, 8:14 a.m. |
| Certificate valid not after | Aug. 19, 2036, 3:44 a.m. |
VirusTotal
| Score | 0/60 |
| Report | https://www.virustotal.com/gui/file/8ed24716472bce7c9850fbac171d842a18ebe2f39927fb70457ab2dd4151e1c4/detection |
NIAP analysis
Information computed with MobSF.
| FCS_STO_EXT.1.1 | The application does not store any credentials to non-volatile memory. Storage of Credentials |
| FCS_CKM_EXT.1.1 | The application generate no asymmetric cryptographic keys. Cryptographic Key Generation Services |
| FDP_DEC_EXT.1.1 | The application has access to ['network connectivity', 'camera', 'location', 'bluetooth', 'microphone']. Access to Platform Resources |
| FDP_DEC_EXT.1.2 | The application has access to ['system logs']. Access to Platform Resources |
| FDP_NET_EXT.1.1 | The application has user/application initiated network communications. Network Communications |
| FDP_DAR_EXT.1.1 | The application does not encrypt files in non-volatile memory. Encryption Of Sensitive Application Data |
| FMT_MEC_EXT.1.1 | The application invoke the mechanisms recommended by the platform vendor for storing and setting configuration options. Supported Configuration Mechanism |
| FTP_DIT_EXT.1.1 | The application does not encrypt any data in traffic or does not transmit any data between itself and another trusted IT product. Protection of Data in Transit |
Code analysis
Information computed with MobSF.
Map computed by Pithus.
Domains analysis
Information computed with MobSF.
URL analysis
Information computed with MobSF.
|
ftp://upload.ffmpeg.org/incoming/ Defined in lib/armeabi-v7a/libijkplayer.so |
|
|
data:application/vnd.ms.wms-hdr.asfv1;base64, http://www.openssl.org/support/faq.html Defined in lib/armeabi-v7a/libijkffmpeg.so |
|
|
http://libusb.info Defined in lib/armeabi-v7a/libusb100.so |
|
|
http://203.107.1.33/131392/d?host= http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay http://www.webrtc.org/experiments/rtp-hdrext/video-content-type http://www.webrtc.org/experiments/rtp-hdrext/video-timing http://www.alibaba.com/experiments/rtp-hdrext/audio_ranking_level_id http://www.alibaba.com/experiments/rtp-hdrext/picture_id ftp://%s:%s@%s file://hostname/, http://www.openssl.org/support/faq.html http://www.winimage.com/zLibDll Defined in lib/armeabi-v7a/libwukong_ua.so |
|
|
http://203.107.1.33/131392/d?host= http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay http://www.webrtc.org/experiments/rtp-hdrext/video-content-type http://www.webrtc.org/experiments/rtp-hdrext/video-timing http://www.alibaba.com/experiments/rtp-hdrext/audio_ranking_level_id http://www.alibaba.com/experiments/rtp-hdrext/picture_id ftp://%s:%s@%s file://hostname/, http://www.openssl.org/support/faq.html http://www.winimage.com/zLibDll Defined in lib/armeabi-v7a/libwukong_ua.so |
|
|
http://203.107.1.33/131392/d?host= http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay http://www.webrtc.org/experiments/rtp-hdrext/video-content-type http://www.webrtc.org/experiments/rtp-hdrext/video-timing http://www.alibaba.com/experiments/rtp-hdrext/audio_ranking_level_id http://www.alibaba.com/experiments/rtp-hdrext/picture_id ftp://%s:%s@%s file://hostname/, http://www.openssl.org/support/faq.html http://www.winimage.com/zLibDll Defined in lib/armeabi-v7a/libwukong_ua.so |
|
|
http://203.107.1.33/131392/d?host= http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay http://www.webrtc.org/experiments/rtp-hdrext/video-content-type http://www.webrtc.org/experiments/rtp-hdrext/video-timing http://www.alibaba.com/experiments/rtp-hdrext/audio_ranking_level_id http://www.alibaba.com/experiments/rtp-hdrext/picture_id ftp://%s:%s@%s file://hostname/, http://www.openssl.org/support/faq.html http://www.winimage.com/zLibDll Defined in lib/armeabi-v7a/libwukong_ua.so |
|
|
http://203.107.1.33/131392/d?host= http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay http://www.webrtc.org/experiments/rtp-hdrext/video-content-type http://www.webrtc.org/experiments/rtp-hdrext/video-timing http://www.alibaba.com/experiments/rtp-hdrext/audio_ranking_level_id http://www.alibaba.com/experiments/rtp-hdrext/picture_id ftp://%s:%s@%s file://hostname/, http://www.openssl.org/support/faq.html http://www.winimage.com/zLibDll Defined in lib/armeabi-v7a/libwukong_ua.so |
|
|
http://203.107.1.33/131392/d?host= http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay http://www.webrtc.org/experiments/rtp-hdrext/video-content-type http://www.webrtc.org/experiments/rtp-hdrext/video-timing http://www.alibaba.com/experiments/rtp-hdrext/audio_ranking_level_id http://www.alibaba.com/experiments/rtp-hdrext/picture_id ftp://%s:%s@%s file://hostname/, http://www.openssl.org/support/faq.html http://www.winimage.com/zLibDll Defined in lib/armeabi-v7a/libwukong_ua.so |
|
|
http://203.107.1.33/131392/d?host= http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay http://www.webrtc.org/experiments/rtp-hdrext/video-content-type http://www.webrtc.org/experiments/rtp-hdrext/video-timing http://www.alibaba.com/experiments/rtp-hdrext/audio_ranking_level_id http://www.alibaba.com/experiments/rtp-hdrext/picture_id ftp://%s:%s@%s file://hostname/, http://www.openssl.org/support/faq.html http://www.winimage.com/zLibDll Defined in lib/armeabi-v7a/libwukong_ua.so |
|
|
http://203.107.1.33/131392/d?host= http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay http://www.webrtc.org/experiments/rtp-hdrext/video-content-type http://www.webrtc.org/experiments/rtp-hdrext/video-timing http://www.alibaba.com/experiments/rtp-hdrext/audio_ranking_level_id http://www.alibaba.com/experiments/rtp-hdrext/picture_id ftp://%s:%s@%s file://hostname/, http://www.openssl.org/support/faq.html http://www.winimage.com/zLibDll Defined in lib/armeabi-v7a/libwukong_ua.so |
|
|
http://203.107.1.33/131392/d?host= http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay http://www.webrtc.org/experiments/rtp-hdrext/video-content-type http://www.webrtc.org/experiments/rtp-hdrext/video-timing http://www.alibaba.com/experiments/rtp-hdrext/audio_ranking_level_id http://www.alibaba.com/experiments/rtp-hdrext/picture_id ftp://%s:%s@%s file://hostname/, http://www.openssl.org/support/faq.html http://www.winimage.com/zLibDll Defined in lib/armeabi-v7a/libwukong_ua.so |
|
|
http://live.aliyuncs.com https://slsrole.alicdn.com https://videocloud.cn-hangzhou.log.aliyuncs.com http://www.winimage.com/zLibDll file://%s%s%s ftp://%s:%s@%s Defined in lib/armeabi-v7a/libalivc_conan.so |
|
|
http://live.aliyuncs.com https://slsrole.alicdn.com https://videocloud.cn-hangzhou.log.aliyuncs.com http://www.winimage.com/zLibDll file://%s%s%s ftp://%s:%s@%s Defined in lib/armeabi-v7a/libalivc_conan.so |
|
|
http://live.aliyuncs.com https://slsrole.alicdn.com https://videocloud.cn-hangzhou.log.aliyuncs.com http://www.winimage.com/zLibDll file://%s%s%s ftp://%s:%s@%s Defined in lib/armeabi-v7a/libalivc_conan.so |
|
|
http://live.aliyuncs.com https://slsrole.alicdn.com https://videocloud.cn-hangzhou.log.aliyuncs.com http://www.winimage.com/zLibDll file://%s%s%s ftp://%s:%s@%s Defined in lib/armeabi-v7a/libalivc_conan.so |
|
|
http://www.openssl.org/support/faq.html Defined in lib/armeabi-v7a/libnlsCppSdk.so |
|
|
http://www.videolan.org/x264.html Defined in lib/armeabi-v7a/libalivcffmpeg.so |
Permissions analysis
Information computed with MobSF.
Threat analysis
Information computed with Quark-Engine.
| Confidence:
|
Method reflection |
| Confidence:
|
Method reflection |
| Confidence:
|
Initialize class object dynamically |
| Confidence:
|
Read file and put it into a stream |
| Confidence:
|
Get absolute path of the file and store in string |
| Confidence:
|
Read file from assets directory |
| Confidence:
|
Load additional DEX files dynamically |
| Confidence:
|
Executes the specified string Linux command |
Behavior analysis
Information computed with MobSF.