Pithus report for Fulguris - net.slions.fulguris.full.fdroid

File sums

MD5	`863548b824e1d22142d98285754f20b2`
SHA1	`ea4dd705eacffe0f98d769734471a4e83fdb02bc`
SHA256	`a0a07bd6201c08c6e0e91e9af10eb205dbd62e387dd198a8975fb8c7c446c572`
Size	`4.64MB`

APKiD

Information computed with APKiD.

`/tmp/tmpczevo45s!classes.dex`
anti_vm	`Build.FINGERPRINT check` `Build.MANUFACTURER check`
compiler	`r8 without marker (suspicious)`

SSdeep

Information computed with ssdeep.

APK file	`98304:ADImx1IcSTDptlcYiG9UhfT082QAob2AfrgfXRPNm:ADIc1CyY99SI8BIXRPs`
Manifest	`384:oEhhrK3SxkSWA6PNS9Qtuwo9rFyn7AmphVWtCUdXt4FkESSCAVzEKUv6plL1afnf:…`
`classes.dex`	`49152:iIJxLlxX07lDL/Ltf6QVD7MqWttLE41Y+R6rNgQ08pC5VG+:XxpC7lDJ1Wt5wrc…`

Dexofuzzy

Information computed with Dexofuzzy.

APK file	`6144:aX7PXtWBlVfWdpNbYBAv8erEzx8Uo9KVWISuB:aLPGlKYBRjQIb`
`classes.dex`	`6144:aX7PXtWBlVfWdpNbYBAv8erEzx8Uo9KVWISuB:aLPGlKYBRjQIb`

APK details

Information computed with AndroGuard and Pithus.

Package	`net.slions.fulguris.full.fdroid`
App name	`Fulguris`
Version name	`1.8.7`
Version code	`175`
SDK	`21` - `31`
UAID	`c04515283a876783664210fc79c5f1a7a5b6f13f`
Signature	Signature V1 Signature V2
Frosting	Not frosted Blocks found within V2 signature: `0x7109871a`: Unknown

Certificate details

Information computed with AndroGuard.

MD5	`81768d7ddcb7d2de70375bd55573b78a`
SHA1	`03e20f6dfe8bbe4219be06b0699524771bd82c5f`
SHA256	`1e75d9e508d23dc6f3102faede80fbe812f297b922dd55d45cec8f8e2d58bb03`
Issuer	`Common Name: buildserver_licaon, Organizational Unit: F-Droid`
Not before	`2022-06-08T16:00:11+00:00`
Not after	`2049-10-24T16:00:11+00:00`

Manifest analysis

Information computed with MobSF.

High	Clear text traffic is Enabled For App[android:usesCleartextTraffic=true] The app intends to use cleartext network traffic, such as cleartext HTTP, FTP stacks, DownloadManager, and MediaPlayer. The default value for apps that target API level 27 or lower is "true". Apps that target API level 28 or higher default to "false". The key reason for avoiding cleartext traffic is the lack of confidentiality, authenticity, and protections against tampering; a network attacker can eavesdrop on transmitted data and also modify it without being detected.
Medium	Application Data can be Backed up[android:allowBackup=true] This flag allows anyone to backup your application data via adb. It allows users who have enabled USB debugging to copy application data off of the device.
High	Activity (acr.browser.lightning.MainActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.
High	Activity (acr.browser.lightning.IncognitoActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.
High	Activity (acr.browser.lightning.settings.activity.SettingsActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.

Browsable activities

Information computed with MobSF.

acr.browser.lightning.MainActivity

Schemes: file:// http:// https:// about:// fulguris:// javascript:// inline://

Mime types: text/html text/plain application/xhtml+xml application/vnd.wap.xhtml+xml application/x-webarchive-xml

Main Activity

Information computed with AndroGuard.

acr.browser.lightning.SplashActivity

Activities

Information computed with AndroGuard.

acr.browser.lightning.SplashActivity
acr.browser.lightning.MainActivity
acr.browser.lightning.IncognitoActivity
acr.browser.lightning.settings.activity.SettingsActivity
acr.browser.lightning.reading.ReadingActivity

Sample timeline

Oldest file found in APK	Jan. 1, 1981, 1:01 a.m.
Latest file found in APK	Jan. 1, 1981, 1:01 a.m.
Certificate valid not before	June 8, 2022, 4 p.m.
First submission on VT	June 8, 2022, 4:03 p.m.
Last submission on VT	June 8, 2022, 4:03 p.m.
Upload on Pithus	June 8, 2022, 4:04 p.m.
Certificate valid not after	Oct. 24, 2049, 4 p.m.

VirusTotal

Score	0/61
Report	https://www.virustotal.com/gui/file/a0a07bd6201c08c6e0e91e9af10eb205dbd62e387dd198a8975fb8c7c446c572/detection

NIAP analysis

Information computed with MobSF.

FCS_RBG_EXT.1.1	The application use no DRBG functionality for its cryptographic operations. Random Bit Generation Services
FCS_STO_EXT.1.1	The application does not store any credentials to non-volatile memory. Storage of Credentials
FCS_CKM_EXT.1.1	The application generate no asymmetric cryptographic keys. Cryptographic Key Generation Services
FDP_DEC_EXT.1.1	The application has access to ['microphone', 'location', 'camera', 'network connectivity']. Access to Platform Resources
FDP_DEC_EXT.1.2	The application has access to no sensitive information repositories. Access to Platform Resources
FDP_NET_EXT.1.1	The application has user/application initiated network communications. Network Communications
FDP_DAR_EXT.1.1	The application does not encrypt files in non-volatile memory. Encryption Of Sensitive Application Data
FMT_MEC_EXT.1.1	The application invoke the mechanisms recommended by the platform vendor for storing and setting configuration options. Supported Configuration Mechanism
FTP_DIT_EXT.1.1	The application does encrypt some transmitted data with HTTPS/TLS/SSH between itself and another trusted IT product. Protection of Data in Transit
FCS_HTTPS_EXT.1.1	The application implement the HTTPS protocol that complies with RFC 2818. HTTPS Protocol
FCS_HTTPS_EXT.1.2	The application implement HTTPS using TLS. HTTPS Protocol
FCS_HTTPS_EXT.1.3	The application notify the user and not establish the connection or request application authorization to establish the connection if the peer certificate is deemed invalid. HTTPS Protocol
FIA_X509_EXT.2.1	The application use X.509v3 certificates as defined by RFC 5280 to support authentication for HTTPS , TLS. X.509 Certificate Authentication

Code analysis

Information computed with MobSF.

Low CVSS:7.5	The App logs information. Sensitive information should never be logged. MASVS: MSTG-STORAGE-3 CWE-532 Insertion of Sensitive Information into Log File Files: f3/c.java q1/d.java x0/l.java w1/d.java v1/f.java n3/a.java y/a.java v1/l.java m3/d.java e2/g.java acr/browser/lightning/browser/activity/BrowserActivity.java e2/m.java m2/k.java acr/browser/lightning/reading/ReadingActivity.java m2/g0.java l3/u.java q2/c.java u7/h.java u1/c.java acr/browser/lightning/view/CodeView.java v1/m.java v7/d.java g/j.java v1/g.java e2/h.java m3/h.java d2/l.java a2/d.java w1/a.java v1/i.java x0/d.java x0/o.java h8/e.java e2/i.java d2/g.java v1/o.java m2/a.java u1/b.java a2/k.java m7/c.java w1/b.java v1/k.java v1/h.java f3/g.java b0/e.java y0/z.java z2/b.java l3/j.java m2/y.java net/i2p/android/router/service/State.java q0/b.java u1/d.java a2/c.java a2/f.java
Medium CVSS:7.5	The App uses an insecure Random Number Generator. MASVS: MSTG-CRYPTO-6 CWE-330 Use of Insufficiently Random Values M5: Insufficient Cryptography Files: `v6/a.java v6/b.java org/jsoup/helper/DataUtil.java w6/a.java`
Info CVSS:0	This App uses SSL certificate pinning to detect or prevent MITM attacks in secure communication channel. MASVS: MSTG-NETWORK-4 Files: `u7/d.java u7/h.java u7/c.java u7/g.java`
High CVSS:5.5	App can read/write to External Storage. Any App can read data written to External Storage. MASVS: MSTG-STORAGE-2 CWE-276 Incorrect Default Permissions M2: Insecure Data Storage Files: `w/a.java x0/d.java x0/o.java acr/browser/lightning/settings/fragment/DebugSettingsFragment.java`
Medium CVSS:5.5	App creates temp file. Sensitive information should never be written into a temp file. MASVS: MSTG-STORAGE-2 CWE-276 Incorrect Default Permissions M2: Insecure Data Storage Files: `x0/o.java`
Medium CVSS:5.9	App uses SQLite Database and execute raw SQL query. Untrusted user input in raw SQL queries can cause SQL Injection. Also sensitive information should be encrypted and written to the database. CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') M7: Client Code Quality Files: `o/b.java q/b.java p/h.java r/c.java`
Low CVSS:3.9	App can write to App Directory. Sensitive Information should be encrypted. MASVS: MSTG-STORAGE-14 CWE-276 Incorrect Default Permissions Files: `w1/d.java`
High CVSS:7.4	Insecure WebView Implementation. WebView ignores SSL Certificate errors and accept any SSL Certificate. This application is vulnerable to MITM attacks MASVS: MSTG-NETWORK-3 CWE-295 Improper Certificate Validation M3: Insecure Communication Files: `y0/z.java`
Medium CVSS:4.3	IP Address disclosure MASVS: MSTG-CODE-2 CWE-200 Information Exposure Files: `c/b.java`
Medium CVSS:7.4	Files may contain hardcoded sensitive information like usernames, passwords, keys etc. MASVS: MSTG-STORAGE-14 CWE-312 Cleartext Storage of Sensitive Information M9: Reverse Engineering Files: `org/jsoup/nodes/DocumentType.java`
Low CVSS:0	This App copies data to clipboard. Sensitive data should not be copied to clipboard as other applications can access it. MASVS: MSTG-STORAGE-10 Files: `x/a.java`

Map computed by Pithus.

Domains analysis

Information computed with MobSF.

US	`www.w3.org`	`128.30.52.100`
DE	`search.brave.com`	`143.204.98.79`
US	`crowdin.com`	`44.199.129.167`
CH	`www.slf4j.org`	`83.166.144.67`
US	`www.ask.com`	`151.101.14.114`
NL	`www.site.com`	`23.36.163.244`
US	`www.example.com`	`93.184.216.34`
NL	`www.bing.com`	`13.107.22.200`
US	`play.google.com`	`142.250.184.238`
US	`github.com`	`140.82.121.4`
US	`gitlab.com`	`172.65.251.78`
FR	`lite.qwant.com`	`194.187.168.110`
US	`raw.githubusercontent.com`	`185.199.109.133`
RU	`yandex.ru`	`77.88.55.70`
US	`translate.google.com`	`142.250.185.238`
HK	`www.baidu.com`	`103.235.46.40`
NL	`duckduckgo.com`	`40.114.177.156`
NL	`startpage.com`	`37.0.87.55`
GB	`www.mojeek.com`	`5.102.173.68`
	`schemas.android.com`
IE	`search.yahoo.com`	`212.82.100.137`
US	`www.google.com`	`142.250.186.164`
US	`www.ejemplo.com`	`199.59.243.220`
US	`easylist.to`	`104.21.22.28`
US	`www.ecosia.org`	`104.18.14.27`
CA	`www.ekoru.org`	`142.44.140.100`
US	`slions.net`	`208.113.196.85`
FR	`www.qwant.com`	`194.187.168.100`
KR	`search.naver.com`	`223.130.192.148`
FI	`searx.prvcy.eu`	`95.216.165.156`
US	`fulguris.slions.net`	`208.97.148.204`

URL analysis

Information computed with MobSF.

`https://github.com/ReactiveX/RxJava/wiki/What's-different-in-2.0#error-handling` Defined in `a5/e.java`
`https://github.com/ReactiveX/RxJava/wiki/Error-Handling` Defined in `a5/c.java`
`file:///android_asset/duckduckgo.webp` `https://duckduckgo.com/?t=fulguris&q=` Defined in `p0/j.java`
`file:///android_asset/naver.webp` `https://search.naver.com/search.naver?ie=utf8&query=` Defined in `p0/o.java`
`file:///android_asset/duckduckgo.webp` `https://duckduckgo.com/lite/?t=fulguris&q=` Defined in `p0/h.java`
`file:///android_asset/brave.webp` `https://search.brave.com/search?q=` Defined in `p0/e.java`
`file:///android_asset/duckduckgo.webp` `https://duckduckgo.com/lite/?q=` Defined in `p0/g.java`
`file:///android_asset/ecosia.webp` `https://www.ecosia.org/search?q=` Defined in `p0/k.java`
`file:///android_asset/yahoo.webp` `https://search.yahoo.com/search?p=` Defined in `p0/v.java`
`file:///android_asset/bing.webp` `https://www.bing.com/search?q=` Defined in `p0/d.java`
`file:///android_asset/qwant.webp` `https://lite.qwant.com/?q=` Defined in `p0/p.java`
`file:///android_asset/duckduckgo.webp` `https://duckduckgo.com/html/?q=` Defined in `p0/i.java`
`file:///android_asset/startpage.webp` `https://startpage.com/do/m/mobilesearch?language=english&query=` Defined in `p0/s.java`
`file:///android_asset/yandex.webp` `https://yandex.ru/yandsearch?lr=21411&text=` Defined in `p0/w.java`
`file:///android_asset/baidu.webp` `https://www.baidu.com/s?wd=` Defined in `p0/b.java`
`file:///android_asset/yahoo.webp` `https://search.yahoo.com/mobile/s?nojs=1&p=` Defined in `p0/u.java`
`file:///android_asset/google.webp` `https://www.google.com/search?client=fulguris&ie=UTF-8&oe=UTF-8&q=` Defined in `p0/m.java`
`file:///android_asset/ask.webp` `http://www.ask.com/web?qsrc=0&o=0&l=dir&qo=Fulguris&q=` Defined in `p0/a.java`
`file:///android_asset/startpage.webp` `https://startpage.com/do/search?language=english&query=` Defined in `p0/t.java`
`file:///android_asset/mojeek.webp` `https://www.mojeek.com/search?q=` Defined in `p0/n.java`
`file:///android_asset/ekoru.webp` `https://www.ekoru.org/?ext=styx&q=` Defined in `p0/l.java`
`file:///android_asset/searx.webp` `https://searx.prvcy.eu/search?q=` Defined in `p0/r.java`
`file:///android_asset/qwant.webp` `https://www.qwant.com/?q=` Defined in `p0/q.java`
`www.*?` `https://translate.google.com/translate?sl=auto&tl=` Defined in `acr/browser/lightning/browser/activity/BrowserActivity.java`
`https://crowdin.com/project/fulguris-web-browser` `https://github.com/sponsors/Slion` Defined in `acr/browser/lightning/settings/fragment/RedirectSponsorshipSettingsFragment.java`
`https://crowdin.com/project/fulguris-web-browser` `https://github.com/sponsors/Slion` Defined in `acr/browser/lightning/settings/fragment/RedirectSponsorshipSettingsFragment.java`
`http://www.w3.org/1999/xhtml` Defined in `b0/d.java`
`https://www.google.com` Defined in `t0/w.java`
`http://www.slf4j.org/codes.html#StaticLoggerBinder` `http://www.slf4j.org/codes.html#unsuccessfulInit` `http://www.slf4j.org/codes.html#loggerNameMismatch` `http://www.slf4j.org/codes.html#replay` `http://www.slf4j.org/codes.html#substituteLogger` `http://www.slf4j.org/codes.html#multiple_bindings` `http://www.slf4j.org/codes.html#version_mismatch` Defined in `f8/c.java`
`http://www.slf4j.org/codes.html#StaticLoggerBinder` `http://www.slf4j.org/codes.html#unsuccessfulInit` `http://www.slf4j.org/codes.html#loggerNameMismatch` `http://www.slf4j.org/codes.html#replay` `http://www.slf4j.org/codes.html#substituteLogger` `http://www.slf4j.org/codes.html#multiple_bindings` `http://www.slf4j.org/codes.html#version_mismatch` Defined in `f8/c.java`
`http://www.slf4j.org/codes.html#StaticLoggerBinder` `http://www.slf4j.org/codes.html#unsuccessfulInit` `http://www.slf4j.org/codes.html#loggerNameMismatch` `http://www.slf4j.org/codes.html#replay` `http://www.slf4j.org/codes.html#substituteLogger` `http://www.slf4j.org/codes.html#multiple_bindings` `http://www.slf4j.org/codes.html#version_mismatch` Defined in `f8/c.java`
`http://www.slf4j.org/codes.html#StaticLoggerBinder` `http://www.slf4j.org/codes.html#unsuccessfulInit` `http://www.slf4j.org/codes.html#loggerNameMismatch` `http://www.slf4j.org/codes.html#replay` `http://www.slf4j.org/codes.html#substituteLogger` `http://www.slf4j.org/codes.html#multiple_bindings` `http://www.slf4j.org/codes.html#version_mismatch` Defined in `f8/c.java`
`http://www.slf4j.org/codes.html#StaticLoggerBinder` `http://www.slf4j.org/codes.html#unsuccessfulInit` `http://www.slf4j.org/codes.html#loggerNameMismatch` `http://www.slf4j.org/codes.html#replay` `http://www.slf4j.org/codes.html#substituteLogger` `http://www.slf4j.org/codes.html#multiple_bindings` `http://www.slf4j.org/codes.html#version_mismatch` Defined in `f8/c.java`
`http://www.slf4j.org/codes.html#StaticLoggerBinder` `http://www.slf4j.org/codes.html#unsuccessfulInit` `http://www.slf4j.org/codes.html#loggerNameMismatch` `http://www.slf4j.org/codes.html#replay` `http://www.slf4j.org/codes.html#substituteLogger` `http://www.slf4j.org/codes.html#multiple_bindings` `http://www.slf4j.org/codes.html#version_mismatch` Defined in `f8/c.java`
`http://www.slf4j.org/codes.html#StaticLoggerBinder` `http://www.slf4j.org/codes.html#unsuccessfulInit` `http://www.slf4j.org/codes.html#loggerNameMismatch` `http://www.slf4j.org/codes.html#replay` `http://www.slf4j.org/codes.html#substituteLogger` `http://www.slf4j.org/codes.html#multiple_bindings` `http://www.slf4j.org/codes.html#version_mismatch` Defined in `f8/c.java`
`http://schemas.android.com/apk/res/android` Defined in `d2/l.java`
`https://easylist.to/easylist/easylist.txt` `https://easylist.to` `https://easylist.to/easylist/easyprivacy.txt` `https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-agh-online.txt` `https://gitlab.com/curben/urlhaus-filter` `https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts` `https://github.com/StevenBlack/hosts` Defined in `e6/c.java`
`https://easylist.to/easylist/easylist.txt` `https://easylist.to` `https://easylist.to/easylist/easyprivacy.txt` `https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-agh-online.txt` `https://gitlab.com/curben/urlhaus-filter` `https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts` `https://github.com/StevenBlack/hosts` Defined in `e6/c.java`
`https://easylist.to/easylist/easylist.txt` `https://easylist.to` `https://easylist.to/easylist/easyprivacy.txt` `https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-agh-online.txt` `https://gitlab.com/curben/urlhaus-filter` `https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts` `https://github.com/StevenBlack/hosts` Defined in `e6/c.java`
`https://easylist.to/easylist/easylist.txt` `https://easylist.to` `https://easylist.to/easylist/easyprivacy.txt` `https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-agh-online.txt` `https://gitlab.com/curben/urlhaus-filter` `https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts` `https://github.com/StevenBlack/hosts` Defined in `e6/c.java`
`https://easylist.to/easylist/easylist.txt` `https://easylist.to` `https://easylist.to/easylist/easyprivacy.txt` `https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-agh-online.txt` `https://gitlab.com/curben/urlhaus-filter` `https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts` `https://github.com/StevenBlack/hosts` Defined in `e6/c.java`
`https://easylist.to/easylist/easylist.txt` `https://easylist.to` `https://easylist.to/easylist/easyprivacy.txt` `https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-agh-online.txt` `https://gitlab.com/curben/urlhaus-filter` `https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts` `https://github.com/StevenBlack/hosts` Defined in `e6/c.java`
`https://easylist.to/easylist/easylist.txt` `https://easylist.to` `https://easylist.to/easylist/easyprivacy.txt` `https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-agh-online.txt` `https://gitlab.com/curben/urlhaus-filter` `https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts` `https://github.com/StevenBlack/hosts` Defined in `e6/c.java`
`https://github.com/Slion/Fulguris/blob/main/LICENSE.CPAL-1.0.` `javascript:(function()` `file:///android_asset` `data:image/png;base64,` Defined in `y0/z.java`
`https://play.google.com/store/apps/details?id=net.slions.fulguris.full.playstore` Defined in `a/d.java`
`http://www.w3.org/1999/xhtml` `http://www.w3.org/2000/svg` `http://www.w3.org/1999/xlink` `https://play.google.com/store/apps/details?id=net.slions.fulguris.full.playstore` Defined in `a/z.java`
`http://www.w3.org/1999/xhtml` `http://www.w3.org/2000/svg` `http://www.w3.org/1999/xlink` `https://play.google.com/store/apps/details?id=net.slions.fulguris.full.playstore` Defined in `a/z.java`
`http://www.w3.org/1999/xhtml` `http://www.w3.org/2000/svg` `http://www.w3.org/1999/xlink` `https://play.google.com/store/apps/details?id=net.slions.fulguris.full.playstore` Defined in `a/z.java`
`http://www.w3.org/1999/xhtml` `http://www.w3.org/2000/svg` `http://www.w3.org/1999/xlink` `https://play.google.com/store/apps/details?id=net.slions.fulguris.full.playstore` Defined in `a/z.java`
`https://www.google.com/search?client=fulguris&ie=UTF-8&oe=UTF-8&q=` Defined in `u0/f.java`
`www.example.com` `https://slions.net/api/resources/10/versions` `http://fulguris.slions.net` `https://slions.net/resources/fulguris.10/updates` `www.ejemplo.com` `www.site.com` Defined in `Android String Resource`
`www.example.com` `https://slions.net/api/resources/10/versions` `http://fulguris.slions.net` `https://slions.net/resources/fulguris.10/updates` `www.ejemplo.com` `www.site.com` Defined in `Android String Resource`
`www.example.com` `https://slions.net/api/resources/10/versions` `http://fulguris.slions.net` `https://slions.net/resources/fulguris.10/updates` `www.ejemplo.com` `www.site.com` Defined in `Android String Resource`

Permissions analysis

Information computed with MobSF.

High	`android.permission.WRITE_EXTERNAL_STORAGE`	read/modify/delete external storage contents Allows an application to write to external storage.
High	`android.permission.READ_EXTERNAL_STORAGE`	read external storage contents Allows an application to read from external storage.
High	`android.permission.ACCESS_COARSE_LOCATION`	coarse (network-based) location Access coarse location sources, such as the mobile network database, to determine an approximate phone location, where available. Malicious applications can use this to determine approximately where you are.
High	`android.permission.ACCESS_FINE_LOCATION`	fine (GPS) location Access fine location sources, such as the Global Positioning System on the phone, where available. Malicious applications can use this to determine where you are and may consume additional battery power.
High	`android.permission.RECORD_AUDIO`	record audio Allows application to access the audio record path.
High	`android.permission.CAMERA`	take pictures and videos Allows application to take pictures and videos with the camera. This allows the application to collect images that the camera is seeing at any time.
Low	`android.permission.INTERNET`	full Internet access Allows an application to create network sockets.
Low	`android.permission.VIBRATE`	control vibrator Allows the application to control the vibrator.
Low	`android.permission.ACCESS_NETWORK_STATE`	view network status Allows an application to view the status of all networks.
Low	`android.permission.MODIFY_AUDIO_SETTINGS`	change your audio settings Allows application to modify global audio settings, such as volume and routing.
	`com.android.launcher.permission.INSTALL_SHORTCUT`	Unknown permission Unknown permission from android reference

Threat analysis

Information computed with Quark-Engine.

Confidence: 100%	Load external class
Confidence: 100%	Implicit intent(view a web page, make a phone call, etc.)
Confidence: 100%	Find a method from given class name, usually for reflection
Confidence: 100%	Method reflection
Confidence: 100%	Read sensitive data(SMS, CALLLOG, etc)
Confidence: 100%	Implicit intent(view a web page, make a phone call, etc.) via setData
Confidence: 100%	Connect to a URL and get the response code
Confidence: 100%	Send notification
Confidence: 100%	Monitor the broadcast action events (BOOT_COMPLETED)
Confidence: 100%	Create a socket connection to the proxy address
Confidence: 100%	Get last known location of the device
Confidence: 100%	Get location of the device
Confidence: 100%	Create a secure socket connection to the proxy address
Confidence: 100%	Method reflection
Confidence: 100%	Get the time of current location
Confidence: 100%	Initialize class object dynamically
Confidence: 80%	Check if the network is connected
Confidence: 80%	Create a socket connection to the given host address
Confidence: 80%	Check the active network type
Confidence: 80%	Read data and put it into a buffer stream
Confidence: 80%	Connect to a URL and read data from it
Confidence: 80%	Create a secure socket connection to the given host address
Confidence: 80%	Read file and put it into a stream
Confidence: 80%	Get declared method from given method name
Confidence: 80%	Open a file from given absolute path of the file
Confidence: 80%	Get absolute path of the file and store in string
Confidence: 80%	Executes the specified string Linux command
Confidence: 80%	Connect to a URL and set request method
Confidence: 80%	Get resource file from res/raw directory

Behavior analysis

Information computed with MobSF.

Android notifications

       acr/browser/lightning/browser/activity/BrowserActivity.java

Base64 decode

       d2/e.java

Base64 encode

       y0/z.java
       i2/e.java

Certificate handling

       u7/d.java
       v7/l.java
       org/jsoup/Connection.java
       l7/a.java
       p7/h.java
       l7/u.java
       u7/h.java
       org/jsoup/helper/HttpConnection.java
       q7/h.java

Execute os command

       w1/d.java

Get installed applications

       y0/z.java

Get system service

       dagger/hilt/android/internal/managers/ViewComponentManager.java
       p2/c.java
       m2/y.java
       a2/e.java
       c2/a.java
       q2/a.java
       acr/browser/lightning/browser/activity/BrowserActivity.java
       b/k.java
       i1/c.java
       x0/o.java
       a2/k.java
       acr/browser/lightning/BrowserApp.java

Http connection

       org/jsoup/helper/HttpConnection.java
       m3/f.java

Https connection

       org/jsoup/helper/HttpConnection.java

Inter process communication

       a/d0.java
       a1/a.java
       b0/d.java
       a/z.java
       c1/a.java
       j/b.java
       f/b.java
       acr/browser/lightning/download/LightningDownloadListener.java
       acr/browser/lightning/settings/activity/SettingsActivity.java
       j1/c.java
       x0/l.java
       w/a.java
       c2/a.java
       a2/h.java
       acr/browser/lightning/browser/activity/BrowserActivity.java
       acr/browser/lightning/settings/fragment/BackupSettingsFragment$importBookmarks$1.java
       acr/browser/lightning/reading/ReadingActivity.java
       j/h.java
       acr/browser/lightning/settings/fragment/AdBlockSettingsFragment.java
       g/a.java
       k7/a.java
       a/d.java
       f/c.java
       c1/c.java
       b2/c.java
       acr/browser/lightning/ThemedActivity.java
       y0/s.java
       acr/browser/lightning/IncognitoActivity.java
       acr/browser/lightning/settings/fragment/RedirectSponsorshipSettingsFragment.java
       g/q.java
       x0/o.java
       w4/a.java
       j1/e.java
       t0/i.java
       b2/a.java
       a2/k.java
       acr/browser/lightning/settings/fragment/DebugSettingsFragment.java
       acr/browser/lightning/locale/LocaleAwareActivity.java
       j1/a.java
       c1/b.java
       x0/e.java
       g/r.java
       acr/browser/lightning/rx/BroadcastReceiverObservable.java
       j7/a.java
       g/l.java
       y0/z.java
       acr/browser/lightning/settings/fragment/BackupSettingsFragment.java
       a2/i.java
       acr/browser/lightning/MainActivity.java
       k7/c.java
       a2/c.java
       a2/f.java

Java reflection

       v7/f.java
       i1/f.java
       acr/browser/lightning/settings/activity/SettingsActivity.java
       j1/c.java
       w1/d.java
       u7/c.java
       d2/j.java
       h8/c.java
       n3/a.java
       v1/l.java
       l6/a.java
       e2/g.java
       acr/browser/lightning/browser/activity/BrowserActivity.java
       u7/b.java
       b7/n.java
       g4/f.java
       j3/b.java
       m2/g0.java
       u7/e.java
       acr/browser/lightning/view/PullRefreshLayout.java
       u7/h.java
       u1/c.java
       e3/a.java
       f2/a.java
       e3/x.java
       g3/a.java
       e2/h.java
       m2/f.java
       a2/d.java
       x0/i.java
       m6/b.java
       w1/a.java
       m2/a0.java
       acr/browser/lightning/BrowserApp.java
       e2/i.java
       s6/s.java
       w4/a.java
       m6/a.java
       e2/j.java
       d3/a.java
       v7/h.java
       u2/b.java
       u1/b.java
       l6/f.java
       e3/q.java
       g3/b.java
       k3/c.java
       u7/d.java
       m2/y.java
       f2/e.java
       u1/d.java
       a2/c.java
       u7/g.java

Local file i/o operations

       d2/b.java
       t0/d.java
       y/b.java
       p/d.java
       i/d.java
       b0/e.java
       acr/browser/lightning/settings/fragment/BackupSettingsFragment.java
       e6/b.java
       a/r.java
       y/a.java
       w/a.java
       t0/n0.java
       acr/browser/lightning/browser/activity/BrowserActivity.java
       m3/k.java
       b/h.java
       e2/m.java
       b0/a.java

Message digest

       z7/i.java
       z7/w.java

Query database of sms, contacts etc

       b0/d.java

Sending broadcast

       x0/l.java
       x0/o.java

Set or read clipboard data

       w0/b.java
       a/r.java
       v/r.java
       x/a.java
       c2/a.java
       acr/browser/lightning/browser/activity/BrowserActivity.java
       u/c.java

Starting activity

       a/d0.java
       x0/e.java
       g/r.java
       g/a.java
       g/q.java
       k7/a.java
       g/l.java
       y0/z.java
       w/a.java
       acr/browser/lightning/ThemedActivity.java
       acr/browser/lightning/MainActivity.java
       c2/a.java
       k7/c.java
       acr/browser/lightning/browser/activity/BrowserActivity.java
       acr/browser/lightning/reading/ReadingActivity.java
       j/h.java
       acr/browser/lightning/settings/fragment/DebugSettingsFragment.java

Starting service

       acr/browser/lightning/browser/activity/BrowserActivity.java
       a2/k.java

Tcp socket

       m7/c.java
       p7/d.java
       w7/a.java
       u7/h.java
       r7/b.java
       p7/i.java
       l7/a.java
       p7/h.java
       u7/b.java
       l7/u.java
       s7/q.java
       p7/e.java
       m3/a.java
       q7/h.java
       s7/f.java
       org/jsoup/internal/ConstrainableInputStream.java
       g4/f.java
       z7/y.java