0/57
Threat
Analyzed on 2022-05-23T22:36:24.504266
MD5 | e944c422b4dfabbc58ba13436dfa4ef2 | |
SHA1 | 4bb17ee3647e871a4675b36b34f6628eb759a7e3 | |
SHA256 | bb9ebdfb53ee1852ec5bdd145348c5c9c603fe05bb644054ea6610963166449e | |
Size | 7.82MB |
Information computed with APKiD.
/tmp/tmpf73hjhmx!classes.dex | |
anti_vm |
|
compiler |
|
Information computed with ssdeep.
APK file | 98304:2eNv/iB7rSQrRM4SlvCN3BUsQy+p4NutWXOIM6O+1X1EwQ9bnSsb3uH8q:TNv/Kvo4mvCxBUsZstSO701X1b6Oj | |
Manifest | 768:0BmgScPITBNtCyw13ch3tpkKm8Ih8XzKrEwfgHAgnVAncYo8C54UOlEFzREXhqCn:… | |
classes.dex | 49152:Co3VFnMMvdLwmEVgAzY8aPz40euxMIhQabU//v7UK62WMZo9tPaxXDVIehjR/lK… |
Information computed with Dexofuzzy.
APK file | 3072:MoTx/AKyfoktENqRl1b9/i7xssmRM98888wtqVa8QV/o+mC:1pAvQkS4RlH/Ixss… | |
classes.dex | 3072:MoTx/AKyfoktENqRl1b9/i7xssmRM98888wtqVa8QV/o+mC:1pAvQkS4RlH/Ixss… |
Information computed with AndroGuard and Pithus.
Information computed with AndroGuard.
Information computed with MobSF.
Findings | Files |
---|---|
Certificate/Key files hardcoded inside the app. |
SEC-INF/buildConfirm.crt |
Information computed with MobSF.
High | Broadcast Receiver (com.samsung.android.video.common.spage.VideoCardProvider) is not Protected.An intent-filter exists. A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported. |
High | TaskAffinity is set for Activity (com.samsung.android.video.player.activity.MoviePlayer) If taskAffinity is set, then other application could read the Intents sent to Activities belonging to another task. Always use the default setting keeping the affinity as the package name in order to prevent sensitive information inside sent or received Intents from being read by another application. |
High | Activity (com.samsung.android.video.player.activity.SubtitleSetting) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
High | Activity (com.samsung.android.video.player.activity.SCoverPlayer) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
High | Activity (com.samsung.android.video.player.activity.SettingsActivity) is not Protected.An intent-filter exists. An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported. |
High | TaskAffinity is set for Activity (com.samsung.android.video.common.activity.RequestPlayerPermissionsActivity) If taskAffinity is set, then other application could read the Intents sent to Activities belonging to another task. Always use the default setting keeping the affinity as the package name in order to prevent sensitive information inside sent or received Intents from being read by another application. |
High | Activity (com.samsung.android.video.common.activity.RequestPlayerPickerActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
High | Activity (com.samsung.android.video.player.activity.SuperSlowActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
High | Activity (com.samsung.android.video.player.activity.GifPlayerActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
High | Activity (com.samsung.android.video.player.activity.GifPickerActivity) is not Protected. [android:exported=true] An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
High | Broadcast Receiver (com.samsung.android.video.player.receiver.SettingsResetReceiver) is Protected by a permission, but the protection level of the permission should be checked.Permission: com.sec.android.settings.permission.SOFT_RESET [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
High | Broadcast Receiver (com.samsung.android.video.player.receiver.ATTCommandReceiver) is Protected by a permission, but the protection level of the permission should be checked.Permission: com.sec.bcservice.permission.BCSERVICE [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
High | Broadcast Receiver (com.samsung.android.video.player.receiver.AutomotiveTestReciever) is Protected by a permission, but the protection level of the permission should be checked.Permission: com.samsung.android.video.AUTOMOTIVE_TESTprotectionLevel: normal [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission. However, the protection level of the permission is set to normal. This means that a malicious application can request and obtain the permission and interact with the component. If it was set to signature, only applications signed with the same certificate could obtain the permission. |
High | Broadcast Receiver (com.samsung.android.video.player.receiver.SideSyncReceiver) is not Protected. [android:exported=true] A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. |
High | Service (com.samsung.android.video.common.surface.vi.ViService) is Protected by a permission, but the protection level of the permission should be checked.Permission: com.samsung.android.video.VI_SERVICEprotectionLevel: normal [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission. However, the protection level of the permission is set to normal. This means that a malicious application can request and obtain the permission and interact with the component. If it was set to signature, only applications signed with the same certificate could obtain the permission. |
Low | Service (com.samsung.android.video.player.miniplayer.PopupPlayer) is Protected by a permission.Permission: com.samsung.android.video.POPUP_PLAYERprotectionLevel: signature[android:exported=true] A Service is found to be exported, but is protected by permission. |
High | Service (com.samsung.android.sdk.bixby.BixbyAppService) is Protected by a permission, but the protection level of the permission should be checked.Permission: com.samsung.android.bixby.agent.permission.APP_SERVICE [android:exported=true] A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. |
Information computed with MobSF.
com.samsung.android.video.player.activity.MoviePlayer |
Hosts: * Schemes: rtsp:// http:// sshttp:// https:// sphttp:// Mime types: application/sdp application/x-dtcp1 video/mp4 video/mpeg video/mpeg4 video/mp2p video/3gp video/3gpp video/3gpp2 video/x-ms-asf video/x-ms-wmv video/x-ms-wma video/x-m4v video/m4v video/webm video/flv video/x-flv video/mkv video/x-matroska video/divx video/avi video/skm video/sktm video/k3g video/ak3g video/x-msvideo video/rmf video/vnd.ms-playready.media.pyv video/mp2ts video/vnd.sdrm-media.sm4 application/Videos video/* application/x-mpegurl application/vnd.apple.mpegurl audio/x-mpegurl |
com.samsung.android.video.common.activity.RequestPlayerPickerActivity |
Schemes: samsungvideoplayer:// |
Information computed with AndroGuard.
|
Information computed with AndroGuard.
|
Information computed with AndroGuard.
|
Oldest file found in APK | Jan. 1, 2009, midnight |
Latest file found in APK | Jan. 1, 2009, midnight |
Certificate valid not before | June 22, 2011, 12:25 p.m. |
First submission on VT | April 26, 2021, 8:30 p.m. |
Last submission on VT | April 26, 2021, 8:30 p.m. |
Upload on Pithus | May 23, 2022, 10:36 p.m. |
Certificate valid not after | Nov. 7, 2038, 12:25 p.m. |
Score | 0/57 |
Report | https://www.virustotal.com/gui/file/bb9ebdfb53ee1852ec5bdd145348c5c9c603fe05bb644054ea6610963166449e/detection |
Information computed with MobSF.
FCS_RBG_EXT.1.1 | The application invoke platform-provided DRBG functionality for its cryptographic operations. Random Bit Generation Services |
FCS_STO_EXT.1.1 | The application does not store any credentials to non-volatile memory. Storage of Credentials |
FCS_CKM_EXT.1.1 | The application generate no asymmetric cryptographic keys. Cryptographic Key Generation Services |
FDP_DEC_EXT.1.1 | The application has access to ['bluetooth', 'NFC', 'network connectivity']. Access to Platform Resources |
FDP_DEC_EXT.1.2 | The application has access to no sensitive information repositories. Access to Platform Resources |
FDP_NET_EXT.1.1 | The application has user/application initiated network communications. Network Communications |
FDP_DAR_EXT.1.1 | The application does not encrypt files in non-volatile memory. Encryption Of Sensitive Application Data |
FMT_MEC_EXT.1.1 | The application invoke the mechanisms recommended by the platform vendor for storing and setting configuration options. Supported Configuration Mechanism |
FTP_DIT_EXT.1.1 | The application does encrypt some transmitted data with HTTPS/TLS/SSH between itself and another trusted IT product. Protection of Data in Transit |
FCS_RBG_EXT.2.1 FCS_RBG_EXT.2.2 |
The application perform all deterministic random bit generation (DRBG) services in accordance with NIST Special Publication 800-90A using Hash_DRBG. The deterministic RBG is seeded by an entropy source that accumulates entropy from a platform-based DRBG and a software-based noise source, with a minimum of 256 bits of entropy at least equal to the greatest security strength (according to NIST SP 800-57) of the keys and hashes that it will generate. Random Bit Generation from Application |
FCS_CKM.1.1(3) FCS_CKM.1.2(3) |
A password/passphrase shall perform [Password-based Key Derivation Functions] in accordance with a specified cryptographic algorithm.. Password Conditioning |
FCS_COP.1.1(2) | The application perform cryptographic hashing services not in accordance with FCS_COP.1.1(2) and uses the cryptographic algorithm RC2/RC4/MD4/MD5. Cryptographic Operation - Hashing |
FCS_HTTPS_EXT.1.1 | The application implement the HTTPS protocol that complies with RFC 2818. HTTPS Protocol |
FCS_HTTPS_EXT.1.2 | The application implement HTTPS using TLS. HTTPS Protocol |
FCS_HTTPS_EXT.1.3 | The application notify the user and not establish the connection or request application authorization to establish the connection if the peer certificate is deemed invalid. HTTPS Protocol |
FIA_X509_EXT.2.1 | The application use X.509v3 certificates as defined by RFC 5280 to support authentication for HTTPS , TLS. X.509 Certificate Authentication |
Information computed with MobSF.
Map computed by Pithus.
Information computed with MobSF.
Information computed with MobSF.
https://stg-api.di.atlas.samsung.com https://regi.di.atlas.samsung.com https://dc.di.atlas.samsung.com Defined in com/samsung/context/sdk/samsunganalytics/internal/connection/Domain.java |
|
https://stg-api.di.atlas.samsung.com https://regi.di.atlas.samsung.com https://dc.di.atlas.samsung.com Defined in com/samsung/context/sdk/samsunganalytics/internal/connection/Domain.java |
|
https://stg-api.di.atlas.samsung.com https://regi.di.atlas.samsung.com https://dc.di.atlas.samsung.com Defined in com/samsung/context/sdk/samsunganalytics/internal/connection/Domain.java |
|
https://vas.samsungapps.com/stub/stubUpdateCheck.as https://cn-ms.samsungapps.com/getCNVasURL.as Defined in com/samsung/android/video/common/galaxyapps/GalaxyAppsUtil.java |
|
https://vas.samsungapps.com/stub/stubUpdateCheck.as https://cn-ms.samsungapps.com/getCNVasURL.as Defined in com/samsung/android/video/common/galaxyapps/GalaxyAppsUtil.java |
|
https://cn-api.samsungcloud.com https://api.samsungcloud.com Defined in com/samsung/android/sdk/scloud/util/UrlUtil.java |
|
https://cn-api.samsungcloud.com https://api.samsungcloud.com Defined in com/samsung/android/sdk/scloud/util/UrlUtil.java |
Information computed with MobSF.
Information computed with Quark-Engine.
Confidence:
|
Load external class |
Confidence:
|
Run shell script programmably |
Confidence:
|
Implicit intent(view a web page, make a phone call, etc.) |
Confidence:
|
Find a method from given class name, usually for reflection |
Confidence:
|
Connect to a URL and receive input stream from the server |
Confidence:
|
Method reflection |
Confidence:
|
Monitor data identified by a given content URI changes(SMS, MMS, etc.) |
Confidence:
|
Load class from given class name |
Confidence:
|
Retrieve data from broadcast |
Confidence:
|
Read sensitive data(SMS, CALLLOG, etc) |
Confidence:
|
Open a file from given absolute path of the file |
Confidence:
|
Implicit intent(view a web page, make a phone call, etc.) via setData |
Confidence:
|
Connect to a URL and get the response code |
Confidence:
|
Monitor the broadcast action events (BOOT_COMPLETED) |
Confidence:
|
Monitor incoming call status |
Confidence:
|
Get absolute path of the file and store in string |
Confidence:
|
Get last known location of the device |
Confidence:
|
Get the current WIFI information |
Confidence:
|
Get location of the device |
Confidence:
|
Query the IMEI number |
Confidence:
|
Method reflection |
Confidence:
|
Query data from URI (SMS, CALLLOGS) |
Confidence:
|
Get the current WiFi IP address |
Confidence:
|
Get the time of current location |
Confidence:
|
Initialize class object dynamically |
Confidence:
|
Connect to a URL and set request method |
Confidence:
|
Get resource file from res/raw directory |
Confidence:
|
Write HTTP input stream into a file |
Confidence:
|
Send broadcast |
Confidence:
|
Modify voice volume |
Confidence:
|
Connect to a URL and read data from it |
Confidence:
|
Read file and put it into a stream |
Confidence:
|
Return dynamic information about the current Wi-Fi connection |
Confidence:
|
Get calendar information |
Confidence:
|
Check if the given file path exist |
Confidence:
|
Executes the specified string Linux command |
Confidence:
|
Read the input stream from given URL |
Information computed with MobSF.
Information computed by Pithus.