Pithus report for WifiProbe - ch.rontalnetz.wifiprobe

File sums

MD5	`6642b1b24fb16b60239b6105a22a5739`
SHA1	`775ba27a5127557ee72e313d8f6b9d29ae681446`
SHA256	`c733f9faa73ed2bbfaf3e91ffc5d5ab1dde5cb02192530566f131c669c317873`
Size	`5.07MB`

APKiD

Information computed with APKiD.

`/tmp/tmp3ejppewz!classes.dex`
anti_vm	`Build.FINGERPRINT check` `Build.MANUFACTURER check`
compiler	`r8 without marker (suspicious)`

SSdeep

Information computed with ssdeep.

APK file	`98304:1MHb0eKcL+iffr7kKts6arqqJkUDLIxTGcod0jdg7l+LWSvR:1MQR4+rOqLs6cjjC78SA`
Manifest	`96:sQIaVaUJff4Psjr/9o9Oh3EypuqdsGtAMeAMDI1wp0P0wVLMn9J9VT+VyT+kT+hn:b…`
`classes.dex`	`98304:1b+JdMbmhGz5PME3fbaZistK62T0se3GxFpNWGE1/xfD:FkGfz5uiskpNI/xr`

Dexofuzzy

Information computed with Dexofuzzy.

APK file	`6144:YmwpZSDXGC8RIDLNmCNYeTqLjFWbO3/4G3LLQsdsW5P/M:Ymw/2GC8aLNGGqLjFW…`
`classes.dex`	`6144:YmwpZSDXGC8RIDLNmCNYeTqLjFWbO3/4G3LLQsdsW5P/M:Ymw/2GC8aLNGGqLjFW…`

APK details

Information computed with AndroGuard and Pithus.

Package	`ch.rontalnetz.wifiprobe`
App name	`WifiProbe`
Version name	`2.0`
Version code	`2`
SDK	`26` - `31`
UAID	`609bcb11785dc347318ebb177d2960eb9be88c93`
Signature	Signature V2
Frosting	Not frosted Blocks found within V2 signature: `0x7109871a`: Unknown `0x504b4453`: Dependency metadata `0x42726577`: Verity padding

Certificate details

Information computed with AndroGuard.

MD5	`63eb88f714d4a2bbcee7808725277fba`
SHA1	`7b33e7e09febaedf11936f811076c54576b5ba2b`
SHA256	`02a7e3f7f098aaddbb351259d479ef10d31942c0ecb8e63dc39882adc0965776`
Issuer	`Common Name: Martin Koch, Organizational Unit: Private, Organization: Private, Locality: Lucerne, State/Province: Switzerland, Country: de_CH`
Not before	`2021-08-09T12:20:02+00:00`
Not after	`2046-08-03T12:20:02+00:00`

Manifest analysis

Information computed with MobSF.

Medium

Application Data can be Backed up[android:allowBackup=true]
This flag allows anyone to backup your application data via adb. It allows users who have enabled USB debugging to copy application data off of the device.

Main Activity

Information computed with AndroGuard.

ch.rontalnetz.wifiprobe.MainActivity

Activities

Information computed with AndroGuard.

ch.rontalnetz.wifiprobe.AboutActivity
com.google.android.gms.oss.licenses.OssLicensesMenuActivity
com.google.android.gms.oss.licenses.OssLicensesActivity
ch.rontalnetz.wifiprobe.utils.ConnectToConfiguredNetwork
ch.rontalnetz.wifiprobe.utils.ConnectToWifiActivity
ch.rontalnetz.wifiprobe.SettingsActivity
ch.rontalnetz.wifiprobe.MainActivity
com.google.android.gms.common.api.GoogleApiActivity

Sample timeline

Oldest file found in APK	Jan. 1, 1981, 1:01 a.m.
Latest file found in APK	Jan. 1, 1981, 1:01 a.m.
Certificate valid not before	Aug. 9, 2021, 12:20 p.m.
First submission on VT	Jan. 9, 2022, 6:26 p.m.
Last submission on VT	Jan. 11, 2022, 6:58 p.m.
Upload on Pithus	Jan. 12, 2022, 1:35 p.m.
Certificate valid not after	Aug. 3, 2046, 12:20 p.m.

VirusTotal

Score	0/61
Report	https://www.virustotal.com/gui/file/c733f9faa73ed2bbfaf3e91ffc5d5ab1dde5cb02192530566f131c669c317873/detection

NIAP analysis

Information computed with MobSF.

FCS_RBG_EXT.1.1	The application use no DRBG functionality for its cryptographic operations. Random Bit Generation Services
FCS_STO_EXT.1.1	The application does not store any credentials to non-volatile memory. Storage of Credentials
FCS_CKM_EXT.1.1	The application generate no asymmetric cryptographic keys. Cryptographic Key Generation Services
FDP_DEC_EXT.1.1	The application has access to ['location', 'network connectivity']. Access to Platform Resources
FDP_DEC_EXT.1.2	The application has access to no sensitive information repositories. Access to Platform Resources
FDP_NET_EXT.1.1	The application has user/application initiated network communications. Network Communications
FDP_DAR_EXT.1.1	The application implement functionality to encrypt sensitive data in non-volatile memory. Encryption Of Sensitive Application Data
FMT_MEC_EXT.1.1	The application invoke the mechanisms recommended by the platform vendor for storing and setting configuration options. Supported Configuration Mechanism
FTP_DIT_EXT.1.1	The application does encrypt some transmitted data with HTTPS/TLS/SSH between itself and another trusted IT product. Protection of Data in Transit

Code analysis

Information computed with MobSF.

Low
CVSS:7.5

The App logs information. Sensitive information should never be logged.
MASVS: MSTG-STORAGE-3
CWE-532 Insertion of Sensitive Information into Log File

Files:

 kotlinx/coroutines/debug/AgentPremain.java
 kotlin/io/ConsoleKt.java

High
CVSS:7.5

The App uses an insecure Random Number Generator.
MASVS: MSTG-CRYPTO-6
CWE-330 Use of Insufficiently Random Values
M5: Insufficient Cryptography

Files:

 kotlin/collections/EmptyList.java
 kotlin/random/AbstractPlatformRandom.java
 kotlin/collections/unsigned/UArraysKt___UArraysJvmKt$asList$4.java
 kotlin/collections/unsigned/UArraysKt___UArraysJvmKt$asList$1.java
 kotlin/collections/ArraysKt___ArraysJvmKt$asList$6.java
 kotlin/collections/ArraysKt___ArraysJvmKt$asList$3.java
 kotlin/random/KotlinRandom.java
 kotlin/collections/AbstractList.java
 kotlin/collections/RingBuffer.java
 kotlin/random/PlatformRandomKt.java
 kotlin/collections/ArraysKt___ArraysJvmKt$asList$7.java
 kotlin/collections/CollectionsKt__CollectionsJVMKt.java
 kotlin/collections/ArraysKt___ArraysJvmKt$asList$1.java
 kotlin/collections/unsigned/UArraysKt___UArraysJvmKt$asList$2.java
 kotlin/random/jdk8/PlatformThreadLocalRandom.java
 kotlin/collections/ArraysKt___ArraysJvmKt$asList$4.java
 kotlin/collections/builders/ListBuilder.java
 kotlin/collections/CollectionsKt___CollectionsKt.java
 kotlin/random/FallbackThreadLocalRandom.java
 kotlin/collections/MovingSubList.java
 kotlin/collections/ArraysKt___ArraysJvmKt$asList$2.java
 kotlin/collections/unsigned/UArraysKt___UArraysJvmKt$asList$3.java
 kotlin/collections/CollectionsKt__MutableCollectionsJVMKt.java
 kotlin/random/FallbackThreadLocalRandom$implStorage$1.java
 kotlin/random/PlatformRandom.java
 kotlin/collections/ArraysKt___ArraysJvmKt$asList$5.java
 kotlin/collections/ArraysKt___ArraysJvmKt$asList$8.java
 kotlin/collections/CollectionsKt__MutableCollectionsKt.java

High
CVSS:5.5

App creates temp file. Sensitive information should never be written into a temp file.
MASVS: MSTG-STORAGE-2
CWE-276 Incorrect Default Permissions
M2: Insecure Data Storage

Files:

 kotlin/io/path/PathsKt__PathUtilsKt.java
 kotlin/io/FilesKt__UtilsKt.java

Map computed by Pithus.

Domains analysis

Information computed with MobSF.

US	`www.apache.org`		`151.101.2.132`
US	`opensource.org`		`159.65.34.8`

URL analysis

Information computed with MobSF.

`https://www.apache.org/licenses/LICENSE-2.0.txt` `https://opensource.org/licenses/mit-license.php` Defined in `Android String Resource`
`https://www.apache.org/licenses/LICENSE-2.0.txt` `https://opensource.org/licenses/mit-license.php` Defined in `Android String Resource`

Permissions analysis

Information computed with MobSF.

High	`android.permission.ACCESS_COARSE_LOCATION`	coarse (network-based) location Access coarse location sources, such as the mobile network database, to determine an approximate phone location, where available. Malicious applications can use this to determine approximately where you are.
High	`android.permission.ACCESS_FINE_LOCATION`	fine (GPS) location Access fine location sources, such as the Global Positioning System on the phone, where available. Malicious applications can use this to determine where you are and may consume additional battery power.
Low	`android.permission.ACCESS_WIFI_STATE`	view Wi-Fi status Allows an application to view the information about the status of Wi-Fi.
Low	`android.permission.INTERNET`	full Internet access Allows an application to create network sockets.
Low	`android.permission.CHANGE_WIFI_STATE`	change Wi-Fi status Allows an application to connect to and disconnect from Wi-Fi access points and to make changes to configured Wi-Fi networks.
Low	`android.permission.ACCESS_NETWORK_STATE`	view network status Allows an application to view the status of all networks.
	`android.Manifest.permission.NETWORK_SETTINGS`	Unknown permission Unknown permission from android reference

Threat analysis

Information computed with Quark-Engine.

Confidence: 100%	Load external class
Confidence: 100%	Find a method from given class name, usually for reflection
Confidence: 100%	Method reflection
Confidence: 100%	Load class from given class name
Confidence: 100%	Retrieve data from broadcast
Confidence: 100%	Read sensitive data(SMS, CALLLOG, etc)
Confidence: 100%	Implicit intent(view a web page, make a phone call, etc.) via setData
Confidence: 100%	Monitor the broadcast action events (BOOT_COMPLETED)
Confidence: 100%	Read file from assets directory
Confidence: 100%	Get last known location of the device
Confidence: 100%	Get location of the device
Confidence: 100%	Method reflection
Confidence: 100%	Query data from URI (SMS, CALLLOGS)
Confidence: 100%	Get the time of current location
Confidence: 100%	Initialize class object dynamically
Confidence: 100%	Connect to the specific WIFI network
Confidence: 100%	Get specific method from other Dex files
Confidence: 80%	Start another application from current application
Confidence: 80%	Read file and put it into a stream
Confidence: 80%	Get declared method from given method name
Confidence: 80%	Get resource file from res/raw directory

Behavior analysis

Information computed with MobSF.

Get system service

       ch/rontalnetz/wifiprobe/scan/Scanner.java
       ch/rontalnetz/wifiprobe/utils/ConnectToConfiguredNetwork.java
       ch/rontalnetz/wifiprobe/utils/ConnectToWifiActivity.java

Get wifi details

       ch/rontalnetz/wifiprobe/scan/Scanner.java
       ch/rontalnetz/wifiprobe/utils/ConnectToConfiguredNetwork.java
       ch/rontalnetz/wifiprobe/utils/ConnectToWifiActivity.java

Inter process communication

       ch/rontalnetz/wifiprobe/scan/Scanner$wifiScanReceiver$1.java
       ch/rontalnetz/wifiprobe/scan/Scanner.java
       ch/rontalnetz/wifiprobe/RecyclerAdapterWifiItems.java
       ch/rontalnetz/wifiprobe/AboutActivity.java
       ch/rontalnetz/wifiprobe/MainActivity.java
       ch/rontalnetz/wifiprobe/utils/ConnectToWifiActivity$connectWifiGtEqQ$broadcastReceiver$1.java
       ch/rontalnetz/wifiprobe/utils/ConnectToWifiActivity.java
       ch/rontalnetz/wifiprobe/scan/Scanner$startScan$1.java

Java reflection

       kotlin/internal/PlatformImplementations.java
       kotlinx/coroutines/debug/internal/DebugProbesImpl.java
       kotlinx/coroutines/internal/ConcurrentKt.java
       kotlin/coroutines/jvm/internal/DebugMetadataKt.java
       kotlinx/coroutines/internal/StackTraceRecoveryKt.java
       kotlinx/coroutines/internal/FastServiceLoader.java
       kotlin/internal/PlatformImplementationsKt.java
       kotlinx/coroutines/internal/FastServiceLoaderKt.java
       kotlin/coroutines/jvm/internal/ModuleNameRetriever.java
       kotlinx/coroutines/CommonPool.java
       kotlin/jvm/internal/Intrinsics.java
       kotlin/jvm/internal/Reflection.java
       kotlinx/coroutines/android/AndroidExceptionPreHandler.java
       kotlinx/coroutines/internal/ExceptionsConstuctorKt.java
       kotlin/jvm/internal/ClassReference.java

Starting activity

       ch/rontalnetz/wifiprobe/RecyclerAdapterWifiItems.java
       ch/rontalnetz/wifiprobe/AboutActivity.java
       ch/rontalnetz/wifiprobe/MainActivity.java
       ch/rontalnetz/wifiprobe/scan/Scanner$startScan$1.java