× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 8088de1bec8d9523902c131e768756138d2c83bab71aaecf2af7923130c1b2cf
File name: install.apk
Detection ratio: 14 / 46
Analysis date: 2013-02-16 15:55:59 UTC ( 1 year, 2 months ago ) View latest
Antivirus Result Update
Avast Android:SMSAgent-EG [Trj] 20130216
CAT-QuickHeal Android.Agentsms.HJ1bcb 20130215
Comodo UnclassifiedMalware 20130216
DrWeb Android.SmsSend.313.origin 20130214
ESET-NOD32 a variant of Android/TrojanSMS.Agent.HJ 20130216
GData Android:SMSAgent-EG 20130216
Ikarus AndroidOS.Trojan.SMSAgent 20130216
Kaspersky HEUR:Trojan-SMS.AndroidOS.Agent.u 20130216
Kingsoft Android.Troj.Jifake.a.(kcloud) 20130204
NANO-Antivirus Trojan.Agent.bfvnvg 20130216
PCTools Trojan.Gen 20130216
Sophos Andr/FakeIns-B 20130216
Symantec Trojan.Gen.2 20130216
TrendMicro-HouseCall TROJ_GEN.RCBH1AD 20130216
AVG 20130216
Agnitum 20130216
AhnLab-V3 20130216
AntiVir 20130216
Antiy-AVL 20130216
BitDefender 20130216
ByteHero 20130215
ClamAV 20130216
Commtouch 20130216
Emsisoft 20130216
F-Prot 20130216
F-Secure 20130216
Fortinet 20130216
Jiangmin 20130216
K7AntiVirus 20130216
Malwarebytes 20130216
McAfee 20130216
McAfee-GW-Edition 20130216
MicroWorld-eScan 20130216
Microsoft 20130216
Norman 20130215
Panda 20130216
Rising 20130205
SUPERAntiSpyware 20130216
TheHacker 20130215
TotalDefense 20130215
TrendMicro 20130216
VBA32 20130215
VIPRE 20130216
ViRobot 20130216
eSafe 20130211
nProtect 20130216
The file being studied is Android related! APK Android file more specifically. The application's main package name is install.app. The internal version number of the application is 15. The displayed version string of the application is 15.3. The minimum Android API level for the application to run (MinSDKVersion) is 4. The target Android API level for the application to run (TargetSDKVersion) is 15.
Risk summary
The studied DEX file makes use of API reflection
Permissions that allow the application to manipulate SMS
Permissions that allow the application to perform calls
Permissions that allow the application to perform payments
Permissions that allow the application to access Internet
Permissions that allow the application to access private information
Other permissions that could be considered as dangerous in certain scenarios
Required permissions
android.permission.SEND_SMS (send SMS messages)
android.permission.DISABLE_KEYGUARD (disable key lock)
android.permission.RECEIVE_BOOT_COMPLETED (automatically start at boot)
android.permission.INTERNET (full Internet access)
android.permission.INSTALL_PACKAGES (directly install applications)
android.permission.SYSTEM_ALERT_WINDOW (display system-level alerts)
android.permission.KILL_BACKGROUND_PROCESSES (kill background processes)
android.permission.READ_LOGS (read sensitive log data)
android.permission.ACCESS_NETWORK_STATE (view network status)
android.permission.CALL_PRIVILEGED (directly call any phone numbers)
android.permission.GET_TASKS (retrieve running applications)
android.permission.CALL_PHONE (directly call phone numbers)
android.permission.DELETE_PACKAGES (delete applications)
android.permission.RECEIVE_SMS (receive SMS)
android.permission.READ_PHONE_STATE (read phone state and identity)
com.android.launcher.permission.INSTALL_SHORTCUT (Unknown permission from android reference)
android.permission.RESTART_PACKAGES (kill background processes)
android.permission.WRITE_EXTERNAL_STORAGE (modify/delete SD card contents)
android.permission.READ_CONTACTS (read contact data)
Permission-related API calls
ACCESS_NETWORK_STATE
RESTART_PACKAGES
INTERNET
SEND_SMS
VIBRATE
READ_LOGS
READ_PHONE_STATE
Main Activity
install.app.MainActivity
Activities
install.app.MainActivity
Services
install.app.MainService
ru.beta.MainService
Receivers
install.app.MainReceiver
ru.beta.MainReceiver
Activity-related intent filters
install.app.MainActivity
actions: android.intent.action.MAIN
categories: android.intent.category.LAUNCHER
Receiver-related intent filters
ru.beta.MainReceiver
actions: custom.alarm, android.intent.action.BOOT_COMPLETED, android.intent.action.USER_PRESENT, android.intent.action.PHONE_STATE, android.intent.action.SCREEN_OFF, android.intent.action.SCREEN_ON
install.app.MainReceiver
actions: custom.timer.wait, custom.timer.send, custom.timer.kill, android.provider.Telephony.SMS_RECEIVED, android.intent.action.BOOT_COMPLETED
Code-related observations
The application does not load any code dynamically
The application contains reflection code
The application does not contain native code
The application does not contain cryptographic code
Application certificate information
Application bundle files
Interesting strings
Compressed bundles
File identification
MD5 5d9c622b240dab5d6e883e26e9ea0fc0
SHA1 355d6ffa3a6449175e950db333ef1904964c73f0
SHA256 8088de1bec8d9523902c131e768756138d2c83bab71aaecf2af7923130c1b2cf
ssdeep
6144:QW3mFFYxt06SoxYzAOYsNdmhEwutLgn6WRrLHapCvaVJM+:Q5F2xt06SoqzAOYsihEbLeTYLt

File size 255.7 KB ( 261887 bytes )
File type Android
Magic literal
Zip archive data, at least v2.0 to extract

TrID Android Package (73.9%)
Java Archive (20.4%)
ZIP compressed archive (5.6%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
Tags
apk android ext-prg zip

VirusTotal metadata
First submission 2013-01-12 15:30:09 UTC ( 1 year, 3 months ago )
Last submission 2014-04-02 04:21:30 UTC ( 2 weeks, 4 days ago )
File names Recent45.apk
5d9c622b240dab5d6e883e26e9ea0fc0.virus
5d9c622b240dab5d6e883e26e9ea0fc0.apk.log
install.apk
file-5003694_apk
Recent45.apk
5d9c622b240dab5d6e883e26e9ea0fc0.log
instll.apk
install.apk
N133.apk
test.txt
ExifTool file metadata
MIMEType
application/zip

ZipRequiredVersion
20

ZipCRC
0x65b1ca65

FileType
ZIP

ZipCompression
Deflated

ZipUncompressedSize
1334

ZipCompressedSize
667

FileAccessDate
2014:04:02 05:20:51+01:00

ZipFileName
META-INF/MANIFEST.MF

ZipBitFlag
0x0008

FileCreateDate
2014:04:02 05:20:51+01:00

ZipModifyDate
2013:01:11 15:55:01

No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Started services
#Intent;component=install.app/ru.beta.MainService;S.key=logs;end
#Intent;component=install.app/.MainService;S.key=pay;end
#Intent;component=install.app/.MainService;S.key=logs;end
External programs launched
logcat ActivityManager:I
Opened files
/res/raw/data.db
Interesting calls
Calls APIs that provide access to information about the telephony services on the device. Applications can use such methods to determine telephony services and states, as well as to access some types of subscriber information.
Calls APIs that manage SMS operations such as sending data, text, and pdu SMS messages.
Contacted URLs
http://mobihot.be/midlets/ins/?imei=468243943352280&imsi=298854470072077&appid=1058&phone=15555215554&country=us&model=Nexus S&manufacturer=samsung&sdk=15&flow_id=226