Analysis Report com.mobistartapp.win7imulator.apk

Overview

General Information

Joe Sandbox Version:	25.0.0 Tiger's Eye
Analysis ID:	752653
Start date:	03.01.2019
Start time:	15:03:57
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	com.mobistartapp.win7imulator.apk
Cookbook file name:	defaultandroidfilecookbook.jbs
Analysis system description:	Android 8.1 Oreo
Detection:	MAL
Classification:	mal52.spyw.evad.andAPK@0/253@4/0
Warnings:	Show All Not all executed log events are in report (maximum 10 identical API calls) Not all resource files were parsed Not all resource strings were parsed Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing dynamic data code.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	52	0 - 100	Report FP / FN	false

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Mitre Att&ck Matrix

Signature Similarity

Sample Distance (10 = nearest)

10 9 8 7 6 5 4 3 2 1

Similar Samples

SHA256	Analysis ID	Samplename	Similarity

Signature Overview

Click to jump to signature section

Location Tracing:

Queries the phones location (GPS)

Show sources

Source: com.mobistartapp.win7imulator.services.ServiceRegisterLocation$1;->a:7	API Call: android.location.Location.getLatitude
Source: com.mobistartapp.win7imulator.services.ServiceRegisterLocation$1;->a:11	API Call: android.location.Location.getLongitude
Source: com.mobistartapp.win7imulator.services.ServiceRegisterLocation$1;->a:21	API Call: android.location.Location.getLatitude
Source: com.mobistartapp.win7imulator.services.ServiceRegisterLocation$1;->a:31	API Call: android.location.Location.getLongitude
Source: com.mobistartapp.win7imulator.services.ServiceRegisterTrack$1;->a:7	API Call: android.location.Location.getLatitude
Source: com.mobistartapp.win7imulator.services.ServiceRegisterTrack$1;->a:11	API Call: android.location.Location.getLongitude
Source: com.mobistartapp.win7imulator.services.ServiceRegisterTrack$1;->a:21	API Call: android.location.Location.getLatitude
Source: com.mobistartapp.win7imulator.services.ServiceRegisterTrack$1;->a:31	API Call: android.location.Location.getLongitude
Source: com.startapp.android.publish.i.m;->a:7	API Call: android.location.Location.getLongitude
Source: com.startapp.android.publish.i.m;->a:14	API Call: android.location.Location.getLatitude
Source: com.startapp.android.publish.i.m;->a:53	API Call: android.location.LocationManager.getLastKnownLocation
Source: com.google.android.gms.internal.zzabt;->zza:777	API Call: android.location.Location.getLatitude
Source: com.google.android.gms.internal.zzabt;->zza:779	API Call: android.location.Location.getLongitude
Source: com.startapp.android.publish.model.BaseRequest;->fillCellLocationDetails:11	API Call: android.telephony.TelephonyManager.getCellLocation

Exploits:

Might use exploit to break dedexer tools

Show sources

Source: com.mobistartapp.win7imulator.apk

Code Location: Lcom/startapp/android/publish/banner/banner3d/a;.a()V

Spreading:

Accesses external storage location

Show sources

Source: com.mobistartapp.win7imulator.a.a;->a:19	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.mobistartapp.win7imulator.a.b;->a:111	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.mobistartapp.win7imulator.activities.MainActivity;->a:28	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.mobistartapp.win7imulator.activities.MainActivity;->onCreate:493	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.mobistartapp.win7imulator.b.a;->a:117	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.mobistartapp.win7imulator.b.b;->a:78	API Call: android.os.Environment.getExternalStorageState
Source: com.mobistartapp.win7imulator.b.b;->b:87	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.mobistartapp.win7imulator.b.b;->d:100	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.mobistartapp.win7imulator.b.b;->e:110	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.mobistartapp.win7imulator.b.c;->c:184	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.facebook.ads.internal.k.b.o;->a:4	API Call: android.os.Environment.getExternalStorageState
Source: com.facebook.ads.internal.k.b.o;->b:28	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.startapp.android.publish.i.r;->a:2	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.google.android.gms.internal.zzma;->call:3	API Call: android.os.Environment.getExternalStorageState
Source: com.google.android.gms.internal.zzmr;-><init>:13	API Call: android.os.Environment.getExternalStorageDirectory

Networking:

Checks an internet connection is available

Show sources

Source: com.mobistartapp.win7imulator.b.a;->i:1561	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.mobistartapp.win7imulator.b.a;->i:1562	API Call: android.net.NetworkInfo.isConnected
Source: com.google.firebase.iid.FirebaseInstanceIdService;->c:103	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.google.firebase.iid.FirebaseInstanceIdService;->c:104	API Call: android.net.NetworkInfo.isConnected
Source: com.google.android.gms.internal.zzcgl;->zzzc:1236	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.google.android.gms.internal.zzcgl;->zzzc:1236	API Call: android.net.NetworkInfo.isConnected
Source: com.google.android.gms.internal.zzcgl;->zzza:2663	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.google.android.gms.internal.zzcgl;->zzza:2663	API Call: android.net.NetworkInfo.isConnected
Source: com.google.android.gms.internal.zzcgl;->zzb:2140	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.google.android.gms.internal.zzcgl;->zzb:2140	API Call: android.net.NetworkInfo.isConnected
Source: com.mobistartapp.win7imulator.services.NetworkChangeReceiverList;->onReceive:446	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: com.mobistartapp.win7imulator.services.NetworkChangeReceiverList;->onReceive:447	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: com.mobistartapp.win7imulator.services.NetworkChangeReceiverList;->onReceive:451	API Call: android.net.NetworkInfo.isAvailable
Source: com.mobistartapp.win7imulator.b.a;->m:1611	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.mobistartapp.win7imulator.b.a;->m:1614	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.mobistartapp.win7imulator.b.a;->n:1625	API Call: android.net.wifi.WifiManager.isWifiEnabled
Source: com.mobistartapp.win7imulator.b.a;->n:1626	API Call: android.net.wifi.WifiManager.getConnectionInfo
Source: com.mobistartapp.win7imulator.services.NetworkChangeReceiverList;->onReceive:452	API Call: android.net.NetworkInfo.isAvailable
Source: com.facebook.ads.internal.l.a.a;->c:88	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.facebook.ads.internal.l.a.a;->c:89	API Call: android.net.NetworkInfo.isConnected
Source: com.facebook.ads.internal.g.a;->c:40	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.facebook.ads.internal.g.a;->c:41	API Call: android.net.NetworkInfo.isConnectedOrConnecting
Source: com.startapp.android.publish.i.p;->b:80	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.startapp.android.publish.i.p;->b:81	API Call: android.net.NetworkInfo.isConnected
Source: com.startapp.android.publish.i.p;->c:105	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.startapp.android.publish.i.p;->c:106	API Call: android.net.NetworkInfo.isConnected
Source: com.startapp.android.publish.i.p;->c:114	API Call: android.net.wifi.WifiManager.getConnectionInfo
Source: com.startapp.android.publish.i.x;->a:575	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.startapp.android.publish.i.x;->a:576	API Call: android.net.NetworkInfo.isConnected
Source: com.facebook.ads.internal.i.e;->d:24	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.facebook.ads.internal.i.e;->d:25	API Call: android.net.NetworkInfo.isConnectedOrConnecting
Source: com.google.android.gms.internal.acf;->zze:70	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.google.android.gms.internal.acf;->zze:71	API Call: android.net.NetworkInfo.isConnected
Source: com.google.android.gms.internal.zzabm;->zza:61	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.google.android.gms.internal.zzacc;->zzl:87	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.google.android.gms.internal.zzacc;->zzl:89	API Call: android.net.NetworkInfo.getDetailedState
Source: com.google.android.gms.internal.zzcfp;->zzlQ:32	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.google.android.gms.internal.zzcfp;->zzlQ:33	API Call: android.net.NetworkInfo.isConnected
Source: com.startapp.android.publish.model.BaseRequest;->fillWifiDetails:44	API Call: android.net.wifi.WifiManager.getConnectionInfo

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.35
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.207.132

Opens an internet connection

Show sources

Source: com.mobistartapp.win7imulator.b.a;->i:1564	API Call: java.net.URL.openConnection("http://www.google.com")
Source: com.oneaudience.sdk.n;->b:89	API Call: java.net.URL.openConnection("https://api.oneaudience.com/api/devices")
Source: com.google.android.gms.internal.zzcft;->run:8	API Call: java.net.URL.openConnection("https://app-measurement.com/config/app/1%3A315538004582%3Aandroid%3Ae50792d558411d03?app_instance_id=98bb1d23afcb451a051adfd649819135&platform=android&gmp_version=11020")
Source: com.google.android.gms.internal.zzcft;->run:8	API Call: java.net.URL.openConnection("https://app-measurement.com/a")
Source: com.mobistartapp.win7imulator.a.e;->a:182	API Call: java.net.URL.openConnection("http://www.mobistartapp.com/fcm_server_php/windows7_simulator/fcm_register.php")
Source: com.mobistartapp.win7imulator.a.a;->a:10	API Call: java.net.URL.openConnection (not executed)
Source: com.mobistartapp.win7imulator.a.b;->a:72	API Call: java.net.URL.openConnection (not executed)
Source: com.mobistartapp.win7imulator.a.f;->a:230	API Call: java.net.URL.openConnection (not executed)
Source: com.mobistartapp.win7imulator.a.i;->a:39	API Call: java.net.URL.openConnection (not executed)
Source: com.mobistartapp.win7imulator.a.j;->a:125	API Call: java.net.URL.openConnection (not executed)
Source: com.mobistartapp.win7imulator.b.a;->a:177	API Call: java.net.URL.openConnection (not executed)
Source: com.mobistartapp.win7imulator.b.d;->a:3	API Call: java.net.URL.openConnection (not executed)
Source: com.mobistartapp.win7imulator.services.NetworkChangeReceiverList;->a:341	API Call: java.net.URL.openConnection (not executed)
Source: com.mobistartapp.win7imulator.services.ServiceUploadCheckLoopList;->a:286	API Call: java.net.URL.openConnection (not executed)
Source: com.facebook.ads.internal.k.a.f;->a:6	API Call: java.net.URL.openConnection (not executed)
Source: com.facebook.ads.internal.k.b.h;->a:26	API Call: java.net.URL.openConnection (not executed)
Source: com.google.android.exoplayer2.i.m;->a:52	API Call: java.net.URL.openConnection (not executed)
Source: com.startapp.android.publish.i.h;->a:2	API Call: java.net.URL.openConnection (not executed)
Source: com.startapp.android.publish.i.p;->a:5	API Call: java.net.URL.openConnection (not executed)
Source: com.google.android.gms.ads.identifier.zza;->run:5	API Call: java.net.URL.openConnection (not executed)
Source: com.google.android.gms.internal.zzabm;->zza:177	API Call: java.net.URL.openConnection (not executed)
Source: com.google.android.gms.internal.zzajd;->zzaN:9	API Call: java.net.URL.openConnection (not executed)
Source: com.google.android.gms.internal.zzajo;->zzb:3	API Call: java.net.URL.openConnection (not executed)
Source: com.google.android.gms.internal.zzakb;->shouldInterceptRequest:187	API Call: java.net.URL.openConnection (not executed)
Source: com.google.android.gms.internal.zzao;->zza:38	API Call: java.net.URL.openConnection (not executed)
Source: com.google.android.gms.internal.zzre;->zza:3	API Call: java.net.URL.openConnection (not executed)

Performs DNS lookups (Java API)

Show sources

Source: com.mobistartapp.win7imulator.a.h;->a:26	API Call: java.net.InetAddress.getByName (not executed)
Source: com.mobistartapp.win7imulator.services.ServiceDDSLoiic$a;->a:58	API Call: java.net.InetAddress.getByName (not executed)
Source: com.facebook.ads.internal.k.b.f;-><init>:10	API Call: java.net.InetAddress.getByName (not executed)

Scans for WIFI networks

Show sources

Source: com.startapp.android.publish.i.b;->a:30

API Call: android.net.wifi.WifiManager.getScanResults

Downloads files from webservers via HTTP

Show sources

Source: global traffic

HTTP traffic detected: GET //Win7Simulator/settings_win7simulator.xml HTTP/1.1User-Agent: Dalvik/2.1.0 (Linux; U; Android 8.1.0; VirtualBox Build/OPM8.181005.003)Host: www.mobistartapp.comConnection: Keep-AliveAccept-Encoding: gzip

Found strings which match to known social media urls

Show sources

Source: android	String found in binary or memory: Can\'t get Facebook Access Token equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: Can\'t get Json From Facebook get Code: %d equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: DCIM/Facebook equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: Error getting facebook Json equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: Facebook Ads SDK delivery response Error message equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: Facebook Ads SDK request for ads failed equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: Facebook Ads SDK request for ads timed out equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: Facebook Ads SDK returned no ad placements equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: Failed to parse Facebook Ads SDK delivery response equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: Unknown Facebook Ads SDK delivery response type equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: YAHOO equals www.yahoo.com (Yahoo)
Source: android	String found in binary or memory: Youtube ApplicationInForeground schedule service after equals www.youtube.com (Youtube)
Source: android	String found in binary or memory: com.facebook.AccessToken equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads thread-%d %tF %<tT equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.FEATURE_CONFIG equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.SERVER equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.interstitial.clicked equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.interstitial.clicked: equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.interstitial.dismissed equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.interstitial.dismissed: equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.interstitial.displayed equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.interstitial.displayed: equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.interstitial.error equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.interstitial.error: equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.interstitial.impression.logged equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.interstitial.impression.logged: equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.rewarded_video.ad_click equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.rewarded_video.ad_impression equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.rewarded_video.closed equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.rewarded_video.completed equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.rewarded_video.completed.without.reward equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.rewarded_video.error equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.rewarded_video.server_reward_failed equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.ads.rewarded_video.server_reward_success equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.katana equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.facebook.lite equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: com.google.android.youtube equals www.youtube.com (Youtube)
Source: android	String found in binary or memory: content://com.facebook.katana.provider.AttributionIdProvider equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: facebook equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: facebook.com equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: http://www.facebook.com equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: http://www.facebook.vom/Windows7Simulator equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: http://www.youtube.com/watch?v= equals www.youtube.com (Youtube)
Source: android	String found in binary or memory: https://graph.%s.facebook.com/network_ads_common equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: https://graph.facebook.com/network_ads_common equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: https://graph.facebook.com/v2.5/me equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: https://www.%s.facebook.com equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: https://www.%s.facebook.com/adnw_logging/ equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: https://www.%s.facebook.com/audience_network/server_side_reward equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: https://www.facebook.com/adnw_logging/ equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: https://www.facebook.com/audience_network/server_side_reward equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: https://www.youtube.com/watch?v= equals www.youtube.com (Youtube)
Source: android	String found in binary or memory: twitter equals www.twitter.com (Twitter)
Source: android	String found in binary or memory: twitter.com equals www.twitter.com (Twitter)
Source: android	String found in binary or memory: youtube equals www.youtube.com (Youtube)
Source: android	String found in binary or memory: {"packageNames":"com.android.storagemanager,com.android.printspooler,com.google.android.setupwizard,com.android.bluetoothmidiservice,com.android.defcontainer,com.example.android.notepad,com.android.carrierconfig,com.google.android.webview,com.android.dialer,com.android.phone,com.android.pacprocessor,com.android.egg,com.android.mms.service,com.google.android.packageinstaller,com.google.android.printservice.recommendation,com.android.captiveportallogin,com.android.inputdevices,com.android.calllogbackup,com.google.android.syncadapters.calendar,com.android.providers.partnerbookmarks,com.android.wallpaper.livepicker,com.android.providers.calendar,com.android.contacts,com.android.providers.telephony,com.google.android.partnersetup,com.android.deskclock,com.android.externalstorage,com.android.vending,com.google.android.ext.shared,com.android.keychain,com.android.gallery3d,com.android.wallpaperbackup,com.android.chrome,com.android.cts.ctsshim,com.android.providers.contacts,com.android.managedprovisioning,com.android.m

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: www.mobistartapp.com

Posts data to webserver

Show sources

Source: unknown

HTTP traffic detected: POST /fcm_server_php/windows7_simulator/fcm_register.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Dalvik/2.1.0 (Linux; U; Android 8.1.0; VirtualBox Build/OPM8.181005.003)Host: www.mobistartapp.comConnection: Keep-AliveAccept-Encoding: gzipContent-Length: 654Data Raw: 75 73 65 72 5f 6c 61 6e 67 3d 45 4e 26 75 73 65 72 5f 63 6f 75 6e 74 72 79 3d 26 75 73 65 72 5f 65 6d 61 69 6c 3d 70 65 72 6d 69 73 69 6f 6e 5f 6e 6f 74 5f 67 72 61 6e 74 65 64 25 34 30 65 6d 61 69 6c 2e 63 6f 6d 26 72 65 67 49 64 3d 65 67 30 43 35 43 74 56 58 39 30 25 33 41 41 50 41 39 31 62 48 6b 53 5f 44 4f 35 6f 62 6b 67 4c 35 65 5a 4f 6c 37 55 63 46 2d 71 37 74 70 68 69 4e 4e 64 79 56 6e 52 71 36 4d 75 74 42 6f 39 51 52 33 5f 39 32 6e 50 38 69 79 53 43 39 44 4a 46 4c 61 62 70 54 35 66 71 72 47 48 73 58 61 32 46 41 74 43 79 42 4d 50 36 53 67 44 73 4d 30 39 4f 4f 6e 64 58 5a 5f 73 39 4b 5a 53 68 45 30 34 65 4b 6f 41 45 63 52 51 5f 30 4f 71 75 6a 38 2d 5f 36 6c 58 6c 72 59 72 36 39 6d 26 61 70 70 5f 70 61

Urls found in memory or binary data

Show sources

Source: android	String found in binary or memory: http://d1byvlfiet2h9q.cloudfront.net/InApp/resources/adInformationDialog3.html
Source: android	String found in binary or memory: http://engadget.search.aol.com/search?q=%s
Source: android	String found in binary or memory: http://play.google.com
Source: android	String found in binary or memory: http://play.google.com/store/apps/
Source: android	String found in binary or memory: http://robocop.oneaudience.com/reporterror
Source: avd_show_password.xml	String found in binary or memory: http://schemas.android.com/aapt
Source: webview_blank_layout.xml	String found in binary or memory: http://schemas.android.com/apk/lib/com.google.ads
Source: abc_tint_seek_thumb.xml, layout_permissions.xml	String found in binary or memory: http://schemas.android.com/apk/res-auto
Source: abc_action_menu_layout.xml	String found in binary or memory: http://schemas.android.com/apk/res-auto((android.support.v7.widget.ActionMenuView
Source: abc_screen_toolbar.xml	String found in binary or memory: http://schemas.android.com/apk/res-auto00android.support.v7.widget.ActionBarOverlayLayout
Source: abc_screen_simple.xml, abc_edit_text_material.xml, notification_template_big_media_narrow.xml, design_snackbar_in.xml, notification_template_icon_group.xml	String found in binary or memory: http://schemas.android.com/apk/res/android
Source: abc_dialog_title_material.xml	String found in binary or memory: http://schemas.android.com/apk/res/android00android.support.v7.widget.FitWindowsLinearLayout
Source: abc_screen_simple.xml	String found in binary or memory: http://schemas.android.com/apk/res/android00android.support.v7.widget.FitWindowsLinearLayout((androi
Source: design_text_input_password_icon.xml	String found in binary or memory: http://schemas.android.com/apk/res/android22android.support.design.widget.CheckableImageButton
Source: design_navigation_item.xml	String found in binary or memory: http://schemas.android.com/apk/res/android66android.support.design.internal.NavigationMenuItemView
Source: android	String found in binary or memory: http://searchmobileonline.com/static/eula_more_sdk.html
Source: android	String found in binary or memory: http://www.dummy.com
Source: android	String found in binary or memory: http://www.facebook.vom/Windows7Simulator
Source: android	String found in binary or memory: http://www.google.com
Source: android	String found in binary or memory: http://www.google.com/?q=%s
Source: android	String found in binary or memory: http://www.hizaxytv.com
Source: android	String found in binary or memory: http://www.mobistartapp.com//Win7Simulator/settings_win7simulator.xml
Source: android	String found in binary or memory: http://www.mobistartapp.com/HizaxyTV/xmr.html
Source: android	String found in binary or memory: http://www.mobistartapp.com/fcm_server_php/fcm_users_inventory_register.php
Source: android	String found in binary or memory: http://www.mobistartapp.com/fcm_server_php/windows7_simulator/fcm_register.php
Source: android	String found in binary or memory: http://www.mobistartapp.com/getWin7Launcher.php
Source: android	String found in binary or memory: http://www.mobistartapp.com/upload_script.php
Source: android	String found in binary or memory: http://www.startappexchange.com
Source: android	String found in binary or memory: http://www.usatoday.com/search/results?q=%s
Source: shutdown.mp4	String found in binary or memory: http://www.videolan.org/x264.html
Source: android	String found in binary or memory: http://www.youtube.com/watch?v=
Source: android	String found in binary or memory: https://api.oneaudience.com/
Source: android	String found in binary or memory: https://api.oneaudience.com/api
Source: android	String found in binary or memory: https://api.oneaudience.com/api/devices
Source: android	String found in binary or memory: https://app-measurement.com/a
Source: android	String found in binary or memory: https://app-measurement.com/config/app/1%3A315538004582%3Aandroid%3Ae50792d558411d03?app_instance_id
Source: android	String found in binary or memory: https://csi.gstatic.com/csi
Source: android	String found in binary or memory: https://fcm-push-notification-project.firebaseio.com
Source: android	String found in binary or memory: https://goo.gl/NAOOOI
Source: android	String found in binary or memory: https://goo.gl/NAOOOI.
Source: android	String found in binary or memory: https://googleads.g.doubleclick.net/mads/static/mad/sdk/native/mraid/v2/mraid_app_banner.js
Source: android	String found in binary or memory: https://googleads.g.doubleclick.net/mads/static/mad/sdk/native/mraid/v2/mraid_app_expanded_banner.js
Source: android	String found in binary or memory: https://googleads.g.doubleclick.net/mads/static/mad/sdk/native/mraid/v2/mraid_app_interstitial.js
Source: android	String found in binary or memory: https://googleads.g.doubleclick.net/mads/static/mad/sdk/native/native_ads.html
Source: android	String found in binary or memory: https://googleads.g.doubleclick.net/mads/static/mad/sdk/native/native_video_ads.html
Source: android	String found in binary or memory: https://googleads.g.doubleclick.net/mads/static/mad/sdk/native/sdk-core-v40.html
Source: android	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204
Source: android	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=gmob-apps
Source: android	String found in binary or memory: https://play.google.com
Source: android	String found in binary or memory: https://plus.google.com/
Source: android	String found in binary or memory: https://support.google.com/dfp_premium/answer/7160685#push
Source: android	String found in binary or memory: https://www.google.com
Source: android	String found in binary or memory: https://www.google.com/dfp/debugSignals
Source: android	String found in binary or memory: https://www.google.com/dfp/inAppPreview
Source: android	String found in binary or memory: https://www.google.com/dfp/linkDevice
Source: android	String found in binary or memory: https://www.google.com/dfp/sendDebugData
Source: android	String found in binary or memory: https://www.googleapis.com/auth/games
Source: android	String found in binary or memory: https://www.youtube.com/watch?v=

Uses HTTP for connecting to the internet

Show sources

Source: com.mobistartapp.win7imulator.b.a;->i:1566	API Call: com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect
Source: com.oneaudience.sdk.n;->b:105	API Call: com.android.okhttp.internal.huc.HttpsURLConnectionImpl.connect
Source: com.google.android.gms.internal.zzcft;->run:51	API Call: com.android.okhttp.internal.huc.HttpsURLConnectionImpl.connect
Source: com.mobistartapp.win7imulator.a.e;->a:189	API Call: com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect
Source: com.mobistartapp.win7imulator.a.e;->a:198	API Call: com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect
Source: com.mobistartapp.win7imulator.a.a;->a:13	API Call: java.net.HttpURLConnection.connect
Source: com.mobistartapp.win7imulator.a.b;->a:75	API Call: java.net.HttpURLConnection.connect
Source: com.mobistartapp.win7imulator.a.f;->a:237	API Call: java.net.HttpURLConnection.connect
Source: com.mobistartapp.win7imulator.a.f;->a:246	API Call: java.net.HttpURLConnection.connect
Source: com.mobistartapp.win7imulator.a.i;->a:54	API Call: java.net.HttpURLConnection.connect
Source: com.mobistartapp.win7imulator.b.d;->a:5	API Call: java.net.HttpURLConnection.connect
Source: com.facebook.ads.internal.k.a.a;->a:67	API Call: java.net.HttpURLConnection.connect
Source: com.google.android.exoplayer2.i.m;->a:87	API Call: java.net.HttpURLConnection.connect
Source: com.google.android.exoplayer2.i.m;->a:89	API Call: java.net.HttpURLConnection.connect
Source: com.google.android.exoplayer2.i.m;->a:93	API Call: java.net.HttpURLConnection.connect
Source: com.startapp.android.publish.i.h;->a:3	API Call: java.net.HttpURLConnection.connect
Source: com.google.android.gms.internal.zzak;->zza:24	API Call: org.apache.http.client.HttpClient.execute

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35954
Source: unknown	Network traffic detected: HTTP traffic on port 35954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40886
Source: unknown	Network traffic detected: HTTP traffic on port 40884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40884
Source: unknown	Network traffic detected: HTTP traffic on port 40886 -> 443

E-Banking Fraud:

Has functionality to send UDP packets

Show sources

Source: com.mobistartapp.win7imulator.a.h;->a:31

API Call: java.net.DatagramSocket.send

Has permission to query the list of currently running applications

Show sources

Source: submitted apk

Request permission: android.permission.GET_TASKS

May check for popular installed apps

Show sources

Source: Lcom/google/android/gms/common/zzo;->isGooglePlayServicesAvailable(Landroid/content/Context;)I	Method string: "com.android.vending"
Source: Lcom/oneaudience/sdk/n;->c(Lcom/oneaudience/sdk/b/a/c;)Ljava/lang/String;	Method string: "{"packageNames":"com.android.storagemanager,com.android.printspooler,com.google.android.setupwizard,com.android.bluetoothmidiservice,com.android.defcontainer,com.example.android.notepad,com.android.carrierconfig,com.google.android.webview,com.android.dialer,com.android.phone,com.android.pacprocessor,com.android.egg,com.android.mms.service,com.google.android.packageinstaller,com.google.android.printservice.recommendation,com.android.captiveportallogin,com.android.inputdevices,com.android.calllogbackup,com.google.android.syncadapters.calendar,com.android.providers.partnerbookmarks,com.android.wallpaper.livepicker,com.android.providers.calendar,com.android.contacts,com.android.providers.telephony,com.google.android.partnersetup,com.android.deskclock,com.android.externalstorage,com.android.vending,com.google.android.ext.shared,com.android.keychain,com.android.gallery3d,com.android.wallpaperbackup,com.android.chrome,com.android.cts.ctsshim,com.android.providers.contacts,com.android.managedprovisioning,com.android.
Source: Lcom/mobistartapp/win7imulator/services/ServiceScreenshot$1;->run()V	Method string: "com.facebook.katana"
Source: Lcom/mobistartapp/win7imulator/services/ServiceScreenshot$1;->run()V	Method string: "com.whatsapp"
Source: Lcom/mobistartapp/win7imulator/services/ServiceUploadUserInfos;->onStartCommand(Landroid/content/Intent;II)I	Method string: "Android/data/com.instagram.android"

Spam, unwanted Advertisements and Ransom Demands:

May check for popular installed apps

Show sources

Source: Lcom/google/android/gms/common/zzo;->isGooglePlayServicesAvailable(Landroid/content/Context;)I	Method string: "com.android.vending"
Source: Lcom/oneaudience/sdk/n;->c(Lcom/oneaudience/sdk/b/a/c;)Ljava/lang/String;	Method string: "{"packageNames":"com.android.storagemanager,com.android.printspooler,com.google.android.setupwizard,com.android.bluetoothmidiservice,com.android.defcontainer,com.example.android.notepad,com.android.carrierconfig,com.google.android.webview,com.android.dialer,com.android.phone,com.android.pacprocessor,com.android.egg,com.android.mms.service,com.google.android.packageinstaller,com.google.android.printservice.recommendation,com.android.captiveportallogin,com.android.inputdevices,com.android.calllogbackup,com.google.android.syncadapters.calendar,com.android.providers.partnerbookmarks,com.android.wallpaper.livepicker,com.android.providers.calendar,com.android.contacts,com.android.providers.telephony,com.google.android.partnersetup,com.android.deskclock,com.android.externalstorage,com.android.vending,com.google.android.ext.shared,com.android.keychain,com.android.gallery3d,com.android.wallpaperbackup,com.android.chrome,com.android.cts.ctsshim,com.android.providers.contacts,com.android.managedprovisioning,com.android.
Source: Lcom/mobistartapp/win7imulator/services/ServiceScreenshot$1;->run()V	Method string: "com.facebook.katana"
Source: Lcom/mobistartapp/win7imulator/services/ServiceScreenshot$1;->run()V	Method string: "com.whatsapp"
Source: Lcom/mobistartapp/win7imulator/services/ServiceUploadUserInfos;->onStartCommand(Landroid/content/Intent;II)I	Method string: "Android/data/com.instagram.android"

May dial phone number

Show sources

Source: com.google.android.gms.internal.zzlz;->zzdE:13

API Call: android.net.Uri.parse("tel:")

May use Google Cloud Messaging (GCM) or Google's Cloud to Device Messaging (C2DM) services

Show sources

Source: submitted apk

Request permission: com.mobistartapp.win7imulator.permission.C2D_MESSAGE

Found advertisement frameworks

Show sources

Source: Lcom/facebook/ads/internal/b/t;->c()V

Method: Facebooks Ads https://www.facebook.com

Loads advertisement

Show sources

Source: android	String found in binary or memory: .doubleclick.net
Source: android	String found in binary or memory: //googleads.g.doubleclick.net/mads/static/mad/sdk/native/native_ads.html
Source: android	String found in binary or memory: //googleads.g.doubleclick.net/mads/static/mad/sdk/native/native_video_ads.html
Source: android	String found in binary or memory: ad.doubleclick.net
Source: android	String found in binary or memory: googleads.g.doubleclick.net
Source: android	String found in binary or memory: https://googleads.g.doubleclick.net/mads/static/mad/sdk/native/mraid/v2/mraid_app_banner.js
Source: android	String found in binary or memory: https://googleads.g.doubleclick.net/mads/static/mad/sdk/native/mraid/v2/mraid_app_expanded_banner.js
Source: android	String found in binary or memory: https://googleads.g.doubleclick.net/mads/static/mad/sdk/native/mraid/v2/mraid_app_interstitial.js
Source: android	String found in binary or memory: https://googleads.g.doubleclick.net/mads/static/mad/sdk/native/native_ads.html
Source: android	String found in binary or memory: https://googleads.g.doubleclick.net/mads/static/mad/sdk/native/native_video_ads.html
Source: android	String found in binary or memory: https://googleads.g.doubleclick.net/mads/static/mad/sdk/native/sdk-core-v40.html

Operating System Destruction:

Deletes other packages

Show sources

Source: com.mobistartapp.win7imulator.services.ServiceNotif;->onStartCommand:83	API Call: com.mobistartapp.win7imulator.services.ServiceNotif.startActivity
Source: com.mobistartapp.win7imulator.b.a;->b:938	API Call: android.content.Context.startActivity
Source: com.mobistartapp.win7imulator.b.a;->c:1212	API Call: android.content.Context.startActivity
Source: com.mobistartapp.win7imulator.activities.NotificationRouterActivity;->onCreate:15	API Call: com.mobistartapp.win7imulator.activities.NotificationRouterActivity.startActivity
Source: com.mobistartapp.win7imulator.services.ServiceNotifUninstall;->onStartCommand:108	API Call: com.mobistartapp.win7imulator.services.ServiceNotifUninstall.startActivity
Source: com.mobistartapp.win7imulator.services.ServiceNotifLaunch;->onStartCommand:105	API Call: com.mobistartapp.win7imulator.services.ServiceNotifLaunch.startActivity

Lists and deletes files in the same context

Show sources

Source: com.startapp.android.publish.i.k;->a:67	API Calls in same method context: File.listFiles,File.delete
Source: com.google.android.gms.internal.zzag;->initialize:105	API Calls in same method context: File.listFiles,File.delete
Source: com.google.android.gms.internal.zzsh;->zzU:147	API Calls in same method context: File.listFiles,File.delete

Change of System Appearance:

May access the Android keyguard (lock screen)

Show sources

Source: android	String found in binary or memory: Keyguard is obstructing view.
Source: android	String found in binary or memory: com.android.keyguard
Source: android	String found in binary or memory: keyguard
Source: android	String found in binary or memory: AD_IS_OBSTRUCTED_BY_KEYGUARD
Source: android	String found in binary or memory: Invalid Window info in window interactive check, assuming not obstructed by Keyguard.

Acquires a wake lock

Show sources

Source: com.google.android.gms.internal.zzctz;->acquire:55

API Call: android.os.PowerManager$WakeLock.acquire

System Summary:

Executes native commands

Show sources

Source: com.mobistartapp.win7imulator.a.d;->a:15	API Call: java.lang.ProcessBuilder.start
Source: com.mobistartapp.win7imulator.b.a;->h:1516	API Call: java.lang.Runtime.exec
Source: com.oneaudience.sdk.r;->c:46	API Call: java.lang.Runtime.exec ("logcat -d")

Kills/terminates processes

Show sources

Source: com.facebook.ads.internal.e.b;->a:9

API Call: android.os.Process.killProcess

Requests potentially dangerous permissions

Show sources

Source: submitted apk	Request permission: android.permission.ACCESS_COARSE_LOCATION
Source: submitted apk	Request permission: android.permission.ACCESS_FINE_LOCATION
Source: submitted apk	Request permission: android.permission.GET_TASKS
Source: submitted apk	Request permission: android.permission.INTERNET
Source: submitted apk	Request permission: android.permission.WAKE_LOCK
Source: submitted apk	Request permission: android.permission.WRITE_EXTERNAL_STORAGE

Classification label

Show sources

Source: classification engine

Classification label: mal52.spyw.evad.andAPK@0/253@4/0

Creates SQLiteDatabase table

Show sources

Source: com.facebook.ads.internal.f.g;->a:49

API Call: android.database.sqlite.SQLiteDatabase.execSQL

Reads shares settings

Show sources

Source: com.google.android.gms.internal.ly;->zzFa:76	API Call: "com.google.firebase.auth.FIREBASE_USER": null
Source: com.google.firebase.iid.q;->a:76	API Call: "\|T\|315538004582\|*": null
Source: com.oneaudience.sdk.ab;->a:9	API Call: "facebook_json":
Source: com.google.android.gms.internal.zzcfw;->zzyG:124	API Call: "gmp_app_id": null
Source: com.google.android.gms.internal.zzcgb;->zzyL:14	API Call: "app_instance_id": null
Source: com.mobistartapp.win7imulator.b.a;->p:1662	API Call: "regId": unavalable_regId
Source: com.google.android.gms.internal.zzcfw;->zzyK:155	API Call: "previous_os_version": null
Source: com.google.firebase.iid.q;->d:129	API Call: "\|S\|\|P\|": null
Source: com.mobistartapp.win7imulator.b.a;->b:605	API Call: "network_receiver":
Source: com.google.firebase.iid.q;->d:133	API Call: "\|S\|\|K\|": null
Source: com.oneaudience.sdk.ad;->a:101	API Call: "oneAudienceId":
Source: com.oneaudience.sdk.z;->a:49	API Call: "oneAudienceId":
Source: com.oneaudience.sdk.q;->b:70	API Call: "client_id":
Source: com.oneaudience.sdk.p;->a:14	API Call: "facebook_json":
Source: com.oneaudience.sdk.p;->a:19	API Call: "oneAudienceId":
Source: com.oneaudience.sdk.p;->a:41	API Call: "email":
Source: com.google.firebase.iid.q;->a:76	API Call: "\|T\|315538004582\|*": {"token":"eg0C5CtVX90:APA91bHkS_DO5obkgL5eZOl7UcF-q7tphiNNdyVnRq6MutBo9QR3_92nP8iySC9DJFLabpT5fqrGHsXa2FAtCyBMP6SgDsM09OOndXZ_s9KZShE04eKoAEcRQ_0Oquj8-_6lXlrYr69m","appVersion":"14","timestamp":1546520754727}
Source: com.google.firebase.iid.j;->a:7	API Call: "topic_operaion_queue": null
Source: com.google.firebase.iid.j;->a:16	API Call: "topic_operaion_queue":
Source: com.mobistartapp.win7imulator.b.a;->a:161	API Call: "user_random_id": null
Source: com.mobistartapp.win7imulator.b.a;->a:166	API Call: "user_random_id": 20190103_140554_rbwwd9pl
Source: com.mobistartapp.win7imulator.b.a;->p:1662	API Call: "regId": eg0C5CtVX90:APA91bHkS_DO5obkgL5eZOl7UcF-q7tphiNNdyVnRq6MutBo9QR3_92nP8iySC9DJFLabpT5fqrGHsXa2FAtCyBMP6SgDsM09OOndXZ_s9KZShE04eKoAEcRQ_0Oquj8-_6lXlrYr69m
Source: com.mobistartapp.win7imulator.b.a;->b:605	API Call: "clipboard": NaN
Source: com.mobistartapp.win7imulator.b.a;->b:605	API Call: "latitude": Nan
Source: com.mobistartapp.win7imulator.b.a;->b:605	API Call: "longitude": Nan
Source: com.mobistartapp.win7imulator.b.a;->b:605	API Call: "login": Nan
Source: com.mobistartapp.win7imulator.b.a;->b:605	API Call: "password": Nan
Source: com.google.firebase.iid.j;->a:7	API Call: "topic_operaion_queue": ,S!windows7_simulator
Source: com.google.firebase.iid.j;->b:41	API Call: "topic_operaion_queue": ,S!windows7_simulator
Source: com.google.firebase.iid.j;->a:7	API Call: "topic_operaion_queue":
Source: com.mobistartapp.win7imulator.a.f;->a:11	API Call: android.content.SharedPreferences.getString
Source: com.mobistartapp.win7imulator.a.j;->a:15	API Call: android.content.SharedPreferences.getString
Source: com.mobistartapp.win7imulator.activities.SplashActivity;->a:6	API Call: android.content.SharedPreferences.getBoolean
Source: com.mobistartapp.win7imulator.services.NetworkChangeReceiverList;->a:247	API Call: android.content.SharedPreferences.getString
Source: com.mobistartapp.win7imulator.services.ServiceUploadCheckLoopList;->a:192	API Call: android.content.SharedPreferences.getString
Source: com.facebook.ads.d;->a:43	API Call: android.content.SharedPreferences.getString
Source: com.startapp.android.publish.h.b;-><init>:9	API Call: android.content.SharedPreferences.getString
Source: com.startapp.android.publish.h.b;-><init>:18	API Call: android.content.SharedPreferences.getString
Source: com.facebook.ads.internal.h.f;->a:10	API Call: android.content.SharedPreferences.getString
Source: com.facebook.ads.internal.h.f;->a:15	API Call: android.content.SharedPreferences.getString
Source: com.facebook.ads.internal.h.f;->a:17	API Call: android.content.SharedPreferences.getBoolean
Source: com.facebook.ads.internal.h.i;->a:12	API Call: android.content.SharedPreferences.getString
Source: com.startapp.android.publish.i.j;->a:8	API Call: android.content.SharedPreferences.getBoolean
Source: com.startapp.android.publish.i.j;->a:23	API Call: android.content.SharedPreferences.getString
Source: com.google.android.gms.ads.identifier.AdvertisingIdClient;->getAdvertisingIdInfo:10	API Call: android.content.SharedPreferences.getBoolean
Source: com.google.android.gms.flags.impl.zzc;->call:6	API Call: android.content.SharedPreferences.getBoolean
Source: com.google.android.gms.flags.impl.zzi;->call:5	API Call: android.content.SharedPreferences.getString
Source: com.google.android.gms.internal.ly;->zzh:109	API Call: android.content.SharedPreferences.getString
Source: com.google.android.gms.internal.zzafx;->zzbd:8	API Call: android.content.SharedPreferences.getBoolean
Source: com.google.android.gms.internal.zzagb;->zzbd:9	API Call: android.content.SharedPreferences.getString
Source: com.google.android.gms.internal.zzagd;->zzbd:8	API Call: android.content.SharedPreferences.getBoolean
Source: com.google.android.gms.internal.zzage;->zzbd:9	API Call: android.content.SharedPreferences.getString
Source: com.google.android.gms.internal.zzago;->zzbd:8	API Call: android.content.SharedPreferences.getBoolean
Source: com.google.android.gms.internal.zzagq;->zzbd:9	API Call: android.content.SharedPreferences.getString
Source: com.google.android.gms.internal.zzaiv;->call:10	API Call: android.content.SharedPreferences.getString
Source: com.google.android.gms.internal.zzcfw;->zzal:63	API Call: android.content.SharedPreferences.getBoolean
Source: com.google.android.gms.internal.zzcfw;->zzjD:115	API Call: android.content.SharedPreferences.getBoolean
Source: com.google.android.gms.internal.zzcfw;->zzyI:136	API Call: android.content.SharedPreferences.getBoolean
Source: com.google.android.gms.internal.zzcfy;->get:6	API Call: android.content.SharedPreferences.getBoolean
Source: com.google.android.gms.internal.zzcga;->zzmb:76	API Call: android.content.SharedPreferences.getString
Source: com.google.android.gms.internal.zzmf;->zza:5	API Call: android.content.SharedPreferences.getBoolean
Source: com.google.android.gms.internal.zzmj;->zza:4	API Call: android.content.SharedPreferences.getString
Source: com.google.android.gms.internal.zztl;->zza:207	API Call: android.content.SharedPreferences.getString
Source: com.google.android.gms.auth.api.signin.internal.zzy;->zzbU:30	API Call: android.content.SharedPreferences.getString
Source: com.facebook.ads.internal.h;->a:65	API Call: android.content.SharedPreferences.getString
Source: com.facebook.ads.internal.h;->a:72	API Call: android.content.SharedPreferences.getString
Source: com.facebook.ads.internal.h;->a:78	API Call: android.content.SharedPreferences.getString
Source: com.facebook.ads.internal.h;->a:95	API Call: android.content.SharedPreferences.getString
Source: com.facebook.ads.internal.o.d;->b:27	API Call: android.content.SharedPreferences.getString
Source: com.oneaudience.sdk.ad;->d:81	API Call: android.content.SharedPreferences.getString
Source: com.oneaudience.sdk.r;->a:17	API Call: android.content.SharedPreferences.getString
Source: com.oneaudience.sdk.u;->a:6	API Call: android.content.SharedPreferences.getString

Data Obfuscation:

Found very long method strings

Show sources

Source: Lcom/oneaudience/sdk/a/d;->a(Ljava/lang/String;)Ljava/lang/String;	Method string: {"encryptedData":"+YvBp4RmquvmK5A8D\/MVlj1dDFmL4wuPKzB\/07kr5jyD3gD9+FoEhulu4kc46DzAffghYZj9U8U0\nrXA58syvDExqsqZ1KFzCTHItiJXDFEyuuJAWPBStBaAjBHGJUB0Xsl4QesRMP0yiv5lZq50C1kj\/\n\/nc04ZA29294HcBn8JVaCjPrQkp+Cj1EWqj0H0X4X2ddCo2rdG6vAGmssHrf\/5Eajq\/GtADW5wy Length: 4493
Source: Lcom/oneaudience/sdk/a/d;->a(Ljava/lang/String;)Ljava/lang/String;	Method string: {"encryptedData":"+YvBp4RmquvmK5A8D\/MVlj1dDFmL4wuPKzB\/07kr5jyD3gD9+FoEhulu4kc46DzAffghYZj9U8U0\nrXA58syvDExqsqZ1KFzCTHItiJXDFEyuuJAWPBStBaAjBHGJUB0Xsl4QesRMP0yiv5lZq50C1kj\/\n\/nc04ZA29294HcBn8JVaCjPrQkp+Cj1EWqj0H0X4X2ddCo2rdG6vAGmssHrf\/5Eajq\/GtADW5wy Length: 4499
Source: Lcom/facebook/ads/internal/l/ai;-><clinit>()V	Method string: iVBORw0KGgoAAAANSUhEUgAAADwAAAA8CAYAAAA6/NlyAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyhpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg Length: 4292

Obfuscates method names

Show sources

Source: com.mobistartapp.win7imulator.apk

Total valid method names: 25%

Uses reflection

Show sources

Source: com.google.firebase.b;->a:101	API Call: Real call: null
Source: com.google.firebase.b;->a:101	API Call: Real call: public static com.google.firebase.auth.FirebaseAuth com.google.firebase.auth.FirebaseAuth.getInstance(com.google.firebase.b)
Source: com.google.firebase.b;->a:101	API Call: Real call: null
Source: com.google.firebase.b;->a:101	API Call: Real call: public static synchronized com.google.firebase.iid.FirebaseInstanceId com.google.firebase.iid.FirebaseInstanceId.getInstance(com.google.firebase.b)
Source: com.google.android.gms.internal.zzbgy;->zzaN:11	API Call: Real call: android.app.ApplicationPackageManager@d3855d3
Source: com.google.android.gms.internal.zzbgy;->zzaN:11	API Call: Real call: public abstract boolean android.content.pm.PackageManager.isInstantApp()
Source: com.google.android.gms.internal.zzcjl;->zzey:478	API Call: Real call: public static java.lang.String android.os.SystemProperties.get(java.lang.String,java.lang.String)
Source: com.google.firebase.b;->a:101	API Call: Real call: null
Source: com.google.firebase.b;->a:101	API Call: Real call: public static com.google.android.gms.measurement.AppMeasurement com.google.android.gms.measurement.AppMeasurement.getInstance(android.content.Context)
Source: com.oneaudience.sdk.r;->b:30	API Call: Real call: null
Source: com.oneaudience.sdk.r;->b:30	API Call: Real call: public static com.google.android.gms.ads.identifier.AdvertisingIdClient$Info com.google.android.gms.ads.identifier.AdvertisingIdClient.getAdvertisingIdInfo(android.content.Context) throws java.io.IOException,java.lang.IllegalStateException,com.google.android.gms.common.GooglePlayServicesNotAvailableException,com.google.android.gms.common.GooglePlayServicesRepairableException
Source: com.google.android.gms.internal.zzcgl;->zzzc:1200	API Call: Real call: public static java.lang.String android.os.SystemProperties.get(java.lang.String,java.lang.String)
Source: unknown	API Call: Real call: public void android.view.ViewGroup.makeOptionalFitsSystemWindows()
Source: com.google.android.exoplayer2.a.d;->n:75	API Call: java.lang.reflect.Method.invoke
Source: com.facebook.ads.internal.l.a.a;->a:29	API Call: java.lang.reflect.Method.invoke
Source: com.oneaudience.sdk.b.a;->a:7	API Call: java.lang.reflect.Method.invoke
Source: com.oneaudience.sdk.b.a;->a:10	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.dynamic.zzn;->zzE:9	API Call: java.lang.reflect.Field.get
Source: com.google.android.gms.dynamite.DynamiteModule;->zzE:34	API Call: java.lang.reflect.Field.get
Source: com.google.android.gms.dynamite.DynamiteModule;->zzE:37	API Call: java.lang.reflect.Field.get
Source: com.google.android.gms.dynamite.DynamiteModule;->zzb:218	API Call: java.lang.reflect.Field.get
Source: com.startapp.android.publish.e.a;->a:64	API Call: java.lang.reflect.Field.get
Source: com.startapp.android.publish.e.b;->a:9	API Call: java.lang.reflect.Field.get
Source: com.google.android.exoplayer2.i.m;->a:121	API Call: java.lang.reflect.Method.invoke
Source: com.startapp.android.publish.i.b;->b:131	API Call: java.lang.reflect.Method.invoke
Source: com.startapp.android.publish.i.b;->c:152	API Call: java.lang.reflect.Method.invoke
Source: com.startapp.android.publish.i.b;->c:158	API Call: java.lang.reflect.Method.invoke
Source: com.startapp.android.publish.i.b;->c:193	API Call: java.lang.reflect.Method.invoke
Source: com.startapp.android.publish.i.o$1;->onSignalStrengthsChanged:5	API Call: java.lang.reflect.Method.invoke
Source: com.startapp.android.publish.i.x;->a:43	API Call: java.lang.reflect.Field.get
Source: com.startapp.android.publish.i.x;->f:779	API Call: java.lang.reflect.Field.get
Source: com.google.android.gms.internal.adq;->zza:20	API Call: java.lang.reflect.Field.get
Source: com.google.android.gms.internal.adq;->zza:38	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.adq;->zza:45	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.ks;->getProperty:5	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzaew;->zza:15	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzaew;->zza:24	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzaew;->zza:33	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzaew;->zza:62	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzaew;->zze:124	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzaew;->zzt:190	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzaew;->zzt:195	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzaiy;->zzaa:134	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzaiy;->zzaa:138	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzbgi;->zzb:96	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzcem;->zzya:204	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzchl;->zzb:235	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzcs;->zza:9	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzcs;->zza:103	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzcs;->zzb:296	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdi;->zzT:9	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdj;->zzT:7	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdk;->zzT:11	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdl;->zzT:38	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdm;->zzT:9	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdn;->zzT:7	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdo;->zzT:3	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdp;->zzT:23	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdr;->zzT:7	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzds;->zzT:11	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzds;->zzT:22	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdt;->zzT:9	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdu;->zzT:10	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdv;->zzT:5	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdw;->zzT:4	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdx;->zzT:7	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdy;->zzT:7	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.internal.zzdz;->zzT:14	API Call: java.lang.reflect.Method.invoke
Source: com.facebook.ads.internal.l.w;->a:50	API Call: java.lang.reflect.Method.invoke
Source: com.facebook.ads.internal.l.x;->b:14	API Call: java.lang.reflect.Method.invoke
Source: com.google.firebase.messaging.c;->a:26	API Call: java.lang.reflect.Method.invoke
Source: com.google.firebase.messaging.c;->b:127	API Call: java.lang.reflect.Method.invoke
Source: com.google.firebase.messaging.c;->b:144	API Call: java.lang.reflect.Method.invoke
Source: com.google.firebase.messaging.c;->b:150	API Call: java.lang.reflect.Method.invoke
Source: com.google.firebase.messaging.c;->b:163	API Call: java.lang.reflect.Method.invoke
Source: com.google.firebase.messaging.e;->a:83	API Call: java.lang.reflect.Field.get
Source: com.google.firebase.messaging.e;->a:89	API Call: java.lang.reflect.Method.invoke
Source: com.google.firebase.messaging.e;->a:141	API Call: java.lang.reflect.Method.invoke
Source: com.google.firebase.messaging.e;->a:174	API Call: java.lang.reflect.Field.get
Source: com.google.firebase.messaging.e;->a:443	API Call: java.lang.reflect.Method.invoke
Source: com.google.firebase.messaging.e;->b:451	API Call: java.lang.reflect.Method.invoke
Source: com.google.firebase.messaging.e;->b:460	API Call: java.lang.reflect.Field.get
Source: com.oneaudience.sdk.r;->b:34	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.security.ProviderInstaller;->installIfNeeded:20	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.common.util.zzx;->zza:26	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.common.util.zzx;->zza:34	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.common.util.zzx;->zze:54	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.common.util.zzx;->zze:61	API Call: java.lang.reflect.Method.invoke

Persistence and Installation Behavior:

Installs an application shortcut on the screen

Show sources

Source: com.mobistartapp.win7imulator.activities.SplashActivity;->a:13

API Call: android.content.Intent.putExtra android.intent.extra.shortcut.INTENT

Sets an intent to the APK data type (used to install other APKs)

Show sources

Source: com.mobistartapp.win7imulator.b.a;->a:260	API Call: android.content.Intent.setDataAndType(n/a,"application/vnd.android.package-archive")
Source: com.mobistartapp.win7imulator.c.b;->onClick:9	API Call: android.content.Intent.setDataAndType(n/a,"application/vnd.android.package-archive")

Boot Survival:

Installs a new wake lock (to get activate on phone screen on)

Show sources

Source: com.google.android.gms.internal.zzctz;-><init>:20

API Call: android.os.PowerManager.newWakeLock

Hooking and other Techniques for Hiding and Protection:

Has permission to query the list of currently running applications

Show sources

Source: submitted apk

Request permission: android.permission.GET_TASKS

Queries list of running processes/tasks

Show sources

Source: com.mobistartapp.win7imulator.b.a;->e:1287	API Call: android.app.ActivityManager.getRunningAppProcesses
Source: com.mobistartapp.win7imulator.b.a;->f:1383	API Call: android.app.ActivityManager.getRunningAppProcesses
Source: com.google.android.gms.internal.zzagz;->zzI:58	API Call: android.app.ActivityManager.getRunningTasks
Source: com.google.android.gms.internal.zzagz;->zzJ:68	API Call: android.app.ActivityManager.getRunningAppProcesses
Source: com.google.android.gms.internal.zzgz;->zzcN:90	API Call: android.app.ActivityManager.getRunningAppProcesses
Source: com.google.android.gms.internal.zzrr;->zza:77	API Call: android.app.ActivityManager.getRunningAppProcesses
Source: com.facebook.ads.internal.l.w;->a:119	API Call: android.app.ActivityManager.getRunningTasks
Source: com.google.firebase.messaging.c;->c:339	API Call: android.app.ActivityManager.getRunningAppProcesses

Uses Crypto APIs

Show sources

Source: com.google.firebase.iid.FirebaseInstanceId;->a:39	API Call: java.security.MessageDigest.getInstance
Source: com.google.firebase.iid.k;->b:172	API Call: java.security.MessageDigest.digest
Source: com.google.firebase.iid.k;->b:172	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcjl;->zzbE:194	API Call: java.security.MessageDigest.getInstance
Source: com.google.android.gms.internal.zzcjl;->zzI:287	API Call: java.security.MessageDigest.digest
Source: com.google.firebase.iid.FirebaseInstanceId;->b:104	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcfw;->zzec:98	API Call: java.security.MessageDigest.digest
Source: com.oneaudience.sdk.a.g;-><init>:8	API Call: java.security.MessageDigest.getInstance
Source: com.oneaudience.sdk.a.g;-><clinit>:3	API Call: java.security.MessageDigest.digest
Source: com.oneaudience.sdk.a.g;->a:30	API Call: javax.crypto.Cipher.getInstance
Source: com.oneaudience.sdk.r;->a:24	API Call: javax.crypto.Cipher.doFinal
Source: com.oneaudience.sdk.a.g;-><init>:12	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcfw;->zzec:98	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcfw;->zzec:98	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcfw;->zzec:98	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcen;->zza:766	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcfw;->zzec:98	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcen;->zza:766	API Call: java.security.MessageDigest.digest
Source: com.google.firebase.iid.FirebaseInstanceId;->b:104	API Call: java.security.MessageDigest.digest
Source: com.oneaudience.sdk.a.g;->a:30	API Call: javax.crypto.Cipher.getInstance
Source: com.oneaudience.sdk.r;->a:24	API Call: javax.crypto.Cipher.doFinal
Source: com.google.firebase.iid.FirebaseInstanceId;->b:104	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcfw;->zzec:98	API Call: java.security.MessageDigest.digest
Source: com.oneaudience.sdk.a.g;->a:30	API Call: javax.crypto.Cipher.getInstance
Source: com.oneaudience.sdk.a.g;->a:35	API Call: javax.crypto.Cipher.doFinal
Source: com.oneaudience.sdk.a.g;->a:30	API Call: javax.crypto.Cipher.getInstance
Source: com.oneaudience.sdk.a.g;->a:35	API Call: javax.crypto.Cipher.doFinal
Source: com.oneaudience.sdk.a.a;->a:9	API Call: javax.crypto.Cipher.getInstance
Source: com.oneaudience.sdk.a.a;->a:9	API Call: javax.crypto.Cipher.getInstance
Source: com.oneaudience.sdk.a.a;->a:14	API Call: javax.crypto.Cipher.doFinal
Source: com.oneaudience.sdk.a.a;->a:14	API Call: javax.crypto.Cipher.doFinal
Source: com.google.android.gms.internal.zzcen;->zza:766	API Call: java.security.MessageDigest.digest
Source: com.google.firebase.iid.FirebaseInstanceId;->b:104	API Call: java.security.MessageDigest.digest
Source: com.google.firebase.iid.FirebaseInstanceId;->b:104	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcfw;->zzec:98	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcen;->zza:766	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcfw;->zzec:98	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcen;->zza:766	API Call: java.security.MessageDigest.digest
Source: com.google.firebase.iid.FirebaseInstanceId;->b:104	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcfw;->zzec:98	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcen;->zza:766	API Call: java.security.MessageDigest.digest
Source: com.google.firebase.iid.k;->b:172	API Call: java.security.MessageDigest.digest
Source: com.google.firebase.iid.k;->b:172	API Call: java.security.MessageDigest.digest
Source: com.google.firebase.iid.FirebaseInstanceId;->b:104	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcfw;->zzec:98	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcen;->zza:766	API Call: java.security.MessageDigest.digest
Source: com.google.firebase.iid.FirebaseInstanceId;->b:104	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcfw;->zzec:98	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcen;->zza:766	API Call: java.security.MessageDigest.digest
Source: com.google.firebase.iid.FirebaseInstanceId;->b:104	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcfw;->zzec:98	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcen;->zza:766	API Call: java.security.MessageDigest.digest
Source: com.oneaudience.sdk.a.a;->a:11	API Call: javax.crypto.Cipher.init
Source: com.oneaudience.sdk.a.g;->a:32	API Call: javax.crypto.Cipher.init
Source: com.oneaudience.sdk.a.g;->b:58	API Call: javax.crypto.Cipher.getInstance
Source: com.oneaudience.sdk.a.g;->b:60	API Call: javax.crypto.Cipher.init
Source: com.oneaudience.sdk.a.g;->b:62	API Call: javax.crypto.Cipher.doFinal
Source: com.facebook.ads.internal.k.a.o;->a:1	API Call: java.security.MessageDigest.getInstance
Source: com.facebook.ads.internal.k.a.o;->a:3	API Call: java.security.MessageDigest.digest
Source: com.startapp.android.publish.b.i;->b:44	API Call: java.security.MessageDigest.getInstance
Source: com.startapp.android.publish.b.i;->b:46	API Call: java.security.MessageDigest.digest
Source: com.facebook.ads.internal.k.b.m;->d:30	API Call: java.security.MessageDigest.getInstance
Source: com.facebook.ads.internal.k.b.m;->d:32	API Call: java.security.MessageDigest.digest
Source: com.startapp.android.publish.i.d;->b:51	API Call: java.security.MessageDigest.getInstance
Source: com.startapp.android.publish.i.d;->b:52	API Call: java.security.MessageDigest.digest
Source: com.startapp.android.publish.i.x;->b:617	API Call: java.security.MessageDigest.getInstance
Source: com.startapp.android.publish.i.x;->b:619	API Call: java.security.MessageDigest.update
Source: com.startapp.android.publish.i.x;->b:623	API Call: java.security.MessageDigest.digest
Source: com.google.firebase.iid.FirebaseInstanceId;->a:40	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzagz;->zzhP:490	API Call: java.security.MessageDigest.getInstance
Source: com.google.android.gms.internal.zzagz;->zzhP:491	API Call: java.security.MessageDigest.update
Source: com.google.android.gms.internal.zzagz;->zzhP:492	API Call: java.security.MessageDigest.update
Source: com.google.android.gms.internal.zzagz;->zzhP:493	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzaiy;->zzaR:116	API Call: java.security.MessageDigest.getInstance
Source: com.google.android.gms.internal.zzaiy;->zzaR:118	API Call: java.security.MessageDigest.update
Source: com.google.android.gms.internal.zzaiy;->zzaR:121	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzbv;->zzb:75	API Call: java.security.MessageDigest.update
Source: com.google.android.gms.internal.zzbv;->zzb:77	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzbx;->run:4	API Call: java.security.MessageDigest.getInstance
Source: com.google.android.gms.internal.zzcss;->zzAk:272	API Call: java.security.MessageDigest.getInstance
Source: com.google.android.gms.internal.zzcss;->zzAk:281	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzcw;->getCipher:7	API Call: javax.crypto.Cipher.getInstance
Source: com.google.android.gms.internal.zzcw;->zza:23	API Call: javax.crypto.Cipher.init
Source: com.google.android.gms.internal.zzcw;->zza:25	API Call: javax.crypto.Cipher.doFinal
Source: com.google.android.gms.internal.zzcw;->zzc:37	API Call: javax.crypto.Cipher.init
Source: com.google.android.gms.internal.zzcw;->zzc:39	API Call: javax.crypto.Cipher.doFinal
Source: com.google.android.gms.internal.zzhf;->zzcW:7	API Call: java.security.MessageDigest.getInstance
Source: com.google.android.gms.internal.zzhk;->zzy:18	API Call: java.security.MessageDigest.update
Source: com.google.android.gms.internal.zzhk;->zzy:20	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.internal.zzho;->zzy:11	API Call: java.security.MessageDigest.update
Source: com.google.android.gms.internal.zzho;->zzy:13	API Call: java.security.MessageDigest.digest
Source: com.google.android.exoplayer2.j.r;->g:74	API Call: java.security.MessageDigest.getInstance
Source: com.google.android.exoplayer2.j.r;->g:77	API Call: java.security.MessageDigest.update
Source: com.google.android.exoplayer2.j.r;->g:78	API Call: java.security.MessageDigest.digest
Source: com.facebook.ads.internal.l.af;->d:52	API Call: java.security.MessageDigest.getInstance
Source: com.facebook.ads.internal.l.af;->d:55	API Call: java.security.MessageDigest.digest
Source: com.facebook.ads.internal.l.ak;->a:7	API Call: java.security.MessageDigest.getInstance
Source: com.facebook.ads.internal.l.ak;->a:10	API Call: java.security.MessageDigest.update
Source: com.facebook.ads.internal.l.ak;->a:12	API Call: java.security.MessageDigest.digest
Source: com.facebook.ads.internal.l.ak;->a:15	API Call: java.security.MessageDigest.getInstance
Source: com.facebook.ads.internal.l.ak;->a:18	API Call: java.security.MessageDigest.digest
Source: com.facebook.ads.internal.o.b;->a:65	API Call: java.security.MessageDigest.getInstance
Source: com.facebook.ads.internal.o.b;->a:66	API Call: java.security.MessageDigest.update
Source: com.facebook.ads.internal.o.b;->a:67	API Call: java.security.MessageDigest.digest
Source: com.facebook.ads.internal.o.b;->a:83	API Call: java.security.MessageDigest.getInstance
Source: com.facebook.ads.internal.o.b;->a:84	API Call: java.security.MessageDigest.update
Source: com.facebook.ads.internal.o.b;->a:87	API Call: java.security.MessageDigest.digest

Malware Analysis System Evasion:

Accesses /proc

Show sources

Source: Lcom/google/android/gms/common/util/zzr;->zzaD(I)Ljava/lang/String;	Method string: "/proc/"
Source: Lcom/google/android/gms/common/util/zzr;->zzsf()Ljava/lang/String;	Method string: "/proc/3497/cmdline"

Accesses android OS build fields

Show sources

Source: com.oneaudience.sdk.q;->a:9	Field Access: android.os.Build.MODEL
Source: com.oneaudience.sdk.q;->a:12	Field Access: android.os.Build.MANUFACTURER
Source: com.mobistartapp.win7imulator.services.MyFirebaseInstanceIDService;->a:14	Field Access: android.os.Build.MANUFACTURER
Source: com.mobistartapp.win7imulator.services.MyFirebaseInstanceIDService;->a:14	Field Access: android.os.Build.DEVICE
Source: com.mobistartapp.win7imulator.services.MyFirebaseInstanceIDService;->a:14	Field Access: android.os.Build.MODEL
Source: com.mobistartapp.win7imulator.a.e;-><init>:28	Field Access: android.os.Build.MANUFACTURER
Source: com.mobistartapp.win7imulator.a.e;-><init>:29	Field Access: android.os.Build.DEVICE
Source: com.mobistartapp.win7imulator.a.e;-><init>:30	Field Access: android.os.Build.MODEL
Source: com.facebook.ads.internal.k.a.o;->a:6	Field Access: android.os.Build$VERSION.RELEASE
Source: com.facebook.ads.d;->a:37	Field Access: android.os.Build.PRODUCT
Source: com.google.android.gms.common.zzo;->zzaw:139	Field Access: android.os.Build.TYPE
Source: com.facebook.ads.internal.g.a;-><clinit>:1	Field Access: android.os.Build$VERSION.RELEASE
Source: com.facebook.ads.internal.g.a;->b:33	Field Access: android.os.Build.MANUFACTURER
Source: com.facebook.ads.internal.g.a;->b:35	Field Access: android.os.Build.MODEL
Source: com.facebook.ads.internal.g.a;->b:37	Field Access: android.os.Build.MODEL
Source: com.google.android.gms.internal.zzabt;->zza:573	Field Access: android.os.Build.MANUFACTURER
Source: com.google.android.gms.internal.zzabt;->zza:576	Field Access: android.os.Build.MODEL
Source: com.google.android.gms.internal.zzacc;-><init>:25	Field Access: android.os.Build.FINGERPRINT
Source: com.google.android.gms.internal.zzacc;-><init>:26	Field Access: android.os.Build.DEVICE
Source: com.google.android.gms.internal.zzagz;->zzhN:456	Field Access: android.os.Build$VERSION.RELEASE
Source: com.google.android.gms.internal.zzagz;->zzhN:459	Field Access: android.os.Build$VERSION.RELEASE
Source: com.google.android.gms.internal.zzagz;->zzhN:465	Field Access: android.os.Build.DEVICE
Source: com.google.android.gms.internal.zzagz;->zzhN:468	Field Access: android.os.Build.DEVICE
Source: com.google.android.gms.internal.zzagz;->zzhN:470	Field Access: android.os.Build.DISPLAY
Source: com.google.android.gms.internal.zzagz;->zzhN:473	Field Access: android.os.Build.DISPLAY
Source: com.google.android.gms.internal.zzagz;->zzhQ:497	Field Access: android.os.Build.MANUFACTURER
Source: com.google.android.gms.internal.zzagz;->zzhQ:498	Field Access: android.os.Build.MODEL
Source: com.google.android.gms.internal.zzaiy;->zza:64	Field Access: android.os.Build$VERSION.RELEASE
Source: com.google.android.gms.internal.zzaiy;->zzik:157	Field Access: android.os.Build.DEVICE
Source: com.google.android.gms.internal.zzcfw;->zzyK:158	Field Access: android.os.Build$VERSION.RELEASE
Source: com.google.android.gms.internal.zzcgl;->zza:156	Field Access: android.os.Build.MODEL
Source: com.google.android.gms.internal.zzcgl;->zza:159	Field Access: android.os.Build$VERSION.RELEASE
Source: com.google.android.gms.internal.zzcgl;->start:1400	Field Access: android.os.Build$VERSION.RELEASE
Source: com.google.android.gms.internal.zzcgl;->zza:1564	Field Access: android.os.Build.MODEL
Source: com.google.android.gms.internal.zzcgl;->zza:1567	Field Access: android.os.Build$VERSION.RELEASE
Source: com.google.android.gms.internal.zzdb;->zza:115	Field Access: android.os.Build$VERSION.SDK
Source: com.google.android.gms.internal.zzdb;->zzb:183	Field Access: android.os.Build$VERSION.SDK
Source: com.google.android.gms.internal.zzmq;-><init>:20	Field Access: android.os.Build$VERSION.RELEASE
Source: com.google.android.gms.internal.zzmq;-><init>:24	Field Access: android.os.Build$VERSION.SDK
Source: com.google.android.gms.internal.zzzi;->zza:106	Field Access: android.os.Build$VERSION.RELEASE
Source: com.google.android.exoplayer2.j.r;-><clinit>:3	Field Access: android.os.Build.DEVICE
Source: com.google.android.exoplayer2.j.r;-><clinit>:4	Field Access: android.os.Build.MANUFACTURER
Source: com.google.android.exoplayer2.j.r;-><clinit>:5	Field Access: android.os.Build.MODEL
Source: com.google.android.exoplayer2.j.r;->a:28	Field Access: android.os.Build$VERSION.RELEASE
Source: com.facebook.ads.internal.l.af;->b:28	Field Access: android.os.Build.TAGS
Source: com.startapp.android.publish.model.BaseRequest;->fillApplicationDetails:111	Field Access: android.os.Build.MANUFACTURER
Source: com.startapp.android.publish.model.BaseRequest;->fillApplicationDetails:113	Field Access: android.os.Build.MODEL

Executes logcat command

Show sources

Source: com.oneaudience.sdk.r;->c:46

API Call: java.lang.Runtime.exec ("logcat -d")

Queries several sensitive phone informations

Show sources

Source: Lcom/google/android/gms/internal/zzaiy;->zza(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;Landroid/os/Bundle;ZLcom/google/android/gms/internal/zzajb;)V	Method string: "os"
Source: Lcom/startapp/android/publish/model/BaseRequest;-><init>()V	Method string: "android"
Source: Lcom/startapp/android/publish/b/a;->a(Lcom/startapp/android/publish/StartAppAd$AdMode;Lcom/startapp/android/publish/model/AdPreferences;)V	Method string: "type"
Source: Lcom/google/android/gms/internal/zzako;->zziq()V	Method string: "version"
Source: Lcom/startapp/android/publish/model/BaseRequest;->getNameValueMap()Ljava/util/List;	Method string: "manufacturer"
Source: Lcom/google/firebase/auth/PhoneAuthCredential;->a()Ljava/lang/String;	Method string: "phone"
Source: Lcom/facebook/ads/internal/b/v;->g()Ljava/lang/String;	Method string: "appid"
Source: Lcom/oneaudience/sdk/q;->b(Landroid/content/Context;Ljava/util/Map;)V	Method string: "imei"
Source: Lcom/startapp/android/publish/model/BaseRequest;->getNameValueMap()Ljava/util/List;	Method string: "model"
Source: Lcom/facebook/ads/d;-><clinit>()V	Method string: "sdk"
Source: Lcom/google/android/gms/ads/internal/overlay/zzaa;->zzgc()V	Method string: "time"
Source: Lcom/startapp/android/publish/d/c;->getNameValueMap()Ljava/util/List;	Method string: "category"

Queries the unique operating system id (ANDROID_ID)

Show sources

Source: com.oneaudience.sdk.q;->a:16	API Call: android.provider.Settings.Secure.getString
Source: com.google.android.gms.internal.zzaiy;->zzV:19	API Call: android.provider.Settings$Secure.getString
Source: com.google.android.gms.internal.zzaiy;->zzW:22	API Call: android.provider.Settings$Secure.getString
Source: com.startapp.android.publish.model.BaseRequest;->setAndroidId:77	API Call: android.provider.Settings$Secure.getString

Tries to detect Virtualbox

Show sources

Source: Lcom/facebook/ads/d;-><clinit>()V	Method string: "vbox86p"
Source: Lcom/facebook/ads/d;-><clinit>()V	Method string: "vbox86p"
Source: Lcom/facebook/ads/d;-><clinit>()V	Method string: "vbox86tp"

HIPS / PFW / Operating System Protection Evasion:

Uses the DexClassLoader (often used for code injection)

Show sources

Source: com.google.android.gms.internal.zzdb;->zza:78	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.google.android.gms.internal.zzea;->zzX:14	API Call: dalvik.system.DexClassLoader.loadClass (not executed)

Language, Device and Operating System Detection:

Checks if phone is rooted (checks for Superuser.apk)

Show sources

Source: com.facebook.ads.internal.l.af;->c:44

API Call: java.io.File.<init>("/system/app/Superuser.apk")

Checks if phone is rooted (checks for test-keys build tags)

Show sources

Source: com.facebook.ads.internal.l.af;->b:30

API Call: java.lang.String.contains("test-keys")

Queries the SIM provider ISO country code

Show sources

Source: com.google.firebase.auth.FirebaseAuth;->zza:267

API Call: android.telephony.TelephonyManager.getSimCountryIso

Queries the SIM provider name (SPN - Service Provider Name)

Show sources

Source: com.startapp.android.publish.model.BaseRequest;->fillSimDetails:35

API Call: android.telephony.TelephonyManager.getSimOperatorName

Queries the SIM provider numeric MCC+MNC (mobile country code + mobile network code)

Show sources

Source: com.startapp.android.publish.model.BaseRequest;->fillSimDetails:33

API Call: android.telephony.TelephonyManager.getSimOperator

Queries the network MAC address

Show sources

Source: com.oneaudience.sdk.t;->a:8

API Call: java.net.NetworkInterface.getHardwareAddress

Queries the network operator ISO country code

Show sources

Source: com.mobistartapp.win7imulator.b.a;->t:1716	API Call: android.telephony.TelephonyManager.getNetworkCountryIso returned ""
Source: com.oneaudience.sdk.q;->b:26	API Call: android.telephony.TelephonyManager.getNetworkCountryIso

Queries the network operator name

Show sources

Source: com.facebook.ads.internal.g.a;->b:31

API Call: android.telephony.TelephonyManager.getNetworkOperatorName

Queries the network operator numeric MCC+MNC (mobile country code + mobile network code)

Show sources

Source: com.google.android.gms.internal.zzacc;->zzl:80	API Call: android.telephony.TelephonyManager.getNetworkOperator
Source: com.startapp.android.publish.model.BaseRequest;->fillNetworkOperatorDetails:29	API Call: android.telephony.TelephonyManager.getNetworkOperator

Queries the unqiue device ID (IMEI, MEID or ESN)

Show sources

Source: com.oneaudience.sdk.q;->b:24	API Call: android.telephony.TelephonyManager.getLine1Number
Source: com.oneaudience.sdk.q;->b:27	API Call: android.telephony.TelephonyManager.getDeviceId

Lowering of HIPS / PFW / Operating System Security Settings:

May check for install Android security applications (AV and firewalls)

Show sources

Source: Lcom/mobistartapp/win7imulator/b/a;->a()V	Method string: "com.antivirus"
Source: Lcom/mobistartapp/win7imulator/b/a;->a()V	Method string: "com.cleanmaster.security"
Source: Lcom/mobistartapp/win7imulator/b/a;->a()V	Method string: "com.avast.android.mobilesecurity"
Source: Lcom/mobistartapp/win7imulator/b/a;->a()V	Method string: "com.antivirus.tablet"
Source: Lcom/mobistartapp/win7imulator/b/a;->a()V	Method string: "com.drweb"
Source: Lcom/mobistartapp/win7imulator/b/a;->a()V	Method string: "com.avira.android"
Source: Lcom/mobistartapp/win7imulator/b/a;->a()V	Method string: "com.eset.ems2.gp"
Source: Lcom/mobistartapp/win7imulator/b/a;->a()V	Method string: "com.wsandroid.suite"
Source: Lcom/mobistartapp/win7imulator/b/a;->b()V	Method string: "com.antivirus"
Source: Lcom/mobistartapp/win7imulator/b/a;->b()V	Method string: "com.cleanmaster.security"
Source: Lcom/mobistartapp/win7imulator/b/a;->b()V	Method string: "com.avast.android.mobilesecurity"
Source: Lcom/mobistartapp/win7imulator/b/a;->b()V	Method string: "com.antivirus.tablet"
Source: Lcom/mobistartapp/win7imulator/b/a;->b()V	Method string: "com.drweb"
Source: Lcom/mobistartapp/win7imulator/b/a;->b()V	Method string: "com.avira.android"
Source: Lcom/mobistartapp/win7imulator/b/a;->b()V	Method string: "com.eset.ems2.gp"
Source: Lcom/mobistartapp/win7imulator/b/a;->b()V	Method string: "com.wsandroid.suite"

Stealing of Sensitive Information:

Uploads sensitive phone information to the internet (privacy leak)

Show sources

Source: 178.33.210.255:80 -> 192.168.1.99:42716

HTTP traffic detected: Header contains sensitive information: Galaxy Nexus (android.os.Build.USER)

Checks if a SIM card is installed

Show sources

Source: com.startapp.android.publish.model.BaseRequest;->fillSimDetails:32

API Call: android.telephony.TelephonyManager.getSimState

Has permissions to create, read or change account settings (inlcuding account password settings)

Show sources

Source: submitted apk

Request permission: android.permission.GET_ACCOUNTS

May take a camera picture

Show sources

Source: com.mobistartapp.win7imulator.b.a;->h:1487	API Call: android.content.Intent.<init>("android.media.action.IMAGE_CAPTURE")
Source: com.mobistartapp.win7imulator.b.a;->i:1530	API Call: android.content.Intent.<init>("android.media.action.IMAGE_CAPTURE")

Queries a list of installed applications

Show sources

Source: com.mobistartapp.win7imulator.activities.MainActivity;->e:380	API Call: android.content.pm.PackageManager.getInstalledApplications
Source: com.mobistartapp.win7imulator.activities.MainActivity;->f:395	API Call: android.content.pm.PackageManager.getInstalledApplications
Source: com.mobistartapp.win7imulator.b.c;->b:138	API Call: android.content.pm.PackageManager.getInstalledApplications
Source: com.oneaudience.sdk.ad;->c:8	API Call: android.content.pm.PackageManager.getInstalledApplications

Queries list of installed packages

Show sources

Source: com.startapp.android.publish.i.t;->c:40

API Call: android.content.pm.PackageManager.getInstalledPackages

Queries stored mail and application accounts (e.g. Gmail or Whatsup)

Show sources

Source: com.mobistartapp.win7imulator.b.a;->q:1676	API Call: android.accounts.Account.name
Source: com.mobistartapp.win7imulator.b.a;->q:1679	API Call: android.accounts.Account.name
Source: com.mobistartapp.win7imulator.b.a;->r:1689	API Call: android.accounts.AccountManager.getAccounts
Source: com.mobistartapp.win7imulator.b.a;->r:1692	API Call: android.accounts.Account.name
Source: com.google.android.gms.common.internal.zzq;->getAccountName:20	API Call: android.accounts.Account.name
Source: com.google.android.gms.internal.zzctu;->zza:65	API Call: android.accounts.Account.name
Source: com.oneaudience.sdk.ad;->d:67	API Call: android.accounts.AccountManager.getAccounts
Source: com.oneaudience.sdk.ae;->a:3	API Call: android.accounts.Account.name
Source: com.google.android.gms.auth.api.signin.GoogleSignInOptions;->zzmz:73	API Call: android.accounts.Account.name

Queries the Googlemail Account Name

Show sources

Source: com.mobistartapp.win7imulator.b.a;->q:1675

API Call: android.accounts.AccountManager.getAccountsByType

Reads logcat

Show sources

Source: com.oneaudience.sdk.r;->c:52

API Call: java.io.BufferedReader.readLine

Has permission to query the current location

Show sources

Source: submitted apk	Request permission: android.permission.ACCESS_COARSE_LOCATION
Source: submitted apk	Request permission: android.permission.ACCESS_FINE_LOCATION

Remote Access Functionality:

Uses DownloadManager to fetch additional components

Show sources

Source: com.google.android.gms.internal.zzwo;->onClick:14

API Call: android.app.DownloadManager.enqueue

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
com.mobistartapp.win7imulator.apk	0%	virustotal		Browse

Dropped Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
mobistartapp.com	0%	virustotal		Browse
www.mobistartapp.com	0%	virustotal		Browse

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report com.mobistartapp.win7imulator.apk

Overview

General Information

Detection

Confidence

Classification

Mitre Att&ck Matrix

Signature Similarity

Similar Samples

Signature Overview

Location Tracing:

Exploits:

Spreading:

Networking:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

Operating System Destruction:

Change of System Appearance:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Antivirus Detection

Initial Sample

Dropped Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Screenshots

Thumbnails