魔盾安全分析报告

分析类型	开始时间	结束时间	持续时间	分析引擎版本
FILE (apk)	2017-11-02 13:39:03	2017-11-02 13:42:20	197 秒	1.4-Maldun

魔盾分数
6.45 恶意的

文件详细信息

文件名	com.quwai.aoutdoor_10401.apk
文件大小	6858914 字节
文件类型	Java archive data (JAR)
CRC32	4322B0D8
MD5	15a675d7e85e51ab3a8b8c88b6bc9ef3
SHA1	88118ff043f38db461cb20195d78202469936a7b
SHA256	6e953cfbe4f93bc3b6d0daed7f91e9606dfdf5dc5f66e9889ad4841b92183d7b
SHA512	a1fc20dbcbfc3c3896738dfc907128681bfc0b2803a9481b995d11a23c2e9816e183cf69f6929e8248e9dd0e158f407b00ad62f60da1730c6488cdef4379a86f
Ssdeep	98304:UiUvAqekOiKcppDcsNvm05mCvwZl7OQELTyq5mGXvZVqpjR7jPAeArvkjRQjvKDI:UiDKOCpisNBmaLTyqvfZVgdvgvUuvJwu
PEiD	None matched
Yara	无匹配
VirusTotal	未查询到VirusTotal文件分析结果

安卓apk文件

Package	com.quwai.aoutdoor
Main Activity	com.quwai.aoutdoor.X5

Activities列表

Activity名称
com.quwai.aoutdoor.X5
com.quwai.aoutdoor.wxapi.WXEntryActivity
com.tencent.tauth.AuthActivity
com.tencent.connect.common.AssistActivity
com.synconset.MultiImageChooserActivity
com.google.zxing.client.android.CaptureActivity
com.google.zxing.client.android.encode.EncodeActivity
com.google.zxing.client.android.HelpActivity
com.quwai.aoutdoor.wxapi.WXPayEntryActivity
cn.jpush.android.ui.PushActivity
me.apla.cordova.AppPreferencesActivity

Services列表

Service名称
com.baidu.location.f
cn.jpush.android.service.DownloadService
cn.jpush.android.service.PushService

Receivers列表

Receiver行为
com.tencent.mm.plugin.openapi.Intent.ACTION_REFRESH_WXAPP
cn.jpush.android.intent.NOTIFICATION_RECEIVED_PROXY
android.intent.action.USER_PRESENT
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
cn.jpush.android.intent.NOTIFICATION_RECEIVED_PROXY
cn.jpush.android.intent.REGISTRATION
cn.jpush.android.intent.UNREGISTRATION
cn.jpush.android.intent.MESSAGE_RECEIVED
cn.jpush.android.intent.NOTIFICATION_RECEIVED
cn.jpush.android.intent.NOTIFICATION_OPENED
cn.jpush.android.intent.ACTION_RICHPUSH_CALLBACK

Permissions列表

危险: android.permission.INTERNET

正常: android.permission.ACCESS_NETWORK_STATE

正常: android.permission.ACCESS_WIFI_STATE

危险: android.permission.WRITE_EXTERNAL_STORAGE

危险: android.permission.READ_PHONE_STATE

危险: android.permission.CAMERA

正常: android.permission.FLASHLIGHT

危险: android.permission.ACCESS_COARSE_LOCATION

危险: android.permission.ACCESS_FINE_LOCATION

危险: android.permission.CHANGE_WIFI_STATE

其它: android.permission.MOUNT_UNMOUNT_FILESYSTEMS

其它: android.permission.READ_LOGS

危险: android.permission.RECORD_AUDIO

正常: android.permission.MODIFY_AUDIO_SETTINGS

危险: com.quwai.aoutdoor.permission.JPUSH_MESSAGE

危险: android.permission.RECEIVE_USER_PRESENT

正常: android.permission.WAKE_LOCK

正常: android.permission.READ_EXTERNAL_STORAGE

正常: android.permission.VIBRATE

危险: android.permission.SYSTEM_ALERT_WINDOW

正常: android.permission.WRITE_SETTINGS

特征低危险等级中危险等级高危险等级

发现隐藏加载

应用程序包含了其他APK文件

应用程序包含了本地共享对象(Shared Object)文件

应用程序注册了运行中接收器

应用程序运行中使用了反射机制

魔盾wping.org IP地址信誉系统

应用程序请求高风险许可权限

安卓动态分析

命令执行

查询账号

动态加载文件

SMS短消息

注册广播接收器

密钥

加密明文

Content Resolver Queries

Intents

反射调用

指纹

Content Observers

Shared Preferences

Content Values

电话状态监听

文件访问

系统特性

安卓静态分析

运行截图

网络分析

访问主机纪录

IP地址
{'country_name': 'China', 'ip': '182.254.152.30', 'inaddrarpa': '', 'hostname': 'www.aoutdoor.net', 'score': 5}

域名解析

域名	IP地址
www.aoutdoor.net	182.254.152.30

HTTP请求

URL	HTTP数据
http://www.aoutdoor.net/res/splash/splash1.jpg	GET /res/splash/splash1.jpg HTTP/1.1 Host: www.aoutdoor.net Connection: keep-alive Referer: http://localhost/x5/UI2/v-uQRJJf-zh_CN-/AOutdoor/portalActivity.w X-Requested-With: com.quwai.aoutdoor User-Agent: Mozilla/5.0 (Linux; U; Android 4.1.2; en-us; Nexus 5 Build/MASTER) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 x5app/1.4.1 Accept-Encoding: gzip,deflate Accept-Language: en-US Accept-Charset: utf-8, iso-8859-1, utf-16, *;q=0.7 Cookie: PHPSESSID=c2lkut1r4c1bnilj7n7scrumi7
http://www.aoutdoor.net/index.php/Server/Splash/getSplashs?callback=jsonpReturn&from=AOUTDOOR_DROID&code=1509601241656&token=BED1B4A17DC63DA5BA43D585C3F25A96&_=1509601226000	GET /index.php/Server/Splash/getSplashs?callback=jsonpReturn&from=AOUTDOOR_DROID&code=1509601241656&token=BED1B4A17DC63DA5BA43D585C3F25A96&_=1509601226000 HTTP/1.1 Host: www.aoutdoor.net Connection: keep-alive Referer: http://localhost/x5/UI2/v-uQRJJf-zh_CN-/AOutdoor/portalActivity.w Accept: / X-Requested-With: com.quwai.aoutdoor User-Agent: Mozilla/5.0 (Linux; U; Android 4.1.2; en-us; Nexus 5 Build/MASTER) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 x5app/1.4.1 Accept-Encoding: gzip,deflate Accept-Language: en-US Accept-Charset: utf-8, iso-8859-1, utf-16, *;q=0.7
http://www.aoutdoor.net/res/splash/splash2.jpg	GET /res/splash/splash2.jpg HTTP/1.1 Host: www.aoutdoor.net Connection: keep-alive Referer: http://localhost/x5/UI2/v-uQRJJf-zh_CN-/AOutdoor/portalActivity.w X-Requested-With: com.quwai.aoutdoor User-Agent: Mozilla/5.0 (Linux; U; Android 4.1.2; en-us; Nexus 5 Build/MASTER) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 x5app/1.4.1 Accept-Encoding: gzip,deflate Accept-Language: en-US Accept-Charset: utf-8, iso-8859-1, utf-16, *;q=0.7 Cookie: PHPSESSID=c2lkut1r4c1bnilj7n7scrumi7

URL

HTTP数据

http://www.aoutdoor.net/res/splash/splash1.jpg

GET /res/splash/splash1.jpg HTTP/1.1
Host: www.aoutdoor.net
Connection: keep-alive
Referer: http://localhost/x5/UI2/v-uQRJJf-zh_CN-/AOutdoor/portalActivity.w
X-Requested-With: com.quwai.aoutdoor
User-Agent: Mozilla/5.0 (Linux; U; Android 4.1.2; en-us; Nexus 5 Build/MASTER) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 x5app/1.4.1
Accept-Encoding: gzip,deflate
Accept-Language: en-US
Accept-Charset: utf-8, iso-8859-1, utf-16, *;q=0.7
Cookie: PHPSESSID=c2lkut1r4c1bnilj7n7scrumi7

http://www.aoutdoor.net/index.php/Server/Splash/getSplashs?callback=jsonpReturn&from=AOUTDOOR_DROID&code=1509601241656&token=BED1B4A17DC63DA5BA43D585C3F25A96&_=1509601226000

GET /index.php/Server/Splash/getSplashs?callback=jsonpReturn&from=AOUTDOOR_DROID&code=1509601241656&token=BED1B4A17DC63DA5BA43D585C3F25A96&_=1509601226000 HTTP/1.1
Host: www.aoutdoor.net
Connection: keep-alive
Referer: http://localhost/x5/UI2/v-uQRJJf-zh_CN-/AOutdoor/portalActivity.w
Accept: */*
X-Requested-With: com.quwai.aoutdoor
User-Agent: Mozilla/5.0 (Linux; U; Android 4.1.2; en-us; Nexus 5 Build/MASTER) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 x5app/1.4.1
Accept-Encoding: gzip,deflate
Accept-Language: en-US
Accept-Charset: utf-8, iso-8859-1, utf-16, *;q=0.7

http://www.aoutdoor.net/res/splash/splash2.jpg

GET /res/splash/splash2.jpg HTTP/1.1
Host: www.aoutdoor.net
Connection: keep-alive
Referer: http://localhost/x5/UI2/v-uQRJJf-zh_CN-/AOutdoor/portalActivity.w
X-Requested-With: com.quwai.aoutdoor
User-Agent: Mozilla/5.0 (Linux; U; Android 4.1.2; en-us; Nexus 5 Build/MASTER) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 x5app/1.4.1
Accept-Encoding: gzip,deflate
Accept-Language: en-US
Accept-Charset: utf-8, iso-8859-1, utf-16, *;q=0.7
Cookie: PHPSESSID=c2lkut1r4c1bnilj7n7scrumi7

动态HTTP/HTTPS请求

内存分析

无内存分析结果

android.intent.action.PHONE_STATE
android.security.STORAGE_CHANGED
android.intent.action.PACKAGE_ADDED
android.intent.action.CONFIGURATION_CHANGED
android.intent.action.PROXY_CHANGE
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_REMOVED

debug.hwui.disable_vsync
dalvik.vm.heapsize
debug.hwui.profile
persist.sys.timezone
dalvik.vm.heapgrowthlimit
debug.sqlite.syncmode
debug.hwui.print_config
debug.hwui.show_dirty_regions
viewancestor.profile_rendering
debug.sqlite.journalmode

6.45

恶意的