ID: Sample Name: fonttable.xml Cookbook: defaultandroidfilecookbook.jbs Time: 05:14:58 Date: 27/04/2018 Version:

Transcription

1 ID: 6926 Sample Name: fonttable.xml Cookbook: defaultandroidfilecookbook.jbs Time: 0:14: Date: 2/04/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Classification Signature Overview System Summary: Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General Static APK Info General Receivers Permission Requested Certificate Resources Network Behavior TCP Packets HTTP Packets APK Behavior Installation Miscellaneous By Permission (executed) By Permission (non-executed) By Class (executed) By Class (non-executed) By API Disassembly 0 Executed Methods 0 Non-Executed Methods Copyright Joe Security LLC 201 Page 2 of

3 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 6926 Start time: 0:14: Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 0m 2s false light fonttable.xml Analysis system description: Android 6.0 Detection: Classification: Warnings: Errors: defaultandroidfilecookbook.jbs CLEAN Show All No dynamic data available Static analyzation failed: null Setup command "_JBInstrumentAPK" failed: Invalid APK Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Classification Copyright Joe Security LLC 201 Page of

4 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview System Summary Click to jump to signature section Copyright Joe Security LLC 201 Page 4 of

5 System Summary: Classification label Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs Copyright Joe Security LLC 201 Page of

6 No. of IPs < 2% 2% < No. of IPs < 0% 0% < No. of IPs < % % < No. of IPs IP Country Flag ASN ASN Name Malicious United States 1169 GOOGLE-GoogleIncUS false Static File Info General File type: XML document text Entropy (bit): TrID: Generic XML (ASCII) (00/1) % File name: File size: 196 MD: SHA1: SHA26: SHA12: File Content Preview: fonttable.xml cc6ff121b04eb96e024e1bb64b0 0ce6ab24a1dbea0ee14a1b1e f2924e0c9d019b9cdcca269ce6bd4c d1cc1dc0d4e2e0be fdddce1a1cacba0ac94dfeb92429d9b129 94c2bc6fbcfdabc11e0002ad20d2b6a4bbbad0 fddcac699f14c092c9e600db99a11 <?xml version="1.0" encoding="utf-" standalone="ye s"?>.<w:fonts xmlns:mc=" s.org/markup-compatibility/2006" xmlns:o="urn:schema s-microsoft-com:office:office" xmlns:r=" penxmlformats.org/officedocument/2006/relati Static APK Info General Label: Version Code: Version Name: Package Name: Is Activity: Is Receiver: Is Service: Requests System Level Permissions: Play Store Compatible: Copyright Joe Security LLC 201 Page 6 of

7 Receivers Permission Requested Certificate Name: Issuer: Subject: Resources Name Type Size Network Behavior TCP Packets Timestamp Source Port Dest Port Source IP Dest IP Apr 2, 201 0:1: CEST Apr 2, 201 0:1: CEST HTTP Packets Session ID Source IP Source Port Destination IP Destination Port Timestamp kbytes transferred Direction Data Apr 2, IN HTTP/ No Content 0:1: CEST Content-Length: 0 Date: Fri, 2 Apr 201 0:1:1 GMT APK Behavior Installation Miscellaneous By Permission (executed) By Permission (non-executed) By Class (executed) Copyright Joe Security LLC 201 Page of

8 By Class (non-executed) By API Disassembly 0 Executed Methods 0 Non-Executed Methods Copyright Joe Security LLC 201 Copyright Joe Security LLC 201 Page of