jianshe.apk MD5:4ff98d2a5f045921757b73faa1d6012d 12% Scanner(s) (4/32) found malware! - VirSCAN.org - Free Multi-Engine Online Virus Scanner v1.02, Supports 47 AntiVirus Engines!

Main Menu

API

uploader for windows(test)

Powered By

File information

File Name :jianshe.apk (File not down)

File Size :22449 byte

File Type :application/zip

MD5:4ff98d2a5f045921757b73faa1d6012d

SHA1:7cf20ada4a7d7224b58a2972094759b3832beaa1

扫描结果
权限
文件行为分析

Scanner results

Scanner results:12%Scanner(s) (4/32)found malware!

Behavior analysis report: Habo file analysis

Time: 2016-06-08 20:32:30 (CST)

Scanner	Engine Ver	Sig Ver	Sig Date	Scan result	Time
antiy	AVL SDK 3.0		1970-01-01	Found nothing	5
asquared	9.0.0.4324	9.0.0.4324	2014-07-03	Android.Trojan.SmsSpy.AS	1
avast	150725-1	4.7.4	2015-07-25	Found nothing	60
avg	2109/8133	10.0.1405	2014-11-26	Found nothing	60
baidu	2.0.1.0	4.1.3.52192	2.0.1.0	Found nothing	12
baidusd	1.0	1.0	2014-04-02	Found nothing	1
bitdefender	7.58469	7.90123	2014-12-25	Found nothing	60
clamav	19861	0.97.5	2014-12-31	Found nothing	60
drweb	5.0.2.3300	5.0.1.1	2014-12-31	Found nothing	60
fortinet	23.345, 23.345	5.1.158	2014-12-08	Found nothing	60
fprot	4.6.2.117	6.5.1.5418	2014-12-31	Found nothing	60
fsecure	2014-04-02-01	9.13	2014-04-02	Found nothing	60
gdata	25.6868	25.6868	2016-06-07	Android.Trojan.SmsSpy.AS	8
ikarus	1.06.01	V1.32.31.0	2014-12-08	Found nothing	60
jiangmin	16.0.100	1.0.0.0	2015-07-25	Found nothing	43
kaspersky	5.5.33	5.5.33	2014-04-01	Found nothing	60
kingsoft	2.1	2.1	2013-09-22	Android.Troj.ya_BqSpy.ya.(kcloud)	5
mcafee	7638	5400.1158	2014-11-30	Found nothing	60
nod32	0920	3.0.21	2014-12-23	Found nothing	60
panda	9.05.01	9.05.01	2015-07-26	Found nothing	5
pcc	11.380.07	9.500-1005	2014-12-31	Found nothing	60
qh360	1.0.1	1.0.1	1.0.1	Found nothing	2
qqphone	1.0.0.0	1.0.0.0	2014-12-09	Found nothing	60
quickheal	14.00	14.00	2015-07-25	Android.Agent.DB	2
rising	25.76.04.01	25.76.04.01	2015-07-24	Found nothing	1
sophos	5.08	3.55.0	2014-12-01	Found nothing	60
symantec	20141230.001	1.3.0.24	2014-12-30	Found nothing	60
tachyon	9.9.9	9.9.9	2013-12-27	Found nothing	3
thehacker	6.8.0.5	6.8.0.5	2015-07-23	Found nothing	1
tws	17.47.17308	1.0.2.2108	2014-12-08	Found nothing	13
vba	3.12.26.3	3.12.26.3	2014-12-31	Found nothing	60
virusbuster	15.0.985.0	5.5.2.13	2014-12-05	Found nothing	60

■Heuristic/Suspicious ■Exact

NOTICE: Results are not 100% accurate and can be reported as a false positive by some scannerswhen and if malware is found. Please judge these results for yourself.

权限列表
许可名称	信息
android.permission.RECEIVE_BOOT_COMPLETED	接收开机启动广播
android.permission.RECEIVE_USER_PRESENT
android.permission.RECEIVE_SMS	监控接收短信
android.permission.SEND_SMS	发送短信
android.permission.READ_PHONE_STATE	读取电话状态
android.permission.BROADCAST_SMS	收到短信时广播
android.permission.READ_SMS	读取短信
android.permission.WRITE_SMS	写短信
android.permission.ACCESS_FINE_LOCATION	获取精确的位置（通过GPS）
android.permission.CAMERA	访问照相机设备
android.permission.INTERNET	连接网络（2G或3G）
android.permission.READ_LOGS	读取系统日志

文件信息

安全评分 :

基本信息
MD5:4ff98d2a5f045921757b73faa1d6012d
包名:cn.android.emiaIvae
最低运行环境:Android 2.2.x
版权:

关键行为
行为描述:	探测 Virtual PC是否存在
详情信息:	N/A
行为描述:	尝试打开调试器或监控软件的驱动设备对象
详情信息:	\??\SICE
	\??\SIWVID
	\??\NTICE
行为描述:	获取TickCount值
详情信息:	TickCount = 1075643, SleepMilliseconds = 50.
	TickCount = 1075690, SleepMilliseconds = 50.
	TickCount = 1075706, SleepMilliseconds = 50.
	TickCount = 1075768, SleepMilliseconds = 50.
	TickCount = 1076237, SleepMilliseconds = 50.
	TickCount = 1076425, SleepMilliseconds = 50.
	TickCount = 1076612, SleepMilliseconds = 50.
	TickCount = 1076659, SleepMilliseconds = 50.
	TickCount = 1076675, SleepMilliseconds = 50.
	TickCount = 1076690, SleepMilliseconds = 50.
	TickCount = 1076768, SleepMilliseconds = 50.
	TickCount = 1077050, SleepMilliseconds = 50.
	TickCount = 1077065, SleepMilliseconds = 50.
	TickCount = 1077081, SleepMilliseconds = 50.
	TickCount = 1077096, SleepMilliseconds = 50.
行为描述:	设置特殊文件夹属性
详情信息:	C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
	C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
	C:\Documents and Settings\Administrator\Local Settings\History
	C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
	C:\Documents and Settings\Administrator\Cookies
行为描述:	查询注册表_检测虚拟机相关
详情信息:	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
行为描述:	查找指定内核模块
详情信息:	lstrcmpiA: ntice.sys <------> ntkrnlpa.exe Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> hal.dll Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> KDCOM.DLL Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> BOOTVID.dll Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> ACPI.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> WMILIB.SYS Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> pci.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> isapnp.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> compbatt.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> BATTC.SYS Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> intelide.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> PCIIDEX.SYS Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> MountMgr.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> ftdisk.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> dmload.sys Des: SoftICE驱动
行为描述:	查找反病毒常用工具窗口
详情信息:	NtUserFindWindowEx: [Class,Window] = [OLLYDBG,]
	NtUserFindWindowEx: [Class,Window] = [GBDYLLO,]
	NtUserFindWindowEx: [Class,Window] = [pediy06,]
	NtUserFindWindowEx: [Class,Window] = [FilemonClass,]
	NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com]
	NtUserFindWindowEx: [Class,Window] = [PROCMON_WINDOW_CLASS,]
	NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com]
	NtUserFindWindowEx: [Class,Window] = [RegmonClass,]
	NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com]

进程行为
行为描述:	枚举进程
详情信息:	N/A

文件行为
行为描述:	创建文件
详情信息:	C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6P4O8QNJ\wpad[1].dat
	C:\Documents and Settings\Administrator\My Documents\xunlei.ini
行为描述:	修改文件内容
详情信息:	C:\Documents and Settings\Administrator\My Documents\xunlei.ini ---> Offset = 0
	C:\Documents and Settings\Administrator\My Documents\xunlei.ini ---> Offset = 55
	C:\Documents and Settings\Administrator\My Documents\xunlei.ini ---> Offset = 74
	C:\Documents and Settings\Administrator\My Documents\xunlei.ini ---> Offset = 88
行为描述:	设置特殊文件夹属性
详情信息:	C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
	C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
	C:\Documents and Settings\Administrator\Local Settings\History
	C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
	C:\Documents and Settings\Administrator\Cookies
行为描述:	删除文件
详情信息:	C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6P4O8QNJ\wpad[1].dat
行为描述:	查找文件
详情信息:	FileName = C:\Documents and Settings
	FileName = C:\Documents and Settings\Administrator
	FileName = C:\Documents and Settings\Administrator\Local Settings
	FileName = C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
	FileName = C:\WINDOWS\system32\Ras\*.pbk
	FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft\Network\Connections\Pbk\*.pbk

网络行为
行为描述:	联网打开网址
详情信息:	InternetOpenUrlA: http://.133.40.:128/wpad.dat, hInternet = 0x00cc0010, Flags = 0x00000010
行为描述:	连接指定站点
详情信息:	InternetConnectA: ServerName = ww****om, PORT = 80, UserName = , Password = , hSession = 0x00cc0004, hConnect = 0x00cc0008, Flags = 0x00000000
	InternetConnectA: ServerName = .133.40., PORT = 128, UserName = , Password = , hSession = 0x00cc0010, hConnect = 0x00cc0014, Flags = 0x00000010
行为描述:	打开HTTP连接
详情信息:	InternetOpenA: UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0), hSession = 0x00cc0004
	InternetOpenA: UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Win32; Trident/4.0), hSession = 0x00cc0010
行为描述:	建立到一个指定的套接字连接
详情信息:	URL: wpad, IP: .133.40.:128, SOCKET = 0x000003bc
	URL: ww**om, IP: .133.40.**:80, SOCKET = 0x000003b8
行为描述:	读取网络文件
详情信息:	hFile = 0x00cc0018, BytesToRead =4010, BytesRead = 4010.
	hFile = 0x00cc000c, BytesToRead =102400, BytesRead = 102400.
行为描述:	发送HTTP包
详情信息:	GET /wpad.dat HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32; Trident/4.0) Host: .133.40.:128
	GET /qn/urlconfig.txt HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) Accept: / Host: ww****om Cache-Control: no-cache
行为描述:	打开HTTP请求
详情信息:	HttpOpenRequestA: ww****om:80/qn/urlconfig.txt, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x84000000
	HttpOpenRequestA: .133.40.:128/wpad.dat, hConnect = 0x00cc0014, hRequest = 0x00cc0018, Verb: GET, Referer: , Flags = 0x00000010
行为描述:	按名称获取主机地址
详情信息:	GetAddrInfoW: computer
	GetAddrInfoW: wpad
	GetAddrInfoW: ww****om

注册表行为
行为描述:	修改注册表
详情信息:	\REGISTRY\USER\S-*\Software\Microsoft\Multimedia\DrawDib\vga.drv 1920x973x16(565 0)
	\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
	\REGISTRY\MACHINE\SOFTWARE\Microsoft\ESENT\Process\996E\DEBUG\Trace Level
行为描述:	删除注册表键值
详情信息:	\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
	\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
	\REGISTRY\MACHINE\SOFTWARE\Microsoft\ESENT\Process\996E\DEBUG\Trace Level
行为描述:	查询注册表_检测虚拟机相关
详情信息:	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

其他行为
行为描述:	探测 Virtual PC是否存在
详情信息:	N/A
行为描述:	创建互斥体
详情信息:	RasPbFile
	CTF.LBES.MutexDefaultS-*
	CTF.Compart.MutexDefaultS-*
	CTF.Asm.MutexDefaultS-*
	CTF.Layouts.MutexDefaultS-*
	CTF.TMD.MutexDefaultS-*
	CTF.TimListCache.FMPDefaultS-MUTEX.DefaultS-
	Local\ZonesCounterMutex
	Local\ZoneAttributeCacheCounterMutex
	Local\ZonesCacheCounterMutex
	Local\ZonesLockedCacheCounterMutex
	MSCTF.Shared.MUTEX.ELH
	MSCTF.Shared.MUTEX.AFJ
行为描述:	创建事件对象
详情信息:	EventName = DINPUTWINMM
	EventName = jzyqfhdslinbc
	EventName = Global\userenv: User Profile setup event
	EventName = Global\crypt32LogoffEvent
	EventName = MSCTF.SendReceive.Event.AFJ.IC
	EventName = MSCTF.SendReceiveConection.Event.AFJ.IC
行为描述:	查找指定窗口
详情信息:	NtUserFindWindowEx: [Class,Window] = [18467-41,]
	NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
	NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
行为描述:	尝试打开调试器或监控软件的驱动设备对象
详情信息:	\??\SICE
	\??\SIWVID
	\??\NTICE
行为描述:	搜索kernel32.dll基地址
详情信息:	Instruction Address = 0x00656aad
行为描述:	窗口信息
详情信息:	Pid = 2380, Hwnd=0x4036c, Text = Tips:获取到的账号不可用请更换服务器重新获取！, ClassName = Afx:400000:b:10011:1900015:0.
	Pid = 2380, Hwnd=0xe031e, Text = 红包迅雷白金账号获取器, ClassName = WTWindow.
	Pid = 2380, Hwnd=0x902fc, Text = 确定, ClassName = Button.
	Pid = 2380, Hwnd=0x40370, Text = V2.1.9.0 更新说明： 1.新增独立复制账号密码按钮（获取账号后可见）。 2.集成了迅雷防踢补丁DLL(第一次运行弹窗提示是否安装)，后续自, ClassName = Static.
	Pid = 2380, Hwnd=0x70336, Text = 更新说明：, ClassName = #32770.
	Pid = 2380, Hwnd=0x50370, Text = 确定, ClassName = Button.
	Pid = 2380, Hwnd=0xa02fc, Text = 运行时出错! 错误代码：1 错误信息：数组成员引用下标超出定义范围 , ClassName = Static.
	Pid = 2380, Hwnd=0x80336, Text = 错误, ClassName = #32770.
行为描述:	隐藏指定窗口
详情信息:	[Window,Class] = [,_EL_CommonDlg]
	[Window,Class] = [,_EL_PicBox]
	[Window,Class] = [,_EL_Timer]
	[Window,Class] = [标签,_EL_Label]
	[Window,Class] = [,_EL_RgnButton]
	[Window,Class] = [,Shell Embedding]
行为描述:	获取TickCount值
详情信息:	TickCount = 1075643, SleepMilliseconds = 50.
	TickCount = 1075690, SleepMilliseconds = 50.
	TickCount = 1075706, SleepMilliseconds = 50.
	TickCount = 1075768, SleepMilliseconds = 50.
	TickCount = 1076237, SleepMilliseconds = 50.
	TickCount = 1076425, SleepMilliseconds = 50.
	TickCount = 1076612, SleepMilliseconds = 50.
	TickCount = 1076659, SleepMilliseconds = 50.
	TickCount = 1076675, SleepMilliseconds = 50.
	TickCount = 1076690, SleepMilliseconds = 50.
	TickCount = 1076768, SleepMilliseconds = 50.
	TickCount = 1077050, SleepMilliseconds = 50.
	TickCount = 1077065, SleepMilliseconds = 50.
	TickCount = 1077081, SleepMilliseconds = 50.
	TickCount = 1077096, SleepMilliseconds = 50.
行为描述:	查找指定内核模块
详情信息:	lstrcmpiA: ntice.sys <------> ntkrnlpa.exe Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> hal.dll Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> KDCOM.DLL Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> BOOTVID.dll Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> ACPI.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> WMILIB.SYS Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> pci.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> isapnp.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> compbatt.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> BATTC.SYS Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> intelide.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> PCIIDEX.SYS Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> MountMgr.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> ftdisk.sys Des: SoftICE驱动
	lstrcmpiA: ntice.sys <------> dmload.sys Des: SoftICE驱动
行为描述:	查找反病毒常用工具窗口
详情信息:	NtUserFindWindowEx: [Class,Window] = [OLLYDBG,]
	NtUserFindWindowEx: [Class,Window] = [GBDYLLO,]
	NtUserFindWindowEx: [Class,Window] = [pediy06,]
	NtUserFindWindowEx: [Class,Window] = [FilemonClass,]
	NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com]
	NtUserFindWindowEx: [Class,Window] = [PROCMON_WINDOW_CLASS,]
	NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com]
	NtUserFindWindowEx: [Class,Window] = [RegmonClass,]
	NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com]

Activities
活动名	类型
cn.android.emiaI.MainActivity	android.intent.action.MAIN
cn.android.emiaI.MainActivity	android.intent.category.LAUNCHER
cn.android.emiaI.UninstallerActivity	android.intent.action.VIEW
cn.android.emiaI.UninstallerActivity	android.intent.action.DELETE
cn.android.emiaI.UninstallerActivity	android.intent.category.DEFAULT

危险函数
函数名称	信息
ContentResolver;->query	读取联系人、短信等数据库
ContentResolver;->delete	删除短信、联系人
SmsManager;->sendMultipartTextMessage	发送彩信

启动方式
名称	信息
cn.android.emiaI.BootReceiver	监控短信（收到短信）启动服务
cn.android.emiaI.BootReceiver
cn.android.emiaI.BootReceiver
cn.android.emiaI.BootReceiver
cn.android.emiaI.BootReceiver	开机启动服务
cn.android.emiaI.BootReceiver	屏幕解锁启动服务
cn.android.emiaI.SmSReceiver	监控短信（收到短信）启动服务
cn.android.emiaI.SmSReceiver
cn.android.emiaI.SmSReceiver
cn.android.emiaI.DeviceReceiver

权限列表
许可名称	信息
android.permission.RECEIVE_BOOT_COMPLETED	接收开机启动广播
android.permission.RECEIVE_USER_PRESENT
android.permission.RECEIVE_SMS	监控接收短信
android.permission.SEND_SMS	发送短信
android.permission.READ_PHONE_STATE	读取电话状态
android.permission.BROADCAST_SMS	收到短信时广播
android.permission.READ_SMS	读取短信
android.permission.WRITE_SMS	写短信
android.permission.ACCESS_FINE_LOCATION	获取精确的位置（通过GPS）
android.permission.CAMERA	访问照相机设备
android.permission.INTERNET	连接网络（2G或3G）
android.permission.READ_LOGS	读取系统日志

服务列表
名称
cn.android.emiaI.SmSserver

文件列表
文件名	校验码
META-INF/MANIFEST.MF	0xed7501b
META-INF/APKIDE.SF	0x941fb824
META-INF/APKIDE.RSA	0xd0896aae
res/drawable-hdpi/ic_launcher.png	0xa7ec1d69
res/drawable-hdpi/icon.png	0xac8b5a00
res/layout/activity_main.xml	0x3ba3db3f
res/xml/lock_screen.xml	0xeab2c16b
AndroidManifest.xml	0xb95e30a4
classes.dex	0x5986df2c
resources.arsc	0x82141a9a

运行截图