3D抓R 英文版.apk MD5:d8eb9db23be13035e55adb9f0f67f824 0% Scanner(s) (0/32) found malware! - VirSCAN.org - Free Multi-Engine Online Virus Scanner v1.02, Supports 47 AntiVirus Engines!

Main Menu

API

uploader for windows(test)

Powered By

File information

File Name :3D抓R 英文版.apk (File not down)

File Size :14057780 byte

File Type :Zip archive data

MD5:d8eb9db23be13035e55adb9f0f67f824

SHA1:d8336ac1bbda47aad6c82d2c59ffd308ecbcd7ab

SHA256:d92bc18ec9e971d8bfd2ba0e21f54469816d1bc61e8ea8e39a213ba572b4faf3

SSDEEP:393216:4oeplpFDWcfTUAg6ftYOolrAP/qj0EazG5VMy85sn:4oeFDWcLUAgoYgOWGPnNn

扫描结果
权限
文件行为分析

Scanner results

Scanner results:0%Scanner(s) (0/32)found malware!

Behavior analysis report: Habo file analysis

Time: 2016-08-30 11:16:49 (CST)

Scanner	Engine Ver	Sig Ver	Sig Date	Scan result	Time
antiy	AVL SDK 3.0		1970-01-01	Found nothing	18
asquared	9.0.0.4324	9.0.0.4324	2014-07-03	Found nothing	6
avast	150725-1	4.7.4	2015-07-25	Found nothing	60
avg	2109/8133	10.0.1405	2014-11-26	Found nothing	60
baidu	2.0.1.0	4.1.3.52192	2.0.1.0	Found nothing	5
baidusd	1.0	1.0	2014-04-02	Found nothing	9
bitdefender	7.58469	7.90123	2014-12-25	Found nothing	60
clamav	19861	0.97.5	2014-12-31	Found nothing	60
drweb	5.0.2.3300	5.0.1.1	2014-12-31	Found nothing	60
fortinet	23.345, 23.345	5.1.158	2014-12-08	Found nothing	60
fprot	4.6.2.117	6.5.1.5418	2014-12-31	Found nothing	60
fsecure	2014-04-02-01	9.13	2014-04-02	Found nothing	60
gdata	25.8084	25.8084	2016-08-30	Found nothing	34
ikarus	1.06.01	V1.32.31.0	2014-12-08	Found nothing	60
jiangmin	16.0.100	1.0.0.0	2015-07-25	Found nothing	60
kaspersky	5.5.33	5.5.33	2014-04-01	Found nothing	60
kingsoft	2.1	2.1	2013-09-22	Found nothing	23
mcafee	7638	5400.1158	2014-11-30	Found nothing	60
nod32	0920	3.0.21	2014-12-23	Found nothing	60
panda	9.05.01	9.05.01	2015-07-26	Found nothing	4
pcc	11.380.07	9.500-1005	2014-12-31	Found nothing	60
qh360	1.0.1	1.0.1	1.0.1	Found nothing	14
qqphone	1.0.0.0	1.0.0.0	2014-12-09	Found nothing	60
quickheal	14.00	14.00	2015-07-25	Found nothing	21
rising	25.76.04.01	25.76.04.01	2015-07-24	Found nothing	6
sophos	5.08	3.55.0	2014-12-01	Found nothing	60
symantec	20141230.001	1.3.0.24	2014-12-30	Found nothing	60
tachyon	9.9.9	9.9.9	2013-12-27	Found nothing	41
thehacker	6.8.0.5	6.8.0.5	2015-07-23	Found nothing	2
tws	17.47.17308	1.0.2.2108	2014-12-08	Found nothing	23
vba	3.12.26.3	3.12.26.3	2014-12-31	Found nothing	60
virusbuster	15.0.985.0	5.5.2.13	2014-12-05	Found nothing	60

■Heuristic/Suspicious ■Exact

NOTICE: Results are not 100% accurate and can be reported as a false positive by some scannerswhen and if malware is found. Please judge these results for yourself.

权限列表
许可名称	信息
android.permission.ACCESS_WIFI_STATE	读取wifi网络状态
android.permission.SYSTEM_ALERT_WINDOW	显示系统窗口
android.permission.READ_PHONE_STATE	读取电话状态
android.permission.ACCESS_NETWORK_STATE	读取网络状态（2G或3G）
android.permission.WRITE_EXTERNAL_STORAGE	写外部存储器（如：SD卡）
android.permission.INTERNET	连接网络（2G或3G）
android.permission.GET_TASKS	获取有关当前或最近运行的任务信息

文件信息

安全评分 :

基本信息
MD5:d8eb9db23be13035e55adb9f0f67f824
包名:com.boobtoob.swtr3
最低运行环境:Android 2.0.1
版权:pnp

关键行为
行为描述:	跨进程写入数据
详情信息:	TargetProcess = C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe, WriteAddress = 0x7ffde008, Size = 0x00000004
行为描述:	获取TickCount值
详情信息:	TickCount = 5368426, SleepMilliseconds = 20.
	TickCount = 5368457, SleepMilliseconds = 20.
	TickCount = 5368488, SleepMilliseconds = 20.
	TickCount = 5368504, SleepMilliseconds = 20.
	TickCount = 5428500, SleepMilliseconds = 60000.
行为描述:	直接获取CPU时钟
详情信息:	N/A
行为描述:	设置线程上下文
详情信息:	C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe
行为描述:	检测自身是否被调试
详情信息:	N/A

进程行为
行为描述:	创建进程
详情信息:	ImagePath = C:\Documents and Settings\Administrator\Local Settings\%temp%\**.exe, CmdLine = "C:\Documents and Settings\Administrator\Local Settings\%temp%\**.exe"
行为描述:	创建本地线程
详情信息:	TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 1980, ThreadID = 444, StartAddress = 792A741C, Parameter = 00000000
	TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 1980, ThreadID = 252, StartAddress = 791F59C0, Parameter = 001B0398
	TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 1980, ThreadID = 1140, StartAddress = 791F5751, Parameter = 00000000
	TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 1980, ThreadID = 1408, StartAddress = 792F7F68, Parameter = 00000000
	TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 1980, ThreadID = 300, StartAddress = 77E56C7D, Parameter = 001E74D8
	TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 1980, ThreadID = 156, StartAddress = 769AE43B, Parameter = 001CBC58
行为描述:	设置线程上下文
详情信息:	C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe
行为描述:	跨进程写入数据
详情信息:	TargetProcess = C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe, WriteAddress = 0x7ffde008, Size = 0x00000004

文件行为
行为描述:	查找文件
详情信息:	FileName = C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
	FileName = C:\WINDOWS\Microsoft.NET\Framework\\*
	FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.INI
	FileName = C:\Documents and Settings\Administrator\Local Settings\Temp
	FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%
	FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe
	FileName = C:\Documents and Settings
	FileName = C:\Documents and Settings\Administrator
	FileName = C:\Documents and Settings\Administrator\Local Settings
	FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\996E.INI
	FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.INI
	FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.INI
	FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
	FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
	FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI

其他行为
行为描述:	检测自身是否被调试
详情信息:	N/A
行为描述:	创建互斥体
详情信息:	CTF.LBES.MutexDefaultS-*
	CTF.Compart.MutexDefaultS-*
	CTF.Asm.MutexDefaultS-*
	CTF.Layouts.MutexDefaultS-*
	CTF.TMD.MutexDefaultS-*
	CTF.TimListCache.FMPDefaultS-MUTEX.DefaultS-
行为描述:	创建事件对象
详情信息:	EventName = Global\CPFATE_1980_v4.0.30319
行为描述:	窗口信息
详情信息:	Pid = 588, Hwnd=0x80358, Text = 确定, ClassName = Button.
	Pid = 588, Hwnd=0x1802fe, Text = 应用程序正常初始化(0xc000007b)失败。请单击“确定”，终止应用程序。 , ClassName = Static.
	Pid = 588, Hwnd=0x902da, Text = Windows - 应用程序错误, ClassName = #32770.
行为描述:	打开互斥体
详情信息:	ShimCacheMutex
行为描述:	打开事件
详情信息:	Global\CLR_PerfMon_StartEnumEvent
	\KernelObjects\LowMemoryCondition
	HookSwitchHookEnabledEvent
	MSFT.VSA.COM.DISABLE.1980
	MSFT.VSA.IEC.STATUS.6c736db0
行为描述:	获取TickCount值
详情信息:	TickCount = 5368426, SleepMilliseconds = 20.
	TickCount = 5368457, SleepMilliseconds = 20.
	TickCount = 5368488, SleepMilliseconds = 20.
	TickCount = 5368504, SleepMilliseconds = 20.
	TickCount = 5428500, SleepMilliseconds = 60000.
行为描述:	调整进程token权限
详情信息:	SE_DEBUG_PRIVILEGE
行为描述:	枚举窗口
详情信息:	N/A
行为描述:	调用Sleep函数
详情信息:	[1]: MilliSeconds = -1.
	[2]: MilliSeconds = 60000.
行为描述:	直接获取CPU时钟
详情信息:	N/A

Activities
活动名	类型
.AdMobTestActivity	android.intent.action.MAIN
.AdMobTestActivity	android.intent.category.LAUNCHER

危险函数
函数名称	信息
java/net/URL;->openConnection	连接URL
java/net/HttpURLConnection;->connect	连接URL
LocationManager;->getLastKnownLocation	获取地址位置
getRuntime	获取命令行环境
TelephonyManager;->getDeviceId	搜集用户手机IMEI码、电话号码、系统版本号等信息

启动方式
名称	信息
com.admob.android.ads.analytics.InstallReceiver

权限列表
许可名称	信息
android.permission.ACCESS_WIFI_STATE	读取wifi网络状态
android.permission.SYSTEM_ALERT_WINDOW	显示系统窗口
android.permission.READ_PHONE_STATE	读取电话状态
android.permission.ACCESS_NETWORK_STATE	读取网络状态（2G或3G）
android.permission.WRITE_EXTERNAL_STORAGE	写外部存储器（如：SD卡）
android.permission.INTERNET	连接网络（2G或3G）
android.permission.GET_TASKS	获取有关当前或最近运行的任务信息

服务列表
名称
eudc.fqngr.py

文件列表
文件名	校验码
META-INF/MANIFEST.MF	0xb8523d63
META-INF/ZHONGL.SF	0x43a7e74c
META-INF/ZHONGL.RSA	0xed0d99e6
assets/bin/Data/Managed/Assembly-CSharp-firstpass.dll	0xdbc73c8
assets/bin/Data/Managed/Assembly-CSharp.dll	0xf79623b1
assets/bin/Data/Managed/Assembly-UnityScript-firstpass.dll	0x434696d6
assets/bin/Data/Managed/Assembly-UnityScript.dll	0x558eaaf2
assets/bin/Data/Managed/Boo.Lang.dll	0x61a12b81
assets/bin/Data/Managed/Mono.Security.dll	0x33c5fa34
assets/bin/Data/Managed/System.dll	0x24dd8f48
assets/bin/Data/Managed/UnityEngine.dll	0xed7566f0
assets/bin/Data/Managed/UnityScript.Lang.dll	0xb47c53fb
assets/bin/Data/Managed/mscorlib.dll	0x3fafd3dd
assets/bin/Data/mainData	0xa4a9681e
assets/bin/Data/settings.xml	0x3a82d3d4
assets/bin/Data/sharedassets0.assets	0xb2f78866
assets/bin/Data/splash.png	0xd78777ef
assets/bin/Data/unity default resources	0xa5fe73bf
assets/libs/armeabi-v7a/libunity.so	0x799bad35
assets/eu	0x6eb02340
lib/armeabi-v7a/lib1337loader.so	0x2ca032c
lib/armeabi-v7a/libgfhnm.so	0xd273e939
res/drawable/app_icon.png	0xbd12acd4
res/drawable/app_splash.png	0xc3bf210f
res/drawable-hdpi/app_icon.png	0x11bf88ba
res/layout/notification.xml	0xd5acd603
res/layout/push_notification.xml	0xeaedfe79
AndroidManifest.xml	0x2a12cce3
classes.dex	0x5e1174cc
resources.arsc	0x97996c4e

运行截图