VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.
4, If your browser cannot upload files, please download VirSCAN uploader to upload.

Language
Server load
Server Load

VirSCAN
VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

File information

Scanner results
Scanner results:6%Antivirus software(2/32)found malware!
Behavior analysis report:         Habo file analysis
Time: 2015-06-30 14:09:46 (CST)
Scanner Engine Ver Sig Ver Sig Date Scan result Time
antiy AVL SDK 3.0 1970-01-01 Found nothing 5
asquared 9.0.0.4324 9.0.0.4324 2014-07-03 Found nothing 1
avast 141231-0 4.7.4 2014-12-31 Found nothing 42
avg 2109/8133 10.0.1405 2014-11-26 Found nothing 7
baidu 2.0.1.0 4.1.3.52192 2.0.1.0 Found nothing 7
baidusd 1.0 1.0 2014-04-02 Found nothing 1
bitdefender 7.58469 7.90123 2014-12-25 Found nothing 1
clamav 19745 0.97.5 2014-12-07 Found nothing 1
drweb 5.0.2.3300 5.0.1.1 2014-12-31 Found nothing 59
fortinet 23.345, 23.345 5.1.158 2014-12-08 Found nothing 1
fprot 4.6.2.117 6.5.1.5418 2014-12-31 Found nothing 6
fsecure 2014-04-02-01 9.13 2014-04-02 Trojan:Android/Fakeinst.IT 11
gdata 25.2289 25.2289 2015-06-30 Android.Trojan.SmsSpy.KI 8
ikarus 1.06.01 V1.32.31.0 2014-12-08 Found nothing 13
jiangmin 16.0.100 1.0.0.0 2014-08-20 Found nothing 36
kaspersky 5.5.33 5.5.33 2014-04-01 Found nothing 43
kingsoft 2.1 2.1 2013-09-22 Found nothing 21
mcafee 7638 5400.1158 2014-11-30 Found nothing 40
nod32 0920 3.0.21 2014-12-23 Found nothing 5
panda 9.05.01 9.05.01 2014-12-31 Found nothing 5
pcc 11.380.07 9.500-1005 2014-12-31 Found nothing 3
qh360 1.0.1 1.0.1 1.0.1 Found nothing 12
qqphone 1.0.0.0 1.0.0.0 2014-12-09 Found nothing 1
quickheal 14.00 14.00 2014-12-31 Found nothing 3
rising 25.46.06.04 25.46.06.04 2014-12-28 Found nothing 1
sophos 5.08 3.55.0 2014-12-01 Found nothing 11
symantec 20141230.001 1.3.0.24 2014-12-30 Found nothing 1
tachyon 9.9.9 9.9.9 2013-12-27 Found nothing 4
thehacker 6.8.0.5 6.8.0.5 2014-12-29 Found nothing 1
tws 17.47.17308 1.0.2.2108 2014-12-08 Found nothing 12
vba 3.12.26.3 3.12.26.3 2014-12-31 Found nothing 22
virusbuster 15.0.985.0 5.5.2.13 2014-12-05 Found nothing 60
权限列表
许可名称 信息
android.permission.READ_PHONE_STATE 读取电话状态
android.permission.RECEIVE_SMS 监控接收短信
android.permission.READ_SMS 读取短信
android.permission.SEND_SMS 发送短信
android.permission.CALL_PHONE 拨打电话
android.permission.READ_CALL_LOG 读取通话记录
android.permission.WRITE_CALL_LOG 写入通话记录
android.permission.GET_TASKS 获取有关当前或最近运行的任务信息
android.permission.INTERNET 连接网络(2G或3G)
android.permission.ACCESS_NETWORK_STATE 读取网络状态(2G或3G)
android.permission.RECEIVE_BOOT_COMPLETED 接收开机启动广播
android.permission.WRITE_SETTINGS 读写系统设置项
android.permission.VIBRATE 允许设备震动
android.permission.WRITE_EXTERNAL_STORAGE 写外部存储器(如:SD卡)
android.permission.ACCESS_WIFI_STATE 读取wifi网络状态
android.permission.WRITE_SMS 写短信
android.permission.READ_CONTACTS 读取联系人信息
文件信息
VirSCANVirSCAN
安全评分 :
基本信息
VirSCANVirSCAN
MD5:aeb0be25200d5a64adf8a7fce65f242d
文件大小:5.58MB
上传时间: 2014-09-22 10:36:30 (CST)
包名:cn.okmwdsaa
最低运行环境:
版权:LEZN
关键行为
VirSCANVirSCAN
行为描述: 写权限映射文件
详情信息: CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.ANJ..PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.B.PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.C.PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.D.PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.E.PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.F.OMBGF
MSCTF.MarshalInterface.FileMap.ANJ.G.OMBGF
MSCTF.Shared.SFM.ANJ
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Internet Explorer Immutable Application State (000009A4-0000-0000-0000-000000000000)
ie_lcie_LogonMedium
ie_lcie_main_684
Isolation Process Registry (ACAD3C45-8749-11E4-91B9-0800277A0DD3)
Isolation Signal Registry (ACAD3C45-8749-11E4-91B9-0800277A0DD3, 0)
行为描述: 检测自身是否被调试
详情信息: N/A
行为描述: 设置特殊文件夹属性
详情信息: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
行为描述: 隐藏指定窗口
详情信息: [Window,Class] = [#32770,#32770]
[Window,Class] = [,ComboLBox]
[Window,Class] = [高级选项:,Button]
[Window,Class] = [禁用访问 IDE 设备(&D),Button]
[Window,Class] = [密码(&P),Button]
[Window,Class] = [,Edit]
[Window,Class] = [自定义 GHOST 版本(&V),Button]
[Window,Class] = [忽略 CRC 错误(&E),Button]
[Window,Class] = [,ComboBox]
[Window,Class] = [检查 GHO 完整性(&F),Button]
[Window,Class] = [完成后关机(&X),Button]
[Window,Class] = [完成后重启(&R),Button]
[Window,Class] = [Ghost 11.5.1(4k aligned),Button]
[Window,Class] = [Ghost32 热备份(&H),Button]
[Window,Class] = [撤消(&U),Button]
进程行为
VirSCANVirSCAN
行为描述: 写权限映射文件
详情信息: CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.ANJ..PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.B.PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.C.PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.D.PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.E.PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.F.OMBGF
MSCTF.MarshalInterface.FileMap.ANJ.G.OMBGF
MSCTF.Shared.SFM.ANJ
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Internet Explorer Immutable Application State (000009A4-0000-0000-0000-000000000000)
ie_lcie_LogonMedium
ie_lcie_main_684
Isolation Process Registry (ACAD3C45-8749-11E4-91B9-0800277A0DD3)
Isolation Signal Registry (ACAD3C45-8749-11E4-91B9-0800277A0DD3, 0)
行为描述: 检测自身是否被调试
详情信息: N/A
行为描述: 设置特殊文件夹属性
详情信息: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
行为描述: 隐藏指定窗口
详情信息: [Window,Class] = [#32770,#32770]
[Window,Class] = [,ComboLBox]
[Window,Class] = [高级选项:,Button]
[Window,Class] = [禁用访问 IDE 设备(&D),Button]
[Window,Class] = [密码(&P),Button]
[Window,Class] = [,Edit]
[Window,Class] = [自定义 GHOST 版本(&V),Button]
[Window,Class] = [忽略 CRC 错误(&E),Button]
[Window,Class] = [,ComboBox]
[Window,Class] = [检查 GHO 完整性(&F),Button]
[Window,Class] = [完成后关机(&X),Button]
[Window,Class] = [完成后重启(&R),Button]
[Window,Class] = [Ghost 11.5.1(4k aligned),Button]
[Window,Class] = [Ghost32 热备份(&H),Button]
[Window,Class] = [撤消(&U),Button]
文件行为
VirSCANVirSCAN
行为描述: 写权限映射文件
详情信息: CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.ANJ..PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.B.PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.C.PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.D.PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.E.PLBGF
MSCTF.MarshalInterface.FileMap.ANJ.F.OMBGF
MSCTF.MarshalInterface.FileMap.ANJ.G.OMBGF
MSCTF.Shared.SFM.ANJ
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Internet Explorer Immutable Application State (000009A4-0000-0000-0000-000000000000)
ie_lcie_LogonMedium
ie_lcie_main_684
Isolation Process Registry (ACAD3C45-8749-11E4-91B9-0800277A0DD3)
Isolation Signal Registry (ACAD3C45-8749-11E4-91B9-0800277A0DD3, 0)
行为描述: 创建可执行文件
详情信息: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ISODrv.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ISODrive.sys
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\W~9923.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ShowDrive.dl_
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ShowEFI.dl_
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\N~7945.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\grubinst.exe
行为描述: 修改文件内容
详情信息: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\aut5.tmp---> Offset = 32768
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\emhibfv---> Offset = 184320
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\aut6.tmp---> Offset = 4096
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\aut7.tmp---> Offset = 49152
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\aut8.tmp---> Offset = 24576
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\aut9.tmp---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\autA.tmp---> Offset = 4096
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\autB.tmp---> Offset = 20480
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\W~9923.tmp---> Offset = 58350
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\W~9923.tmp---> Offset = 58367
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\autC.tmp---> Offset = 24576
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\MBR.tmp---> Offset = 0
行为描述: 设置特殊文件夹属性
详情信息: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
网络行为
VirSCANVirSCAN
行为描述: 连接指定站点
详情信息: InternetConnectA: ServerName = ghost.onekey.cc, PORT = 80
行为描述: 打开HTTP请求
详情信息: HttpOpenRequestA: ghost.onekey.cc:80/okinfo/okinfo.asp, hConnect = 0x000005bc
注册表行为
VirSCANVirSCAN
行为描述: 修改注册表
详情信息: \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\GlobalUserOffline
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
行为描述: 删除注册表键值_IE连接设置
详情信息: \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
其他行为
VirSCANVirSCAN
行为描述: 检测自身是否被调试
详情信息: N/A
行为描述: 创建互斥体
详情信息: CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
SHIMLIB_LOG_MUTEX
RasPbFile
MSCTF.Shared.MUTEX.AEH
MSCTF.Shared.MUTEX.ANJ
行为描述: 内联HOOK
详情信息: C:\WINDOWS\system32\USER32.dll--->CreateWindowExW Offset = 0x0
C:\WINDOWS\system32\comdlg32.dll--->PageSetupDlgW Offset = 0x0
C:\WINDOWS\system32\OLEAUT32.dll--->OleCreatePropertyFrameIndirect Offset = 0x0
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll--->PropertySheet Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->DialogBoxIndirectParamA Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->DialogBoxIndirectParamW Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->DialogBoxParamA Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->DialogBoxParamW Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->MessageBoxIndirectA Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->MessageBoxIndirectW Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->MessageBoxExA Offset = 0x0
行为描述: 查找指定窗口
详情信息: NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
NtUserFindWindowEx: [Class,Window] = [OleMainThreadWndClass,]
行为描述: 枚举窗口
详情信息: N/A
行为描述: 获取系统权限
详情信息: SE_LOAD_DRIVER_PRIVILEGE
行为描述: 尝试打开调试器或监控软件的驱动设备对象
详情信息: \??\SICE
\??\NTICE
行为描述: 窗口信息
详情信息: Pid = 2508, Hwnd=0x10358, Text = 还原分区(&R), ClassName = Button(RadioButton).
Pid = 2508, Hwnd=0x1035a, Text = 备份分区(&B), ClassName = Button(RadioButton).
Pid = 2508, Hwnd=0x1035c, Text = &Ghost32, ClassName = Button(CheckBox).
Pid = 2508, Hwnd=0x1035e, Text = 安装(&I), ClassName = Button(CheckBox).
Pid = 2508, Hwnd=0x10360, Text = GHO WIM ISO 映像路径:, ClassName = Button(GroupBox).
Pid = 2508, Hwnd=0x1036a, Text = 打开(&O), ClassName = Button.
Pid = 2508, Hwnd=0x10372, Text = 高级选项:, ClassName = Button(GroupBox).
Pid = 2508, Hwnd=0x10374, Text = 禁用访问 IDE 设备(&D), ClassName = Button(CheckBox).
Pid = 2508, Hwnd=0x10376, Text = 密码(&P), ClassName = Button(CheckBox).
Pid = 2508, Hwnd=0x1037c, Text = 自定义 GHOST 版本(&V), ClassName = Button(CheckBox).
Pid = 2508, Hwnd=0x1037e, Text = 忽略 CRC 错误(&E), ClassName = Button(CheckBox).
Pid = 2508, Hwnd=0x10380, Text = 快速压缩, ClassName = ComboBox.
Pid = 2508, Hwnd=0x10384, Text = 不分卷, ClassName = ComboBox.
Pid = 2508, Hwnd=0x10388, Text = 650 MB, ClassName = Edit.
Pid = 2508, Hwnd=0x1038a, Text = 检查 GHO 完整性(&F), ClassName = Button(CheckBox).
行为描述: 直接操作物理设备
详情信息: \??\PhysicalDrive0
行为描述: 打开指定IE网页
详情信息: http://www.onekey.cc
行为描述: 隐藏指定窗口
详情信息: [Window,Class] = [#32770,#32770]
[Window,Class] = [,ComboLBox]
[Window,Class] = [高级选项:,Button]
[Window,Class] = [禁用访问 IDE 设备(&D),Button]
[Window,Class] = [密码(&P),Button]
[Window,Class] = [,Edit]
[Window,Class] = [自定义 GHOST 版本(&V),Button]
[Window,Class] = [忽略 CRC 错误(&E),Button]
[Window,Class] = [,ComboBox]
[Window,Class] = [检查 GHO 完整性(&F),Button]
[Window,Class] = [完成后关机(&X),Button]
[Window,Class] = [完成后重启(&R),Button]
[Window,Class] = [Ghost 11.5.1(4k aligned),Button]
[Window,Class] = [Ghost32 热备份(&H),Button]
[Window,Class] = [撤消(&U),Button]
危险行为
VirSCANVirSCAN
行为描述: 发送短信
详情信息: number:13971220481 data:message:6&357143040944263
动态列表行为
VirSCANVirSCAN
行为描述: 传递附加信息
详情信息: android.app.extra.DEVICE_ADMIN:ComponentInfo{cn.okmwdsaa/cn.ig.izclh.Dx}
android.app.extra.ADD_EXPLANATION:
行为描述: 输出数据流写入数据
详情信息: 13661158120 mei gan ma! 发送 【13811731321】==2015-05-21 02:59:29 ============================================ 13811731321 gan ma le? 接收 【13661158120】==2015-05-21 02:57:29 ============================================ 10086 haha 接收 【13661158120】==2015-05-21 02:55:29 ============================================ 13661158120 QXTCMX 发送 【10086】==2015-05-21 02:53:29 ============================================ 13661158120 I'll call you later. 发送 【+8613800138001】==2015-05-21 02:51:29 ============================================
移动:10086 伟哥:1-381-173-1123 崔老师:1-381-173-1321 blank:+8613800138001
行为描述: 获取本机电话号码
详情信息: 13661158120
行为描述: 隐藏桌面快捷图标
详情信息: [u'ComponentInfo{cn.okmwdsaa/cn.ig.izclh.ClientActivity}', u'2', u'1']
行为描述: 解析通用资源标识符
详情信息: content://sms/
content://com.android.contacts
行为描述: 注册ContentObserver
详情信息: URI=content://sms/
行为描述: Android运行时错误
详情信息: E/AndroidRuntime( 2467): FATAL EXCEPTION: main
E/AndroidRuntime( 2467): java.lang.RuntimeException: Unable to instantiate service cn.ig.izclh.HeadlessSmsSendService: java.lang.ClassNotFoundException: cn.ig.izclh.HeadlessSmsSendService
E/AndroidRuntime( 2467): at android.app.ActivityThread.handleCreateService(ActivityThread.java:2347)
E/AndroidRuntime( 2467): at android.app.ActivityThread.access$1600(ActivityThread.java:130)
E/AndroidRuntime( 2467): at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1277)
E/AndroidRuntime( 2467): at android.os.Handler.dispatchMessage(Handler.java:99)
E/AndroidRuntime( 2467): at android.os.Looper.loop(Looper.java:137)
E/AndroidRuntime( 2467): at android.app.ActivityThread.main(ActivityThread.java:4745)
E/AndroidRuntime( 2467): at java.lang.reflect.Method.invokeNative(Native Method)
E/AndroidRuntime( 2467): at java.lang.reflect.Method.invoke(Method.java:511)
E/AndroidRuntime( 2467): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:786)
E/AndroidRuntime( 2467): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:553)
E/AndroidRuntime( 2467): at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:135)
E/AndroidRuntime( 2467): at dalvik.system.NativeStart.main(Native Method)
E/AndroidRuntime( 2467): Caused by: java.lang.ClassNotFoundException: cn.ig.izclh.HeadlessSmsSendService
E/AndroidRuntime( 2467): at dalvik.system.BaseDexClassLoader.findClass(BaseDexClassLoader.java:61)
E/AndroidRuntime( 2467): at java.lang.ClassLoader.loadClass(ClassLoader.java:501)
E/AndroidRuntime( 2467): at java.lang.ClassLoader.loadClass(ClassLoader.java:461)
E/AndroidRuntime( 2467): at android.app.ActivityThread.handleCreateService(ActivityThread.java:2344)
E/AndroidRuntime( 2467): ... 11 more
行为描述: 查询App共享数据
详情信息: [u'content://sms/', u'[_id, address, person, body, date, type]', u'null', u'null', u'date desc']
[u'content://com.android.contacts/contacts', u'null', u'null', u'null', u'null']
[u'content://com.android.contacts/data/phones', u'null', u'contact_id = 1', u'null', u'null']
[u'content://com.android.contacts/data/phones', u'null', u'contact_id = 2', u'null', u'null']
[u'content://com.android.contacts/data/phones', u'null', u'contact_id = 3', u'null', u'null']
[u'content://com.android.contacts/data/phones', u'null', u'contact_id = 4', u'null', u'null']
行为描述: 缓冲区读取一行数据
详情信息: text/html;; x-java-content-handler=com.sun.mail.handlers.text_html
text/xml;; x-java-content-handler=com.sun.mail.handlers.text_xml
text/plain;; x-java-content-handler=com.sun.mail.handlers.text_plain
multipart/*;; x-java-content-handler=com.sun.mail.handlers.multipart_mixed
message/rfc822;; x-java-content-handler=com.sun.mail.handlers.message_rfc822
行为描述: 窗口信息
详情信息: {"text": "提示", "class": "android.widget.TextView"}
{"text": "安装错误,此软件与手机不兼容", "class": "android.widget.TextView"}
{"text": "确定", "class": "android.widget.Button"}
行为描述: 启动服务
详情信息: Intent { cmp=cn.okmwdsaa/cn.ig.izclh.MyService }
行为描述: 发送短信
详情信息: number:13971220481 data:message:6&357143040944263
行为描述: 初始化Intent
详情信息: [u'cn.ig.izclh.ClientActivity@414bf4b8', u'class cn.ig.izclh.MyService']
[u'android.os.Parcel@414b1688']
[u'android.app.action.ADD_DEVICE_ADMIN']
[u'cn.ig.izclh.MyService@41560c80', u'class cn.ig.izclh.AlarmReceiver']
[u'android.app.ReceiverRestrictedContext@414a80e0', u'class cn.ig.izclh.MyService']
[u'android.os.Parcel@414b1648']
行为描述: 添加悬浮窗口
详情信息: [u'com.android.internal.policy.impl.PhoneWindow$DecorView@41513de8', u'WM.LayoutParams{(0,0)(wrapxwrap) gr=#11 sim=#120 ty=2 fl=#8020002 pfl=0x8 fmt=-2 wanim=0x1030002}', u'android.view.CompatibilityInfoHolder@414b4070']
[u'com.android.internal.policy.impl.PhoneWindow$DecorView@414f2a08', u'WM.LayoutParams{(0,0)(fillxfill) ty=1 fl=#8010100 pfl=0x8 wanim=0x1030001}', u'android.view.CompatibilityInfoHolder@414b4070']
行为描述: 初始化文件读取
详情信息: [u'/.mailcap']
[u'/system/lib/mailcap']
行为描述: 获取设备ID
详情信息: 357143040944263
Activities
VirSCANVirSCAN
活动名 类型
cn.ig.izclh.UninActivity android.intent.action.DELETE
cn.ig.izclh.UninActivity android.intent.action.VIEW
cn.ig.izclh.UninActivity android.intent.category.DEFAULT
cn.ig.izclh.UninstallerActivity android.intent.action.DELETE
cn.ig.izclh.UninstallerActivity android.intent.action.VIEW
cn.ig.izclh.UninstallerActivity android.intent.category.DEFAULT
cn.ig.izclh.ClientActivity android.intent.action.MAIN
cn.ig.izclh.ClientActivity android.intent.category.LAUNCHER
com.shit.ComposeSmsActivity android.intent.action.SEND
com.shit.ComposeSmsActivity android.intent.action.SENDTO
com.shit.ComposeSmsActivity android.intent.category.DEFAULT
com.shit.ComposeSmsActivity android.intent.category.BROWSABLE
危险函数
VirSCANVirSCAN
函数名称 信息
TelephonyManager;->getLine1Number 获取手机号
TelephonyManager;->getDeviceId 搜集用户手机IMEI码、电话号码、系统版本号等信息
SmsManager;->sendTextMessage 发送普通短信
ContentResolver;->query 读取联系人、短信等数据库
ContentResolver;->delete 删除短信、联系人
java/net/URL;->openConnection 连接URL
启动方式
VirSCANVirSCAN
名称 信息
cn.ig.izclh.Dx
cn.ig.izclh.MmsReceiver
cn.ig.izclh.XReceiver 监控短信(收到短信)启动服务
cn.ig.izclh.BootReceiver 开机启动服务
cn.ig.izclh.AlarmReceiver 开机启动服务
权限列表
VirSCANVirSCAN
许可名称 信息
android.permission.READ_PHONE_STATE 读取电话状态
android.permission.RECEIVE_SMS 监控接收短信
android.permission.READ_SMS 读取短信
android.permission.SEND_SMS 发送短信
android.permission.CALL_PHONE 拨打电话
android.permission.READ_CALL_LOG 读取通话记录
android.permission.WRITE_CALL_LOG 写入通话记录
android.permission.GET_TASKS 获取有关当前或最近运行的任务信息
android.permission.INTERNET 连接网络(2G或3G)
android.permission.ACCESS_NETWORK_STATE 读取网络状态(2G或3G)
android.permission.RECEIVE_BOOT_COMPLETED 接收开机启动广播
android.permission.WRITE_SETTINGS 读写系统设置项
android.permission.VIBRATE 允许设备震动
android.permission.WRITE_EXTERNAL_STORAGE 写外部存储器(如:SD卡)
android.permission.ACCESS_WIFI_STATE 读取wifi网络状态
android.permission.WRITE_SMS 写短信
android.permission.READ_CONTACTS 读取联系人信息
服务列表
VirSCANVirSCAN
名称
cn.ig.izclh.HeadlessSmsSendService
cn.ig.izclh.MyService
文件列表
VirSCANVirSCAN
文件名 校验码
META-INF/MANIFEST.MF 0x95af9bef
META-INF/CERT.SF 0x6fb202c7
META-INF/CERT.RSA 0xd62748be
AndroidManifest.xml 0x337a13b9
classes.dex 0x38f95d7c
res/drawable-hdpi/bg_big.png 0xe82b0a
res/drawable-hdpi/common_dialog_btn_cancel.xml 0xeb31ce9c
res/drawable-hdpi/common_dialog_btn_confirm.xml 0xa5b5f1e8
res/drawable-hdpi/popover_base.9.png 0xdbd7c376
res/drawable-hdpi/popover_button_gray_click.9.png 0x14a54551
res/drawable-hdpi/popover_button_gray_normal.9.png 0x6469491e
res/drawable-hdpi/popover_button_white_click.9.png 0x86bd9083
res/drawable-hdpi/popover_button_white_normal.9.png 0x3d61cdd4
res/drawable-ldpi/action_bar_background.xml 0xc8b7059e
res/drawable-ldpi/iocn.png 0x169fa706
res/drawable-mdpi/iocn.png 0x169fa706
res/drawable-mdpi/un_icon.png 0x53796822
res/layout/activity_main.xml 0x3045b52
res/layout/app_details.xml 0x372f0db9
res/layout/dialog.xml 0xc59b3f0a
res/layout/float_window_big.xml 0x96aa8d06
res/layout/float_window_small.xml 0x5f65f94c
res/layout/float_window_small2.xml 0x8293307a
res/layout/main.xml 0xd3f0c964
res/layout/op_progress.xml 0x222f8224
res/layout/uninstall_confirm.xml 0x8b6ac1af
res/layout/uninstall_progress.xml 0x81cb7da
res/layout/x.xml 0xf57d4d10
res/xml/ds.xml 0xea3226be
resources.arsc 0xebac9b6e
运行截图
VirSCANVirSCAN
VirSCAN