File name:

Фото альбом 16шт.apk

Full analysis: https://app.any.run/tasks/11fc422f-453b-4769-bea8-b1ffdf3b5474
Verdict: Malicious activity
Analysis date: April 15, 2025, 18:18:31
OS: Android 14
MIME: application/vnd.android.package-archive
File info: Android package (APK), with AndroidManifest.xml, with APK Signing Block
MD5:

AFA4994025006D05FF3FEB0DADB2F0F1

SHA1:

1758731CE6BBC41BF83E842062C48FA7B7122C4C

SHA256:

0B006C1C52C53CD7189E5261F55071D34BE1BE007B304E6D63637C71EC548056

SSDEEP:

98304:9upO+wPXihnoJm23DqnskaiUReSGPxCWgfmBzznsUyHV+Y/LJ+VCqsexK9SzK7nc:AEAxT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Sends SMS messages

      • app_process64 (PID: 2236)

  • SUSPICIOUS

    • Updates data in the storage of application settings (SharedPreferences)

      • app_process64 (PID: 2236)

    • Uses encryption API functions

      • app_process64 (PID: 2236)

    • Connects to unusual port

      • app_process64 (PID: 2236)

  • INFO

    • Dynamically inspects or modifies classes, methods, and fields at runtime

      • app_process64 (PID: 2236)

    • Retrieves data from storage of application settings (SharedPreferences)

      • app_process64 (PID: 2236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jar | Java Archive (78.3)
.zip | ZIP compressed archive (21.6)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: 0x0800
ZipCompression: Unknown (32499)
ZipModifyDate: 2025:04:15 17:19:14
ZipCRC: 0x7e762293
ZipCompressedSize: 5488
ZipUncompressedSize: 15680
ZipFileName: AndroidManifest.xml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start app_process64 app_process32 app_process32 no specs app_process64 no specs app_process32

Process information

PID
CMD
Path
Indicators
Parent process
2236com.example.application /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2271zygote /system/bin/app_process32
app_process32
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2285webview_zygote /system/bin/app_process32—app_process32
User:
webview_zygote
Integrity Level:
UNKNOWN
Exit code:
0
2301com.android.traceur /system/bin/app_process64—app_process64
User:
u0_a53
Integrity Level:
UNKNOWN
Exit code:
512
2327zygote /system/bin/app_process32
app_process32
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
60
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
2236app_process64/data/data/com.example.application/shared_prefs/Prefs.xmlxml
MD5:—
SHA256:—
2236app_process64/data/data/com.example.application/shared_prefs/WebViewChromiumPrefs.xmlxml
MD5:—
SHA256:—
2236app_process64/data/data/com.example.application/app_webview/Default/Local Storage/leveldb/MANIFEST-000001binary
MD5:—
SHA256:—
2236app_process64/data/data/com.example.application/app_webview/Default/Local Storage/leveldb/000001.dbtmptext
MD5:—
SHA256:—
2236app_process64/data/data/com.example.application/app_webview/Default/Local Storage/leveldb/CURRENTtext
MD5:—
SHA256:—
2236app_process64/data/data/com.example.application/cache/WebView/Default/HTTP Cache/Code Cache/webui_js/indexbinary
MD5:—
SHA256:—
2236app_process64/data/data/com.example.application/cache/WebView/Default/HTTP Cache/Code Cache/js/indexbinary
MD5:—
SHA256:—
2236app_process64/data/data/com.example.application/cache/WebView/Default/HTTP Cache/Code Cache/wasm/indexbinary
MD5:—
SHA256:—
2236app_process64/data/data/com.example.application/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-indexbinary
MD5:—
SHA256:—
2236app_process64/data/data/com.example.application/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-indexbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
28
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
142.250.181.227:80
http://connectivitycheck.gstatic.com/generate_204
unknown
—
—
whitelisted
2236
app_process64
POST
200
193.68.89.188:400
http://193.68.89.188:400/event
unknown
—
—
—
2236
app_process64
POST
200
5.252.153.222:400
http://5.252.153.222:400/event
unknown
—
—
—
2236
app_process64
POST
200
91.214.78.172:400
http://91.214.78.172:400/gettingData
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
449
mdnsd
224.0.0.251:5353
—
—
—
unknown
—
—
216.239.35.0:123
time.android.com
—
—
whitelisted
—
—
142.250.181.227:80
connectivitycheck.gstatic.com
GOOGLE
US
whitelisted
—
—
172.217.16.196:443
www.google.com
GOOGLE
US
whitelisted
—
—
142.251.18.81:443
staging-remoteprovisioning.sandbox.googleapis.com
GOOGLE
US
whitelisted
2236
app_process64
91.214.78.172:400
—
JSC Universal Card Technologies
RU
unknown
2327
app_process32
142.250.184.195:443
update.googleapis.com
GOOGLE
US
whitelisted
2271
app_process32
142.250.185.227:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
2327
app_process32
142.250.185.142:443
dl.google.com
GOOGLE
US
whitelisted
2236
app_process64
45.79.77.88:443
www.photo-pick.com
Linode, LLC
US
unknown

DNS requests

Domain
IP
Reputation
www.google.com
  • 172.217.16.196
whitelisted
connectivitycheck.gstatic.com
  • 142.250.181.227
whitelisted
google.com
  • 142.250.185.174
whitelisted
time.android.com
  • 216.239.35.0
  • 216.239.35.12
  • 216.239.35.4
  • 216.239.35.8
whitelisted
staging-remoteprovisioning.sandbox.googleapis.com
  • 142.251.18.81
whitelisted
update.googleapis.com
  • 142.250.184.195
whitelisted
clientservices.googleapis.com
  • 142.250.185.227
whitelisted
dl.google.com
  • 142.250.185.142
whitelisted
www.photo-pick.com
  • 45.79.77.88
unknown
fonts.googleapis.com
  • 216.58.206.42
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Android Device Connectivity Check
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Фото альбом 16шт.apk