21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious SPR/ANDR.WAMod.BAB Sample 25ca09764b27… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 25ca09764b27…. Malware family: SPR/ANDR.WAMod.BAB. Threat score 100/100. 1/26 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/25ca09764b275f4d1037b30dcbdb95583292fbb3ab8cf2e2dd822b513f17bb4a","keywords":["Malicious","SPR/ANDR.WAMod.BAB","malware analysis","sandbox report","threat intelligence","25ca09764b275f4d1037b30dcbdb95583292fbb3ab8cf2e2dd822b513f17bb4a"],"about":{"@type":"SoftwareApplication","name":"FMWhatsAppFouadWhatsApp v9.73F Premium Mod Apk {CracksHash}.apk","applicationCategory":["android"],"identifier":"25ca09764b275f4d1037b30dcbdb95583292fbb3ab8cf2e2dd822b513f17bb4a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"SPR/ANDR.WAMod.BAB","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T2c68,"SELECT * FROM workspec WHERE last_enqueue_time >= ? AND state IN (2, 3, 5) ORDER BY last_enqueue_time DESC" (Source: androidx.work.impl.workers.DiagnosticsWorker.smali, Indicator: "select * from workspec where last_enqueue_time >= ? and state in (2, 3, 5) order by last_enqueue_time desc"), "SELECT id state output run_attempt_count generation FROM workspec WHERE id IN (SELECT work_spec_id FROM workname WHERE name=?)" (Source: X.0bC.smali, Indicator: "select id state output run_attempt_count generation from workspec where id in (select work_spec_id from workname where name=?)"), "CREATE TABLE IF NOT EXISTS `Preference` (`key` TEXT NOT NULL, `long_value` INTEGER, PRIMARY KEY(`key`))" (Source: X.07p.smali, Indicator: "create table if not exists `preference` (`key` text not null, `long_value` integer, primary key(`key`))"), "INSERT OR REPLACE INTO `Preference` (`key`, `long_value`) VALUES (@key, @long_value)" (Source: X.07p.smali, Indicator: "insert or replace into `preference` (`key`, `long_value`) values (@key, @long_value)"), "SELECT DISTINCT work_spec_id FROM SystemIdInfo" (Source: X.0Wv.smali, Indicator: "select distinct work_spec_id from systemidinfo"), "SELECT count(*) FROM sqlite_master WHERE name != \'android_metadata\'" (Source: X.00n.smali, Indicator: "select count(*) from sqlite_master where name != \'android_metadata\'"), "UPDATE room_table_modification_log SET invalidated = 0 WHERE invalidated = 1" (Source: X.00n.smali, Indicator: "update room_table_modification_log set invalidated = 0 where invalidated = 1"), "DELETE FROM workspec WHERE state IN (2, 3, 5) AND (last_enqueue_time + minimum_retention_duration) <" (Source: X.00n.smali, Indicator: "delete from workspec where state in (2, 3, 5) and (last_enqueue_time + minimum_retention_duration) <"), "SELECT id FROM workspec WHERE state NOT IN (2, 3, 5) AND id IN (SELECT work_spec_id FROM workname WHERE name=?)" (Source: X.09E.smali, Indicator: "select id from workspec where state not in (2, 3, 5) and id in (select work_spec_id from workname where name=?)"), "SELECT `progress` `work_spec_id` FROM `WorkProgress` WHERE `work_spec_id` IN (" (Source: X.0X5.smali, Indicator: "select `progress`,`work_spec_id` from `workprogress` where `work_spec_id` in (") "SELECT `tag`,`work_spec_id` FROM `WorkTag` WHERE `work_spec_id` IN (" (Source: X.0X5.smali, Indicator: "select `tag`,`work_spec_id` from `worktag` where `work_spec_id` in (") "SELECT * FROM workspec WHERE state=0 ORDER BY last_enqueue_time LIMIT ?" (Source: X.0X5.smali, Indicator: "select * from workspec where state=0 order by last_enqueue_time limit ?") "SELECT * FROM workspec WHERE state=1" (Source: X.0X5.smali, Indicator: "select * from workspec where state=1") "SELECT * FROM workspec WHERE state=0 AND schedule_requested_at<>-1" (Source: X.0X5.smali, Indicator: "select * from workspec where state=0 and schedule_requested_at<>-1") "SELECT state FROM workspec WHERE id=?" (Source: X.0X5.smali, Indicator: "select state from workspec where id=?") "SELECT * FROM workspec WHERE id=?" (Source: X.0X5.smali, Indicator: "select * from workspec where id=?") "SELECT id, state FROM workspec WHERE id IN (SELECT work_spec_id FROM workname WHERE name=?)" (Source: X.0bO.smali, Indicator: "select id, state from workspec where id in (select work_spec_id from workname where name=?)"), "SELECT COUNT(*)>0 FROM dependency WHERE prerequisite_id=?" (Source: X.0bO.smali, Indicator: "select count(*)>0 from dependency where prerequisite_id=?"), "SELECT DISTINCT tag FROM worktag WHERE work_spec_id=?" (Source: X.0X6.smali, Indicator: "select distinct tag from worktag where work_spec_id=?"), "SELECT * FROM workspec WHERE state=0 AND schedule_requested_at=-1 ORDER BY last_enqueue_time LIMIT (SELECT MAX(?-COUNT(*) 0) FROM workspec WHERE schedule_requested_at<>-1 AND state NOT IN (2, 3, 5))" (Source: X.0Oj.smali, Indicator: "select * from workspec where state=0 and schedule_requested_at=-1 order by last_enqueue_time limit (select max(?-count(*) 0) from workspec where schedule_requested_at<>-1 and state not in (2, 3, 5))"), "SELECT * FROM room_table_modification_log WHERE invalidated = 1;" (Source: X.0bB.smali, Indicator: "select * from room_table_modification_log where invalidated = 1;"), "CREATE TABLE IF NOT EXISTS `_new_WorkSpec` (`id` TEXT NOT NULL, `state` INTEGER NOT NULL, `worker_class_name` TEXT NOT NULL, `input_merger_class_name` TEXT, `input` BLOB NOT NULL, `output` BLOB NOT NULL, `initial_delay` INTEGER NOT NULL, `interval_duration` INTEGER NOT NULL, `flex_duration` INTEGER NOT NULL, `run_attempt_count` INTEGER NOT NULL, `backoff_policy` INTEGER NOT NULL, `backoff_delay_duration` INTEGER NOT NULL, `period_start_time` INTEGER NOT NULL, `minimum_retention_duration` INTEGER NOT NULL, `schedule_requested_at` INTEGER NOT NULL, `run_in_foreground` INTEGER NOT NULL, `out_of_quota_policy` INTEGER NOT NULL, `required_network_type` INTEGER NOT NULL, `requires_charging` INTEGER NOT NULL, `requires_device_idle` INTEGER NOT NULL, `requires_battery_not_low` INTEGER NOT NULL, `requires_storage_not_low` INTEGER NOT NULL, `trigger_content_update_delay` INTEGER NOT NULL, `trigger_max_content_delay` INTEGER NOT NULL, `content_uri_triggers` BLOB NOT NULL, PRIMARY KEY(`id`))" (Source: X.07m.smali, Indicator: "create table if not exists `_new_workspec` (`id` text not null, `state` integer not null, `worker_class_name` text not null, `input_merger_class_name` text, `input` blob not null, `output` blob not null, `initial_delay` integer not null, `interval_duration` integer not null, `flex_duration` integer not null, `run_attempt_count` integer not null, `backoff_policy` integer not null, `backoff_delay_duration` integer not null, `period_start_time` integer not null, `minimum_retention_duration` integer not null, `schedule_requested_at` integer not null, `run_in_foreground` integer not null, `out_of_quota_policy` integer not null, `required_network_type` integer not null, `requires_charging` integer not null, `requires_device_idle` integer not null, `requires_battery_not_low` integer not null, `requires_storage_not_low` integer not null, `trigger_content_update_delay` integer not null, `trigger_max_content_delay` integer not null, `content_uri_triggers` blob not null, primary key(`id`))"), "INSERT INTO `_new_WorkSpec` (`id`,`state`,`worker_class_name`,`input_merger_class_name`,`input`,`output`,`initial_delay`,`interval_duration`,`flex_duration`,`run_attempt_count`,`backoff_policy`,`backoff_delay_duration`,`period_start_time`,`minimum_retention_duration`,`schedule_requested_at`,`run_in_foreground`,`out_of_quota_policy`,`required_network_type`,`requires_charging`,`requires_device_idle`,`requires_battery_not_low`,`requires_storage_not_low`,`trigger_content_update_delay`,`trigger_max_content_delay`,`content_uri_triggers`) SELECT `id` `state` `worker_class_name` `input_merger_class_name` `input` `output` `initial_delay` `interval_duration` `flex_duration` `run_attempt_count` `backoff_policy` `backoff_delay_duration` `period_start_time` `minimum_retention_duration` `schedule_requested_at` `run_in_foreground` `out_of_quota_policy` `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` FROM `WorkSpec`" (Source: X.07m.smali, Indicator: "insert into `_new_workspec` (`id`,`state`,`worker_class_name`,`input_merger_class_name`,`input`,`output`,`initial_delay`,`interval_duration`,`flex_duration`,`run_attempt_count`,`backoff_policy`,`backoff_delay_duration`,`period_start_time`,`minimum_retention_duration`,`schedule_requested_at`,`run_in_foreground`,`out_of_quota_policy`,`required_network_type`,`requires_charging`,`requires_device_idle`,`requires_battery_not_low`,`requires_storage_not_low`,`trigger_content_update_delay`,`trigger_max_content_delay`,`content_uri_triggers`) select `id` `state` `worker_class_name` `input_merger_class_name` `input` `output` `initial_delay` `interval_duration` `flex_duration` `run_attempt_count` `backoff_policy` `backoff_delay_duration` `period_start_time` `minimum_retention_duration` `schedule_requested_at` `run_in_foreground` `out_of_quota_policy` `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` from `workspec`"), "CREATE TABLE IF NOT EXISTS `Dependency` (`work_spec_id` TEXT NOT NULL, `prerequisite_id` TEXT NOT NULL, PRIMARY KEY(`work_spec_id`, `prerequisite_id`) FOREIGN KEY(`work_spec_id`) REFERENCES `WorkSpec`(`id`) ON UPDATE CASCADE ON DELETE CASCADE FOREIGN KEY(`prerequisite_id`) REFERENCES `WorkSpec`(`id`) ON UPDATE CASCADE ON DELETE CASCADE )" (Source: X.0Qh.smali, Indicator: "create table if not exists `dependency` (`work_spec_id` text not null, `prerequisite_id` text not null, primary key(`work_spec_id`, `prerequisite_id`) foreign key(`work_spec_id`) references `workspec`(`id`) on update cascade on delete cascade foreign key(`prerequisite_id`) references `workspec`(`id`) on update cascade on delete cascade )"), "CREATE TABLE IF NOT EXISTS `WorkSpec` (`id` TEXT NOT NULL, `state` INTEGER NOT NULL, `worker_class_name` TEXT NOT NULL, `input_merger_class_name` TEXT, `input` BLOB NOT NULL, `output` BLOB NOT NULL, `initial_delay` INTEGER NOT NULL, `interval_duration` INTEGER NOT NULL, `flex_duration` INTEGER NOT NULL, `run_attempt_count` INTEGER NOT NULL, `backoff_policy` INTEGER NOT NULL, `backoff_delay_duration` INTEGER NOT NULL, `last_enqueue_time` INTEGER NOT NULL, `minimum_retention_duration` INTEGER NOT NULL, `schedule_requested_at` INTEGER NOT NULL, `run_in_foreground` INTEGER NOT NULL, `out_of_quota_policy` INTEGER NOT NULL, `period_count` INTEGER NOT NULL DEFAULT 0, `generation` INTEGER NOT NULL DEFAULT 0, `required_network_type` INTEGER NOT NULL, `requires_charging` INTEGER NOT NULL, `requires_device_idle` INTEGER NOT NULL, `requires_battery_not_low` INTEGER NOT NULL, `requires_storage_not_low` INTEGER NOT NULL, `trigger_content_update_delay` INTEGER NOT NULL, `trigger_max_content_delay` INTEGER NOT NULL, `content_uri_triggers` BLOB NOT NULL, PRIMARY KEY(`id`))" (Source: X.0Qh.smali, Indicator: "create table if not exists `workspec` (`id` text not null, `state` integer not null, `worker_class_name` text not null, `input_merger_class_name` text, `input` blob not null, `output` blob not null, `initial_delay` integer not null, `interval_duration` integer not null, `flex_duration` integer not null, `run_attempt_count` integer not null, `backoff_policy` integer not null, `backoff_delay_duration` integer not null, `last_enqueue_time` integer not null, `minimum_retention_duration` integer not null, `schedule_requested_at` integer not null, `run_in_foreground` integer not null, `out_of_quota_policy` integer not null, `period_count` integer not null default 0, `generation` integer not null default 0, `required_network_type` integer not null, `requires_charging` integer not null, `requires_device_idle` integer not null, `requires_battery_not_low` integer not null, `requires_storage_not_low` integer not null, `trigger_content_update_delay` integer not null, `trigger_max_content_delay` integer not null, `content_uri_triggers` blob not null, primary key(`id`))")23:Tac5,Found string "https://graph.facebook.com/v2.2/maps_configs?fields=base_url,static_base_url,osm_config,url_override_config&pretty=0&access_token=" (Indicator: "facebook.com"; File: "0Po.smali") Found string "https://www.facebook.com/maps/tile/?" (Indicator: "facebook.com"; File: "0Po.smali") Found string "https://www.facebook.com/maps/static/?" (Indicator: "facebook.com"; File: "0Po.smali") Found string "https://www.facebook.com/maps/report/?" (Indicator: "facebook.com"; File: "0NZ.smali") Found string "Name: res/drawable-hdpi/ic_pip_youtube.png" (Indicator: "youtube"; File: "ANDROID.SF") Found string "Name: res/drawable-xhdpi-v4/ic_yotwitter.xml" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/ic_pip_youtube.png" (Indicator: "youtube"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/ic_twitter.png" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/twitter.png" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/twitter_balloon_incoming_normal.9.png" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/twitter_balloon_incoming_normal_ext.9.png" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/twitter_balloon_outgoing_normal.9.png" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/twitter_balloon_outgoing_normal_ext.9.png" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/twitter_message_got_read_receipt_from_target" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/twitter_message_got_receipt_from_server.png" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/twitter_message_got_receipt_from_server_onme" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/twitter_message_got_receipt_from_target.png" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/twitter_message_got_receipt_from_target_onme" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/twitter_message_unsent.png" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable-xxhdpi/twitter_message_unsent_onmedia.png" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable/ic_yopaypal.xml" (Indicator: "paypal"; File: "ANDROID.SF") Found string "Name: res/drawable/twitter.png" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/drawable/twitterb.png" (Indicator: "twitter"; File: "ANDROID.SF") Found string "Name: res/raw/youtube_player_iframe.html" (Indicator: "youtube"; File: "ANDROID.SF")24:T2c68,"SELECT * FROM workspec WHERE last_enqueue_time >= ? AND state IN (2, 3, 5) ORDER BY last_enqueue_time DESC" (Source: androidx.work.impl.workers.DiagnosticsWorker.smali, Indicator: "select * from workspec where last_enqueue_time >= ? and state in (2, 3, 5) order by last_enqueue_time desc"), "SELECT id state output run_attempt_count generation FROM workspec WHERE id IN (SELECT work_spec_id FROM workname WHERE name=?)" (Source: X.0bC.smali, Indicator: "select id state output run_attempt_count generation from workspec where id in (select work_spec_id from workname where name=?)"), "CREATE TABLE IF NOT EXISTS `Preference` (`key` TEXT NOT NULL, `long_value` INTEGER, PRIMARY KEY(`key`))" (Source: X.07p.smali, Indicator: "create table if not exists `preference` (`key` text not null, `long_value` integer, primary key(`key`))"), "INSERT OR REPLACE INTO `Preference` (`key`, `long_value`) VALUES (@key, @long_value)" (Source: X.07p.smali, Indicator: "insert or replace into `preference` (`key`, `long_value`) values (@key, @long_value)"), "SELECT DISTINCT work_spec_id FROM SystemIdInfo" (Source: X.0Wv.smali, Indicator: "select distinct work_spec_id from systemidinfo"), "SELECT count(*) FROM sqlite_master WHERE name != \'android_metadata\'" (Source: X.00n.smali, Indicator: "select count(*) from sqlite_master where name != \'android_metadata\'"), "UPDATE room_table_modification_log SET invalidated = 0 WHERE invalidated = 1" (Source: X.00n.smali, Indicator: "update room_table_modification_log set invalidated = 0 where invalidated = 1"), "DELETE FROM workspec WHERE state IN (2, 3, 5) AND (last_enqueue_time + minimum_retention_duration) <" (Source: X.00n.smali, Indicator: "delete from workspec where state in (2, 3, 5) and (last_enqueue_time + minimum_retention_duration) <"), "SELECT id FROM workspec WHERE state NOT IN (2, 3, 5) AND id IN (SELECT work_spec_id FROM workname WHERE name=?)" (Source: X.09E.smali, Indicator: "select id from workspec where state not in (2, 3, 5) and id in (select work_spec_id from workname where name=?)"), "SELECT `progress` `work_spec_id` FROM `WorkProgress` WHERE `work_spec_id` IN (" (Source: X.0X5.smali, Indicator: "select `progress`,`work_spec_id` from `workprogress` where `work_spec_id` in (") "SELECT `tag`,`work_spec_id` FROM `WorkTag` WHERE `work_spec_id` IN (" (Source: X.0X5.smali, Indicator: "select `tag`,`work_spec_id` from `worktag` where `work_spec_id` in (") "SELECT * FROM workspec WHERE state=0 ORDER BY last_enqueue_time LIMIT ?" (Source: X.0X5.smali, Indicator: "select * from workspec where state=0 order by last_enqueue_time limit ?") "SELECT * FROM workspec WHERE state=1" (Source: X.0X5.smali, Indicator: "select * from workspec where state=1") "SELECT * FROM workspec WHERE state=0 AND schedule_requested_at<>-1" (Source: X.0X5.smali, Indicator: "select * from workspec where state=0 and schedule_requested_at<>-1") "SELECT state FROM workspec WHERE id=?" (Source: X.0X5.smali, Indicator: "select state from workspec where id=?") "SELECT * FROM workspec WHERE id=?" (Source: X.0X5.smali, Indicator: "select * from workspec where id=?") "SELECT id, state FROM workspec WHERE id IN (SELECT work_spec_id FROM workname WHERE name=?)" (Source: X.0bO.smali, Indicator: "select id, state from workspec where id in (select work_spec_id from workname where name=?)"), "SELECT COUNT(*)>0 FROM dependency WHERE prerequisite_id=?" (Source: X.0bO.smali, Indicator: "select count(*)>0 from dependency where prerequisite_id=?"), "SELECT DISTINCT tag FROM worktag WHERE work_spec_id=?" (Source: X.0X6.smali, Indicator: "select distinct tag from worktag where work_spec_id=?"), "SELECT * FROM workspec WHERE state=0 AND schedule_requested_at=-1 ORDER BY last_enqueue_time LIMIT (SELECT MAX(?-COUNT(*) 0) FROM workspec WHERE schedule_requested_at<>-1 AND state NOT IN (2, 3, 5))" (Source: X.0Oj.smali, Indicator: "select * from workspec where state=0 and schedule_requested_at=-1 order by last_enqueue_time limit (select max(?-count(*) 0) from workspec where schedule_requested_at<>-1 and state not in (2, 3, 5))"), "SELECT * FROM room_table_modification_log WHERE invalidated = 1;" (Source: X.0bB.smali, Indicator: "select * from room_table_modification_log where invalidated = 1;"), "CREATE TABLE IF NOT EXISTS `_new_WorkSpec` (`id` TEXT NOT NULL, `state` INTEGER NOT NULL, `worker_class_name` TEXT NOT NULL, `input_merger_class_name` TEXT, `input` BLOB NOT NULL, `output` BLOB NOT NULL, `initial_delay` INTEGER NOT NULL, `interval_duration` INTEGER NOT NULL, `flex_duration` INTEGER NOT NULL, `run_attempt_count` INTEGER NOT NULL, `backoff_policy` INTEGER NOT NULL, `backoff_delay_duration` INTEGER NOT NULL, `period_start_time` INTEGER NOT NULL, `minimum_retention_duration` INTEGER NOT NULL, `schedule_requested_at` INTEGER NOT NULL, `run_in_foreground` INTEGER NOT NULL, `out_of_quota_policy` INTEGER NOT NULL, `required_network_type` INTEGER NOT NULL, `requires_charging` INTEGER NOT NULL, `requires_device_idle` INTEGER NOT NULL, `requires_battery_not_low` INTEGER NOT NULL, `requires_storage_not_low` INTEGER NOT NULL, `trigger_content_update_delay` INTEGER NOT NULL, `trigger_max_content_delay` INTEGER NOT NULL, `content_uri_triggers` BLOB NOT NULL, PRIMARY KEY(`id`))" (Source: X.07m.smali, Indicator: "create table if not exists `_new_workspec` (`id` text not null, `state` integer not null, `worker_class_name` text not null, `input_merger_class_name` text, `input` blob not null, `output` blob not null, `initial_delay` integer not null, `interval_duration` integer not null, `flex_duration` integer not null, `run_attempt_count` integer not null, `backoff_policy` integer not null, `backoff_delay_duration` integer not null, `period_start_time` integer not null, `minimum_retention_duration` integer not null, `schedule_requested_at` integer not null, `run_in_foreground` integer not null, `out_of_quota_policy` integer not null, `required_network_type` integer not null, `requires_charging` integer not null, `requires_device_idle` integer not null, `requires_battery_not_low` integer not null, `requires_storage_not_low` integer not null, `trigger_content_update_delay` integer not null, `trigger_max_content_delay` integer not null, `content_uri_triggers` blob not null, primary key(`id`))"), "INSERT INTO `_new_WorkSpec` (`id`,`state`,`worker_class_name`,`input_merger_class_name`,`input`,`output`,`initial_delay`,`interval_duration`,`flex_duration`,`run_attempt_count`,`backoff_policy`,`backoff_delay_duration`,`period_start_time`,`minimum_retention_duration`,`schedule_requested_at`,`run_in_foreground`,`out_of_quota_policy`,`required_network_type`,`requires_charging`,`requires_device_idle`,`requires_battery_not_low`,`requires_storage_not_low`,`trigger_content_update_delay`,`trigger_max_content_delay`,`content_uri_triggers`) SELECT `id` `state` `worker_class_name` `input_merger_class_name` `input` `output` `initial_delay` `interval_duration` `flex_duration` `run_attempt_count` `backoff_policy` `backoff_delay_duration` `period_start_time` `minimum_retention_duration` `schedule_requested_at` `run_in_foreground` `out_of_quota_policy` `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` FROM `WorkSpec`" (Source: X.07m.smali, Indicator: "insert into `_new_workspec` (`id`,`state`,`worker_class_name`,`input_merger_class_name`,`input`,`output`,`initial_delay`,`interval_duration`,`flex_duration`,`run_attempt_count`,`backoff_policy`,`backoff_delay_duration`,`period_start_time`,`minimum_retention_duration`,`schedule_requested_at`,`run_in_foreground`,`out_of_quota_policy`,`required_network_type`,`requires_charging`,`requires_device_idle`,`requires_battery_not_low`,`requires_storage_not_low`,`trigger_content_update_delay`,`trigger_max_content_delay`,`content_uri_triggers`) select `id` `state` `worker_class_name` `input_merger_class_name` `input` `output` `initial_delay` `interval_duration` `flex_duration` `run_attempt_count` `backoff_policy` `backoff_delay_duration` `period_start_time` `minimum_retention_duration` `schedule_requested_at` `run_in_foreground` `out_of_quota_policy` `required_network_type` `requires_charging` `requires_device_idle` `requires_battery_not_low` `requires_storage_not_low` `trigger_content_update_delay` `trigger_max_content_delay` `content_uri_triggers` from `workspec`"), "CREATE TABLE IF NOT EXISTS `Dependency` (`work_spec_id` TEXT NOT NULL, `prerequisite_id` TEXT NOT NULL, PRIMARY KEY(`work_spec_id`, `prerequisite_id`) FOREIGN KEY(`work_spec_id`) REFERENCES `WorkSpec`(`id`) ON UPDATE CASCADE ON DELETE CASCADE FOREIGN KEY(`prerequisite_id`) REFERENCES `WorkSpec`(`id`) ON UPDATE CASCADE ON DELETE CASCADE )" (Source: X.0Qh.smali, Indicator: "create table if not exists `dependency` (`work_spec_id` text not null, `prerequisite_id` text not null, primary key(`work_spec_id`, `prerequisite_id`) foreign key(`work_spec_id`) references `workspec`(`id`) on update cascade on delete cascade foreign key(`prerequisite_id`) references `workspec`(`id`) on update cascade on delete cascade )"), "CREATE TABLE IF NOT EXISTS `WorkSpec` (`id` TEXT NOT NULL, `state` INTEGER NOT NULL, `worker_class_name` TEXT NOT NULL, `input_merger_class_name` TEXT, `input` BLOB NOT NULL, `output` BLOB NOT NULL, `initial_delay` INTEGER NOT NULL, `interval_duration` INTEGER NOT NULL, `flex_duration` INTEGER NOT NULL, `run_attempt_count` INTEGER NOT NULL, `backoff_policy` INTEGER NOT NULL, `backoff_delay_duration` INTEGER NOT NULL, `last_enqueue_time` INTEGER NOT NULL, `minimum_retention_duration` INTEGER NOT NULL, `schedule_requested_at` INTEGER NOT NULL, `run_in_foreground` INTEGER NOT NULL, `out_of_quota_policy` INTEGER NOT NULL, `period_count` INTEGER NOT NULL DEFAULT 0, `generation` INTEGER NOT NULL DEFAULT 0, `required_network_type` INTEGER NOT NULL, `requires_charging` INTEGER NOT NULL, `requires_device_idle` INTEGER NOT NULL, `requires_battery_not_low` INTEGER NOT NULL, `requires_storage_not_low` INTEGER NOT NULL, `trigger_content_update_delay` INTEGER NOT NULL, `trigger_max_content_delay` INTEGER NOT NULL, `content_uri_triggers` BLOB NOT NULL, PRIMARY KEY(`id`))" (Source: X.0Qh.smali, Indicator: "create table if not exists `workspec` (`id` text not null, `state` integer not null, `worker_class_name` text not null, `input_merger_class_name` text, `input` blob not null, `output` blob not null, `initial_delay` integer not null, `interval_duration` integer not null, `flex_duration` integer not null, `run_attempt_count` integer not null, `backoff_policy` integer not null, `backoff_delay_duration` integer not null, `last_enqueue_time` integer not null, `minimum_retention_duration` integer not null, `schedule_requested_at` integer not null, `run_in_foreground` integer not null, `out_of_quota_policy` integer not null, `period_count` integer not null default 0, `generation` integer not null default 0, `required_network_type` integer not null, `requires_charging` integer not null, `requires_device_idle` integer not null, `requires_battery_not_low` integer not null, `requires_storage_not_low` integer not null, `trigger_content_update_delay` integer not null, `trigger_max_content_delay` integer not null, `content_uri_triggers` blob not null, primary key(`id`))")25:T84f,"ANDROID.SF" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "MANIFEST.MF" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "libsoundtouch.so_1689191811761" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked BuildID[sha1]=d6761a26a9cd8ad23311b7a3d8fb74639873f7e7 stripped"- [targetUID: N/A] "libopustool.so_1689191811761" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked BuildID[sha1]=c28a4b1b0a0f01b4ecdb76f7db1db69b4db7a8f5 stripped"- [targetUID: N/A] "libopustool.so" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked BuildID[sha1]=96c63c2724d9a8733bcb8b7772e0d26bb14cb33b stripped"- [targetUID: N/A] "libsoundtouch.so" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked BuildID[sha1]=867379a88d5394728cf51eb045c426aeac98ffa6 stripped"- [targetUID: N/A] "libsuperpack.so_1689191811758" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked BuildID[sha1]=65832ec1b758e34cabe2ceb060e593844dccd90b stripped"- [targetUID: N/A] "libunwindstack.so_1689191811761" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked interpreter /system/bin/linker64 stripped"- [targetUID: N/A] "libsuperpack.so" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked BuildID[sha1]=db062e6f59a5ebfe2babe87188c7183762e6bf3c stripped"- [targetUID: N/A] "AndroidManifest.xml" has type "Android binary XML"- [targetUID: N/A] "libunwindstack.so" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked interpreter /system/bin/linker stripped"- [targetUID: N/A] "ANDROID.RSA" has type "data"- [targetUID: N/A] "java.security.Provider" has type "ASCII text"- [targetUID: N/A] "kotlinx.coroutines.CoroutineExceptionHandler" has type "ASCII text"- [targetUID: N/A] "kotlinx.coroutines.internal.MainDispatcherFactory" has type "ASCII text"- [targetUID: N/A] "javax.annotation.processing.Processor" has type "ASCII text"- [targetUID: N/A]26:T29a3,Heuristic match: "VK.Zm" Heuristic match: "^m.CL" Heuristic match: "X{.Sk" Heuristic match: "qk.fj" Heuristic match: "OoA.jp" Heuristic match: "android.intent.extra.shortcut.ID" Pattern match: "http://schemas.android.com/apk/res/android" Pattern match: "https://graph.facebook.com/v2.2/maps_configs?fields=base_url,static_base_url,osm_config,url_override_config&pretty=0&access_token=" Pattern match: "https://www.facebook.com/maps/tile/" Pattern match: "https://www.facebook.com/maps/static/" Pattern match: "https://maps.instagram.com/maps/tile/" Pattern match: "https://maps.instagram.com/maps/static/" Pattern match: "https://graph.instagram.com/maps_configs?fields=base_url,static_base_url,osm_config,url_override_config&pretty=0&access_token=" Pattern match: "https://graph.whatsapp.net/v2.2/maps_configs?fields=base_url,static_base_url,osm_config,url_override_config&pretty=0&access_token=" Heuristic match: "androidx.work.util.id" Heuristic match: "null cannot be cast to non-null type kotlin.Int" Pattern match: "http://www.w3.org/TR/SVG11/feature#" Pattern match: "http://xmlpull.org/v1/doc/features.html#process-docdecl" Pattern match: "http://xmlpull.org/v1/doc/features.html#process-namespaces" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://www.w3.org/1999/xlink" Pattern match: "http://ns.adobe.com/xap/1.0/\u0000" Pattern match: "https://www.facebook.com/maps/report/" Pattern match: "https://android.googlesource.com/toolchain/llvm-project" Heuristic match: "Name: assets/compressed/strings/strings_af.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_am.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_ar.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_az.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_bg.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_bn.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_ca.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_cs.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_da.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_de.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_el.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_en.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_es.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_et.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_fa.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_fi.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_fr.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_ga.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_gu.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_ha.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_hi.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_hr.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_hu.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_in.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_it.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_iw.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_ja.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_kk.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_kn.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_ko.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_lo.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_lt.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_lv.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_mk.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_ml.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_mr.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_ms.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_nb.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_nl.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_om.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_pa.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_pl.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_pt.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_ro.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_ru.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_sl.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_sq.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_sr.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_sv.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_sw.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_ta.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_te.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_th.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_tl.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_tr.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_uk.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_ur.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_uz.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_vi.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_zh-rCN.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_zh-rHK.spk.br" Heuristic match: "Name: assets/compressed/strings/strings_zh-rTW.spk.br" Heuristic match: "Name: lib/arm64-v8a/libopustool.so" Heuristic match: "Name: lib/arm64-v8a/libsoundtouch.so" Heuristic match: "Name: lib/arm64-v8a/libsuperpack.so" Heuristic match: "Name: lib/arm64-v8a/libunwindstack.so" Heuristic match: "Name: res/drawable-hdpi/abc_textfield_search_activated_mtrl_alpha.9.pn" Heuristic match: "Name: res/drawable-hdpi/ic_waffle_crossposting_status_upsell_anchor.pn" Heuristic match: "Name: res/drawable-mdpi/abc_textfield_search_activated_mtrl_alpha.9.pn" Heuristic match: "Name: res/drawable-mdpi/ic_waffle_crossposting_status_upsell_anchor.pn" Heuristic match: "Name: res/drawable-night-xhdpi/balloon_centered_no_padding_normal.9.pn" Heuristic match: "Name: res/drawable-xxhdpi/SDot_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/abc_textfield_search_default_mtrl_alpha.9.pn" Heuristic match: "Name: res/drawable-xxhdpi/allo_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/altcrayon_message_got_receipt_from_server.pn" Heuristic match: "Name: res/drawable-xxhdpi/altcrayon_message_got_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/aran_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/bbm2_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/coalfield_message_got_receipt_from_server.pn" Heuristic match: "Name: res/drawable-xxhdpi/coalfield_message_got_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/crmessenger_balloon_incoming_normal_ext.9.pn" Heuristic match: "Name: res/drawable-xxhdpi/crmessenger_balloon_outgoing_normal_ext.9.pn" Heuristic match: "Name: res/drawable-xxhdpi/face_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/feet_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/flor_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/gabcircle_message_got_receipt_from_server.pn" Heuristic match: "Name: res/drawable-xxhdpi/gabcircle_message_got_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/gabioutline_balloon_incoming_normal_ext.9.pn" Heuristic match: "Name: res/drawable-xxhdpi/gabioutline_balloon_outgoing_normal_ext.9.pn" Heuristic match: "Name: res/drawable-xxhdpi/greentick_message_got_receipt_from_server.pn" Heuristic match: "Name: res/drawable-xxhdpi/greentick_message_got_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/hike_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/ic_business_cat_advertising_and_marketing.pn" Heuristic match: "Name: res/drawable-xxhdpi/ic_business_cat_commercial_and_industrial.pn" Heuristic match: "Name: res/drawable-xxhdpi/ic_business_cat_travel_and_transportation.pn" Heuristic match: "Name: res/drawable-xxhdpi/ios2_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/like_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/love_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/messenger_message_got_receipt_from_server.pn" Heuristic match: "Name: res/drawable-xxhdpi/messenger_message_got_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/nhsc_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/pony_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/star_message_got_read_receipt_from_target.pn" Heuristic match: "Name: res/drawable-xxhdpi/x_message_got_receipt_from_server_onmedia.pn" Heuristic match: "Name: res/drawable-xxhdpi/x_message_got_receipt_from_target_onmedia.pn" Heuristic match: "Name: res/drawable-xxxhdpi/abc_scrubber_control_to_pressed_mtrl_000.pn" Heuristic match: "Name: res/drawable-xxxhdpi/abc_scrubber_control_to_pressed_mtrl_005.pn" Pattern match: "http://schemas.android.com/apk/res/androidpackageplatformBuildVersionCodeplatformBuildVersionNamemanifest6.0-2438415com.fmwhatsapp2.23.9.75uses-sdkuses-featureandroid.hardware.bluetoothandroid.hardware.location!android.hardware.location.networkandroid.hard" Pattern match: ".com.sec.android.provider.badge.permission.READ/com.sec.android.provider.badge.permission.WRITE" Pattern match: "com.fmwhatsapp.TextAndDirectChatDeepLinkapi.whatsapp.comwa.mewhatsapp.comwww.whatsapp.com/newsletter/channel!com.fmwhatsapp.DEEP_LINK_REDIRECTsendcatalogproductmessage" Pattern match: "com.fmwhatsapp.accountsync.ProfileActivitycontentcom.android.contacts2vnd.android.cursor.item/vnd.com.fmwhatsapp.profile5com.fmwhatsapp.accountsync.CallContactLandingActivity4vnd.android.cursor.item/vnd.com.fmwhatsapp.voip.call5vnd.android.cursor.item/vnd."27:Ta70,Found string ";base64" (Indicator: "base64"; File: "0Qr.smali") Found string "base64," (Indicator: "base64"; File: "09h.smali") Found string "data URL did not have correct base64 format." (Indicator: "base64"; File: "09h.smali") Found string "AES/CBC/PKCS7Padding" (Indicator: "aes"; File: "0LU.smali") file/memory contains long string with (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: dKAESgq8TVgADy16ghNhFFIEwDTYL7iDzWmzG3wp1GA=" (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: wNpsMXKGSzrDhpdrYfpX13ROBOvpPlVrimWRhFH7aEs=" (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: suHOvlP8KxXis1kn6qZsJxnvUaEs/AXlB0ExkYLAkIU=" (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: TwB6Dua/pY7yA1OtkmZS89WWb3saEseULqwDUiKiGBo=" (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: ugsqK26E3sS62+OjXxb6aEsH3jQXOgr1GtwNa1Gxn5c=" (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: 3rGpPufcCvu8f8g1EZxYtpuAESgkETWHUqkTM2GFs3I=" (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: DUtOcTMi81+YNbUkVicaeSggpu1AcbcW/l/p65fC1U4=" (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: A5Nvv/kNS9zAOljwsd3i+Ugaon7VAesCrZKP3IKQH4M=" (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: 1n6V1ftaESq369XWR9cBNwWlmb4IdV3a6eDjzjzLDOE=" (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: lqYM/tJtW597TSaESLof1GEl6rabo8inErS0FropDI8=" (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: nrPhxbbus0M6noFFnlPwAES4fpMIrCxURakTQbpGVBM=" (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: 94KHaqCaLqOkMzuif/szGchaeSw03frfu81pZ6Gj0AI=" (Indicator: "aes"; File: "ANDROID.SF") Found string "SHA-256-Digest: dbmIPOS1KyGqg5QuX62LMYhgYGDJNaESXUp+iy68ouA=" (Indicator: "aes"; File: "ANDROID.SF") file/memory contains long string with (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: HWF4PirQoHUwey97hamsL97hLLjIjGbNZldBaESIKdY=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: xuTxUMauNKAesfrOqEZYcCnKe/fdR2cJU4jKO+1liRE=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: lkO0ipYA6fHptO79fH91aesoDMaoK8vpRIdjdnhH/Io=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: ni/k0omXl0gAesFyA8NLOhnBy3Q3DoK6DHCcbvC15UY=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: +4b8S/ULB2ixpzDzcL96og05VbfAS/spJ++XTaesLOc=" (Indicator: "aes"; File: "MANIFEST.MF") Found string "SHA-256-Digest: Ns58aeSKA2xJ4Qfjdv8X10ncD3YoQjur6Ls69fGk+VA=" (Indicator: "aes"; File: "MANIFEST.MF")28:T3b3a,"intent-filter&com.fmwhatsapp.instrumentation.REQUESTandroid.intent.category.DEFAULT'com.fmwhatsapp.provider.instrumentation:com.fmwhatsapp.instrumentation.api.InstrumentationProvider.com.fmwhatsapp.home.ui.HomePlaceholderActivity9com.fmwhatsapp.home.ui.StarredMessagesPlaceholderActivitycom.fmwhatsapp.HomeActivity"android.nfc.action.NDEF_DISCOVEREDapplication/com.fmwhatsapp.chatapplication/com.fmwhatsapp.join!android.intent.category.BROWSABLEchatwhatsappcallhttpcall.whatsapp.comactivity-alias/com.fmwhatsapp.AcceptInviteLinkActivityDeepLinkchat.whatsapp.com;com.fmwhatsapp.conversation.EditBroadcastRecipientsSelector?com.fmwhatsapp.conversation.conversationrow.ContactSyncActivityDcom.fmwhatsapp.conversation.conversationrow.album.MediaAlbumActivityJcom.fmwhatsapp.conversation.conversationrow.message.MessageDetailsActivityHcom.fmwhatsapp.conversation.conversationrow.message.KeptMessagesActivityKcom.fmwhatsapp.conversation.conversationrow.message.StarredMessagesActivitycom.fmwhatsapp.Conversationandroid.intent.action.SENDTOsmssmstoCcom.fmwhatsapp.conversationslist.ArchiveNotificationSettingActivity>com.fmwhatsapp.conversationslist.ArchivedConversationsActivitycom.fmwhatsapp.payments.ui.IndiaUpiQrCodeUrlValidationActivity:com.fmwhatsapp.payments.ui.IndiaUpiPaymentLauncherActivity9com.fmwhatsapp.payments.ui.IndiaUpiMandatePaymentActivity3com.fmwhatsapp.payments.ui.IndiaUpiQuickBuyActivity9com.fmwhatsapp.payments.ui.IndiaUpiProfileDetailsActivity9com.fmwhatsapp.payments.ui.IndiaUpiNumberSettingsActivity1com.fmwhatsapp.payments.ui.IndiaUpiStepUpActivityBcom.fmwhatsapp.payments.receiver.IndiaUpiPayIntentReceiverActivitypayupiAcom.fmwhatsapp.payments.ui.IndiaPaymentTransactionHistoryActivityKcom.fmwhatsapp.payments.ui.mapper.register.IndiaUpiMapperValuePropsActivityEcom.fmwhatsapp.payments.ui.mapper.register.IndiaUpiMapperLinkActivityHcom.fmwhatsapp.payments.ui.mapper.register.IndiaUpiMapperPendingActivityMcom.fmwhatsapp.payments.ui.mapper.register.IndiaUpiCreateCustomNumberActivity7com.fmwhatsapp.payments.ui.IndiaUpiPauseMandateActivityCcom.fmwhatsapp.payments.ui.IndiaUpiPaymentsBlockScreenShareActivityMcom.fmwhatsapp.payments.ui.mapper.register.IndiaUpiMapperConfirmationActivity:com.fmwhatsapp.payments.ui.IndiaUpiProvideMoreInfoActivityEcom.fmwhatsapp.payments.ui.IndiaUpiProvideMoreInfoBottomSheetActivity@com.fmwhatsapp.payments.ui.IndiaUpiAccountRecoveryFinishActivityacom.fmwhatsapp.payments.phoenix.flowconfigurationservice.activities.IndiaUpiFcsPinHandlerActivity;com.fmwhatsapp.payments.IndiaUpiPaymentInvitePickerActivitygcom.fmwhatsapp.payments.phoenix.flowconfigurationservice.activities.IndiaUpiFcsAddPaymentMethodActivityicom.fmwhatsapp.payments.phoenix.flowconfigurationservice.activities.IndiaUpiFcsConsumerOnboardingActivity_com.fmwhatsapp.payments.phoenix.flowconfigurationservice.activities.IndiaUpiFcsResetPinActivityPcom.fmwhatsapp.payments.ui.international.IndiaUpiInternationalActivationActivityRcom.fmwhatsapp.payments.ui.international.IndiaUpiInternationalDeactivationActivityPcom.fmwhatsapp.payments.ui.international.IndiaUpiInternationalValidateQrActivityncom.fmwhatsapp.payments.phoenix.flowconfigurationservice.activities.IndiaUpiFcsTransactionConfirmationActivity;com.fmwhatsapp.payments.ui.IndiaWebViewUpiP2mHybridActivity8com.fmwhatsapp.payments.ui.BrazilPaymentSettingsActivity1com.fmwhatsapp.payments.ui.BrazilPayBloksActivity0com.fmwhatsapp.payments.ui.BrazilPaymentActivity3com.fmwhatsapp.payments.ui.BrazilSmbPaymentActivityAcom.fmwhatsapp.payments.ui.BrazilPaymentTransactionDetailActivity;com.fmwhatsapp.payments.ui.BrazilPaymentCardDetailsActivity1com.fmwhatsapp.payments.ui.BrazilFbPayHubActivitycom.fmwhatsapp.payments.ui.BrazilPaymentContactSupportActivityAcom.fmwhatsapp.payments.ui.BrazilPaymentContactSupportP2pActivityGcom.fmwhatsapp.payments.ui.BrazilPaymentCareTransactionSelectorActivity=com.fmwhatsapp.payments.ui.BrazilPaymentReportPaymentActivity3com.fmwhatsapp.payments.ui.BrazilPaymentDPOActivity?com.fmwhatsapp.payments.ui.BrazilPaymentIntegrityAppealActivity@com.fmwhatsapp.payments.ui.BrazilPaymentContactOmbudsmanActivity5com.fmwhatsapp.payments.ui.BrazilOrderDetailsActivity;com.fmwhatsapp.payments.ui.BrazilAccountRecoveryPinActivity8com.fmwhatsapp.framework.alerts.ui.AlertCardListActivity9com.fmwhatsapp.payments.ui.P2mLitePaymentSettingsActivity6com.fmwhatsapp.payments.ui.P2mLiteOrderDetailsActivity3com.fmwhatsapp.payments.ui.P2mLiteDyiReportActivity1com.fmwhatsapp.payments.ui.P2mLiteWebViewActivityBcom.fmwhatsapp.payments.ui.P2mLitePaymentTransactionDetailActivity.com.fmwhatsapp.payments.ui.BusinessHubActivityCcom.fmwhatsapp.payments.ui.MerchantPayoutTransactionHistoryActivitycom.fmwhatsapp.settings.chat.wallpaper.DefaultWallpaperPreviewFcom.fmwhatsapp.settings.chat.wallpaper.WallpaperCurrentPreviewActivity:com.fmwhatsapp.settings.chat.wallpaper.SolidColorWallpaperAcom.fmwhatsapp.settings.chat.wallpaper.SolidColorWallpaperPreviewBcom.fmwhatsapp.settings.chat.wallpaper.WallpaperCategoriesActivity>com.fmwhatsapp.settings.chat.wallpaper.GalleryWallpaperPreview@com.fmwhatsapp.settings.chat.wallpaper.YoGalleryWallpaperPreview'com.fmwhatsapp.settings.SettingsPrivacy$com.fmwhatsapp.settings.SettingsChat6com.fmwhatsapp.settings.SettingsCallingPrivacyActivity>com.fmwhatsapp.wabloks.commerce.ui.view.WaBkExtensionsActivityLcom.fmwhatsapp.wabloks.commerce.ui.view.WaExtensionsBottomsheetModalActivity5com.fmwhatsapp.biz.BusinessProfileExtraFieldsActivity2com.fmwhatsapp.businessupsell.BusinessAppEducation8com.fmwhatsapp.biz.linkedaccounts.LinkedAccountMediaView;com.fmwhatsapp.companiondevice.optin.ui.ForcedOptInActivity4com.fmwhatsapp.companiondevice.LinkedDevicesActivity=com.fmwhatsapp.companiondevice.LinkedDevicesEnterCodeActivityAcom.fmwhatsapp.companiondevice.CompanionHelloConfirmationActivity1com.fmwhatsapp.qrcode.DevicePairQrScannerActivity(com.fmwhatsapp.deeplink.DeepLinkActivity(com.fmwhatsapp.TextAndDirectChatDeepLinkapi.whatsapp.comwa.mewhatsapp.comwww.whatsapp.com/newsletter/channel!com.fmwhatsapp.DEEP_LINK_REDIRECTsendcatalogproductmessage" (Indicator: "android.intent.action.SENDTO"; File: "AndroidManifest.xml")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"25ca09764b275f4d1037b30dcbdb95583292fbb3ab8cf2e2dd822b513f17bb4a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790283550200,"unified_at":"2026-09-24T20:59:10.200Z","metadata":{"hashes":{"sha256":"25ca09764b275f4d1037b30dcbdb95583292fbb3ab8cf2e2dd822b513f17bb4a","sha1":"779fe35005596f221159f072ef157c3961b15d1a","md5":"05d7d64ff1f4e47c095a40ecd7ba18dd","sha512":"6d3694d568144fec3b744428dc5fb4b76b63aeaecbc88289508ed290ef8d7d9ac3a0a63a6e9fe4801c8cd1b67419529da25c5c2c200b04019952997e45f72b8e","ssdeep":"1572864:aiz7oBbxr07ZtvKlktCjrXS08YZZW+jo4NJWxQU08GSF:TzMBbxr0gktGXCYZZWdoJWLTRF","ssdeep_chunks":["1572864:aiz7oBb","1572864:iz7oBbx","1572864:z7oBbxr","1572864:7oBbxr0","1572864:oBbxr07","1572864:Bbxr07Z","1572864:bxr07Zt","1572864:xr07Ztv","1572864:r07ZtvK","1572864:07ZtvKl","1572864:7ZtvKlk","1572864:ZtvKlkt","1572864:tvKlktC","1572864:vKlktCj","1572864:KlktCjr","1572864:lktCjrX","1572864:ktCjrXS","1572864:tCjrXS0","1572864:CjrXS08","1572864:jrXS08Y","1572864:rXS08YZ","1572864:XS08YZZ","1572864:S08YZZW","1572864:08YZZW+","1572864:8YZZW+j","1572864:YZZW+jo","1572864:ZZW+jo4","1572864:ZW+jo4N","1572864:W+jo4NJ","1572864:+jo4NJW","1572864:jo4NJWx","1572864:o4NJWxQ","1572864:4NJWxQU","1572864:NJWxQU0","1572864:JWxQU08","1572864:WxQU08G","1572864:xQU08GS","1572864:QU08GSF","3145728:aiz7oBb","3145728:iz7oBbx","3145728:z7oBbxr","3145728:7oBbxr0","3145728:oBbxr07","3145728:Bbxr07Z","3145728:bxr07Zt","3145728:xr07Ztv","3145728:r07ZtvK","3145728:07ZtvKl","3145728:7ZtvKlk","3145728:ZtvKlkt","3145728:tvKlktC","3145728:vKlktCj","3145728:KlktCjr","3145728:lktCjrX","3145728:ktCjrXS","3145728:tCjrXS0","3145728:CjrXS08","3145728:jrXS08Y","3145728:rXS08YZ","3145728:XS08YZZ","3145728:S08YZZW","3145728:08YZZW+","3145728:8YZZW+j","3145728:YZZW+jo","3145728:ZZW+jo4","3145728:ZW+jo4N","3145728:W+jo4NJ","3145728:+jo4NJW","3145728:jo4NJWx","3145728:o4NJWxQ","3145728:4NJWxQU","3145728:NJWxQU0","3145728:JWxQU08","3145728:WxQU08G","3145728:xQU08GS","3145728:QU08GSF","1572864:TzMBbxr","1572864:zMBbxr0","1572864:MBbxr0g","1572864:Bbxr0gk","1572864:bxr0gkt","1572864:xr0gktG","1572864:r0gktGX","1572864:0gktGXC","1572864:gktGXCY","1572864:ktGXCYZ","1572864:tGXCYZZ","1572864:GXCYZZW","1572864:XCYZZWd","1572864:CYZZWdo","1572864:YZZWdoJ","1572864:ZZWdoJW","1572864:ZWdoJWL","1572864:WdoJWLT","1572864:doJWLTR","1572864:oJWLTRF"],"imphash":"Unknown"},"file_info":{"file_name":"FMWhatsAppFouadWhatsApp v9.73F Premium Mod Apk {CracksHash}.apk","file_type":["android"],"file_type_id":"apk","file_size":73015720,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1689191744000,"last_seen":1689191744000,"last_multi_scan":1689191744000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":10,"suspicious_count":4,"malicious_count":3,"total":17},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"SPR/ANDR.WAMod.BAB.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"SPR/ANDR.WAMod.BAB","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Broadcast Receivers","attack_id":"T1402","attack_id_wiki":"https://attack.mitre.org/techniques/T1402","identifiers":[{"type":"malicious","value":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES Encryption"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"tactic":"Credential Access","technique":"Capture SMS Messages","attack_id":"T1412","attack_id_wiki":"https://attack.mitre.org/techniques/T1412","identifiers":[{"type":"malicious","value":"Found a reference that may indicate interception of SMS content"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"tactic":"Collection","technique":"Audio Capture","attack_id":"T1429","attack_id_wiki":"https://attack.mitre.org/techniques/T1429","identifiers":[{"type":"suspicious","value":"Has the ability to record audio"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"tactic":"Impact","technique":"Carrier Billing Fraud","attack_id":"T1448","attack_id_wiki":"https://attack.mitre.org/techniques/T1448","identifiers":[{"type":"suspicious","value":"Found an indicator for SMS sending capabilities"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"tactic":"Impact","technique":"SMS Control","attack_id":"T1582","attack_id_wiki":"https://attack.mitre.org/techniques/T1582","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.769094280047896","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$22","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$23","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$24","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$25","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"AndroidManifest.xml\" has type \"Android binary XML\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://graph.facebook.com\"\n Found HTTPS url \"https://www.facebook.com\"\n Found HTTPS url \"https://maps.instagram.com\"\n Found HTTPS url \"https://graph.instagram.com\"\n Found HTTPS url \"https://graph.whatsapp.net\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"SHA-256-Digest: 8wWLMGb3qZcmrkvboxnFDX2y5k/AxwufdGLzRznZsi4=\" (Indicator: \"vbox\") in Source: MANIFEST.MF","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/60 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Has the ability to record audio","description":"Permission request for \"android.permission.RECORD_AUDIO\"","origin":"Static Parser","mitre_attack_id":"T1429","relevance":10,"id":"static-34","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found an indicator for SMS sending capabilities","description":"$28","origin":"File/Memory","mitre_attack_id":"T1448","relevance":10,"id":"string-36","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"malicious","category":"General","name":"Has the ability to dial a phone number","description":"Permission request for \"android.permission.CALL_PHONE\"","origin":"Static Parser","relevance":3,"id":"static-33","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"malicious","category":"Installation/Persistence","name":"Has the ability to execute code after reboot","description":"Permission request for \"android.permission.RECEIVE_BOOT_COMPLETED\"","origin":"Static Parser","mitre_attack_id":"T1402","relevance":10,"id":"static-28","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found a reference that may indicate interception of SMS content","description":"\"android.provider.Telephony.SMS_RECEIVED\" (Indicator: \"android.provider.telephony.sms_received\"; File: \"GetCredential.smali\")","origin":"File/Memory","mitre_attack_id":"T1412","relevance":3,"id":"string-40","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Has the ability to record audio"},{"detail":"Found a reference that may indicate interception of SMS content"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Has the ability to execute code after reboot"},{"detail":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Found an indicator for SMS sending capabilities"}],"sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]}]},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"64af0537de538d436a0e8c08","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"ANDR.WAMod.BAB","submit_name":"FMWhatsAppFouadWhatsApp v9.73F Premium Mod Apk {CracksHash}.apk","analysis_start_time":"2023-07-12T19:55:46+00:00","indicators_count":{"informative":10,"suspicious":6,"malicious":3},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ANDROID.SF","sha256":"69749198560f2eac53f052f79f8aca82228bfee56d0f571bcb063f3547b5f233","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"MANIFEST.MF","sha256":"515b9abeb3539014646ccbcc9596496fbda63b13c96e5274d6620b8185ebf709","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"libsoundtouch.so_1689191811761","sha256":"a87d6d5b9b0d40c51c4ef5af66bd38b768c82b855b3ee66f0cc60ab66b87f3ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"libopustool.so_1689191811761","sha256":"03ad21d7a4ce8329bc50d3f36fa367305342bf6745721a4e9f6f6b68948854b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"libopustool.so","sha256":"b5f881155b3256995354b626fbc4001222aad3ff57fd481724b4e8fa64084fac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"libsoundtouch.so","sha256":"dc0b91c5d1facd16a6d127c77cc42003076340036f80f4b0d4e63d8e8f31d4b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"libsuperpack.so_1689191811758","sha256":"e4d2014ce7a087cb83ce60d99f3a331d9baf08bb0b7366e0f25bdf867349309a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"libunwindstack.so_1689191811761","sha256":"8b4f62f464eb6af4285df8cea8fa4c29c04a3768dd7a7b9c34cdae38100eb5cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"libsuperpack.so","sha256":"8ecd431fe9b680762756cfa8f87150ab8028efa99ebee5f2cfd95cbad42b47d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"AndroidManifest.xml","sha256":"f1d59164269a79bded62c5657542e0bf08cf2d17b84ae509dbf3bb4ed2338ee0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"libunwindstack.so","sha256":"ba13dffb65941350b85fb1f4a6c7473f835de00b4134298c81e8cfe3a1b41935","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"ANDROID.RSA","sha256":"8e97e19a547184ba1f58f307b8d45ba8fd02c78052a69b64dc3b3e93263d6d92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"java.security.Provider","sha256":"f061e7aec6360e108d4fcd5393a6f9413d766533215fb7da31fef41e410135a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"kotlinx.coroutines.CoroutineExceptionHandler","sha256":"3129b8edf6db07de6f8ff47695e2177c8bba4eed2962d3085c719e5acbb58a33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"kotlinx.coroutines.internal.MainDispatcherFactory","sha256":"a1ea77ea8f93f419256b6e66f29713f950d8d6e90442b608d880a48003b5eb72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]},{"name":"javax.annotation.processing.Processor","sha256":"0890ecc819a706db6e91eb3de45f8e1db710b3602011801f9c9117e79a33c190","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64af0537de538d436a0e8c08"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["64af0537de538d436a0e8c08"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious SPR/ANDR.WAMod.BAB Sample 25ca09764b27… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 25ca09764b27…. Malware family: SPR/ANDR.WAMod.BAB. Threat score 100/100. 1/26 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/25ca09764b275f4d1037b30dcbdb95583292fbb3ab8cf2e2dd822b513f17bb4a"}],["$","meta","4",{"property":"og:title","content":"Malicious SPR/ANDR.WAMod.BAB Sample 25ca09764b27… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 25ca09764b27…. Malware family: SPR/ANDR.WAMod.BAB. Threat score 100/100. 1/26 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/25ca09764b275f4d1037b30dcbdb95583292fbb3ab8cf2e2dd822b513f17bb4a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious SPR/ANDR.WAMod.BAB Sample 25ca09764b27… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 25ca09764b27…. Malware family: SPR/ANDR.WAMod.BAB. Threat score 100/100. 1/26 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]