34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 39:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T44f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample a38111a4b6bd… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample a38111a4b6bd…. Threat score 35/100. 0/27 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a38111a4b6bdf26e84f4b219b5e6b894f9cb0c37b213883fa7ab91716265342e","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","a38111a4b6bdf26e84f4b219b5e6b894f9cb0c37b213883fa7ab91716265342e"],"about":{"@type":"SoftwareApplication","name":"Poweramp Music Player v3-build-946 Premium Mod Apk {CracksHash}.apk","applicationCategory":["android"],"identifier":"a38111a4b6bdf26e84f4b219b5e6b894f9cb0c37b213883fa7ab91716265342e","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T276a,"RRThe option may temporarily change volume for a few seconds on Bluetooth connection" (Indicator: "connect") "ccTo add tracks navigate to any Library list, select tracks or other items, and use + Playlist action" (Indicator: "select") "Disconnect" (Indicator: "connect") "y

relaxed AAudio requirements on Pixels @ Android 11/12/13, added more sample formats

Audio Info popup shows more info about sample rate/bit width conversions

this depends on info reported by the system that may be incorrect for some firmwares/devices/etc.
depending on the firmware, system may force some fixed sample rate

Hi-Res Output format selection

depending on the device/firmware, some manually selected formats may result in standard definition, no sound at all, or output failure

OpenSL output supports Float32 format now

OpenSL Hi-Res output replaced to Hi-Res output for old Androids

Volume Levels option returned for Android 13
At the moment Volume Levels supported within the app only

fixes/improvements for Android 13
Note: while Legacy File Access still works on Android 13, it will be disabled in the next Poweramp builds
Builds 934-940:

new Bottom buttons option
Makes shuffle, play, select, etc. buttons more accessible in the lower part of screen
new Header Buttons option
tracks and other items range selection in lists
- while in the selection mode Range button toggles checked state between the first and the last checked item
- while in the selection mode long pressing selects all items between previously checked item and long pressed item
new Playlis" (Indicator: "select") "t Insert Position, Queue Insert Position, Play Next Insert Position options
- modes can be changed by long pressing action button in the selection menu
- + Playlist dialog also has modes selection
- Shuffled mode mixes items randomly with the existing items, preferable after the currently played track
whitespace could be used as a split symbol now
search page has quick category filter buttons on top
Long press on search category button to search just that category
added year/album sort for tracks
new settings/data export/import options:
- per-device/per-song preset assignments
- folder/playlist list memory
- bookmarks
new Pause on Screen Off option
fixed few issues with 3rd party skins @ Android 12
added workarounds for legacy Ducktamine skins
Absolute Volume detection improvements
added bold font for widgets

Builds 922-925:

Music Folders selection improvements
- both legacy file paths and separately added folders (Legacy File Access) are supported now
  This may cause duplications if same folder checked as a legacy storage and as a folder
- selected unavailable storages and folders are shown now and can be deleted
- Music Folders selection option for Export/Import Settings/Data
re-enabled Legacy File Access option on Android 12(L)
long" (Indicator: "select") "press on Settings in the main menu opens Settings Search
new Search Track Titles option
Volume Levels option disabled for Android 12 as volume provider functionality is currently broken in Android 12
improved Audio Focus processing for Samsungs @ Android 12
better Bluetooth-to-Bluetooth audio route change handling
fixed issue with Folders Hierarchy song titles for Auto
fixed issue with stream deletion from playlists
workaround for a crash on Samsung S9(+) @ Android 8
workaround for Play bundle missing resources causing crash on some devices or for some 3rd party skins
"Cast to" dialog devices list can be pinch-to-zoomed now

Builds 912-921:

Target SDK bump to 31 (Android 12) due to the Play store requirement
- numerous internal refactorings related to the new Target SDK
- Bluetooth fu" (Indicator: "open") "nctionality on Android 12 requires a new permission. Note that Android 12 names the Bluetooth permission as "Nearby devices". Poweramp doesn't use any location info
- APK size slightly increased due to the Target SDK and build tools update, though size on the device is the same or less as resources.arsc is not extracted anymore
- some 3rd party skins may have minor glitches and require rebuilding due to the new build tools
Music Folders selection improvements for multiple separate "root" folders
On Android 11+, it's not possible to select root of the storage or Downloads folder anymore due to Android limitation. Multiple subfolders (including Downloads subfolders) can be added independently
new Rounded Corners option
Similar to Android 12 rounding, enabled by default
new Stretch Overscroll option
Similar to Android 12 overscroll effect, enabled by defa" (Indicator: "select") "ult
new Material You colors option
Android 12+ only
various other small improvements for Android 12
new Export/Import Settings/Data
- these now export/import not just Poweramp settings, but also data such as album art, playlists, streams, and track statistics
- exported file is compatible with old Poweramp builds if none of the new options selected
cold start improvements
slow to mount SD cards are better handled now

Builds 906-911:

new equalizer features ported from the Poweramp Equalizer app:
- Parametric Equalizer Mode
  - configurable parameters allow high level of sound customization with just a few bands
  - initially empty, bands added/removed/organized by user
  - ban" (Indicator: "select") "d parameters:
    - type
      
      Low Pass/High Pass - passes the signal starting from the defined frequency, resonant with higher Q factor
      Low Shelf/High Shelf - similar to Low Pass/High Pass with a flatter frequency response
      Band Pass - passes the signal around user defined frequency
      Peaking Band - narrower version of the Band Pass
    - channels - applies band to the left, right, or both channels
    - gain - the amplification of the band, may be negative
    - frequency - the center/cutoff point of the band
    - Q - bandwidth and the resulting frequency response curve for the band
  - bands have user configurable background color for easier identification
  - parametric presets are separate from the graphic ones
  - parametric mode has Auto save always enabled, changes are auto saved to the currently selected preset
  - <Default preset> (the implicit preset which is used when no preset selected) is visible in the preset list, but can't be deleted/renamed
- preset" (Indicator: "select") "s now always have tone (Bass/Treble) stored in them
  - built-in presets may also have tone values - usually at 0
  - few tone-only presets added
- knob values can be edited via long press
- preset sharing/import/export via long press in preset list
  Presets saved/loaded in JSON format
- presets also can be imported by opening via file manager
- both Poweramp/Poweramp Equalizer .json and AutoEQ .txt files are supported
  AutoEQ graphic and parametric formats supported and imported to the graphic or parametric presets appropriately.
  Poweramp adds +6dB to AutoEQ graphic gains
search history

" (Indicator: "open") "22The link will be opened in the browser/another app" (Indicator: "open") "No write access to the file(s). To enable access in the Grant Access dialog, please select storage (e.g. SD card) in hamburger menu, then click Select" (Indicator: "select") "DDPlease ensure the internet connection is up and stable and try again" (Indicator: "connect") "JJInternet connection is only required for the first 24 hours after purchase" (Indicator: "connect") ",,Long press any item to select multiple items" (Indicator: "select") "**Long press any item for the selection menu" (Indicator: "select") "Long press item to select/move" (Indicator: "select") "Cast. Disconnected" (Indicator: "connect")37:T41a,"ult

new Material You colors option
Android 12+ only

various other small improvements for Android 12

new Export/Import Settings/Data

these now export/import not just Poweramp settings, but also data such as album art, playlists, streams, and track statistics
exported file is compatible with old Poweramp builds if none of the new options selected

cold start improvements

slow to mount SD cards are better handled now
Builds 906-911:

new equalizer features ported from the Poweramp Equalizer app:
- Parametric Equalizer Mode
  - configurable parameters allow high level of sound customization with just a few bands
  - initially empty, bands added/removed/organized by user
  - ban" (Indicator: "https://")38:T4b5,"AndroidManifest.xml" has type "Android binary XML"- [targetUID: N/A] "LoveDoLove.RSA" has type "data"- [targetUID: N/A] "LoveDoLove.SF" has type "UTF-8 Unicode text with CRLF line terminators"- [targetUID: N/A] "MANIFEST.MF" has type "UTF-8 Unicode text with CRLF line terminators"- [targetUID: N/A] "_.Sd" has type "UTF-8 Unicode text"- [targetUID: N/A] "_.ey" has type "UTF-8 Unicode text"- [targetUID: N/A] "libffmpeg_neon.so" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked BuildID[sha1]=61ecac90d84b411dc493638288fc2b44e843c5cf stripped"- [targetUID: N/A] "libffmpeg_neon.so_1677245236556" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked BuildID[sha1]=37bf690a3eed436716284b00d09d04442407e614 stripped"- [targetUID: N/A] "libpowerampcore.so" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked BuildID[sha1]=4afcc1d147835a3c8bf4e533fb4172a2d1c4dde4 stripped"- [targetUID: N/A] "libpowerampcore.so_1677245236556" has type "ELF 64-bit LSB shared object ARM aarch64 version 1 (SYSV) dynamically linked BuildID[sha1]=6556c7e6108ae2175545caf2fdb803ac1f840066 stripped"- [targetUID: N/A]30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"a38111a4b6bdf26e84f4b219b5e6b894f9cb0c37b213883fa7ab91716265342e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1794146767310,"unified_at":"2026-11-08T14:06:07.310Z","metadata":{"hashes":{"sha256":"a38111a4b6bdf26e84f4b219b5e6b894f9cb0c37b213883fa7ab91716265342e","sha1":"a482a444501afb420e88f6647370111bb318dd46","md5":"08ee45ad7c3590c9b70f9bc4e66c4a9d","sha512":"5a962a663effe58a376137d089a87397ad1863c02c21be423c1b86d6679f72a6fe8a9f827e28ee3f7ccddacce1177b6ef8843fbf7d3924aa878fdc4583134ca8","ssdeep":"393216:2NOfwtKjH67vJm7vp/ZKOgUK3GGAUf1fFZrnGNsGgVyWvhWMrJkcWZy82Amgzr01:24fgA67onUfycQ2AmgzryJtWG","ssdeep_chunks":["393216:2NOfwtK","393216:NOfwtKj","393216:OfwtKjH","393216:fwtKjH6","393216:wtKjH67","393216:tKjH67v","393216:KjH67vJ","393216:jH67vJm","393216:H67vJm7","393216:67vJm7v","393216:7vJm7vp","393216:vJm7vp/","393216:Jm7vp/Z","393216:m7vp/ZK","393216:7vp/ZKO","393216:vp/ZKOg","393216:p/ZKOgU","393216:/ZKOgUK","393216:ZKOgUK3","393216:KOgUK3G","393216:OgUK3GG","393216:gUK3GGA","393216:UK3GGAU","393216:K3GGAUf","393216:3GGAUf1","393216:GGAUf1f","393216:GAUf1fF","393216:AUf1fFZ","393216:Uf1fFZr","393216:f1fFZrn","393216:1fFZrnG","393216:fFZrnGN","393216:FZrnGNs","393216:ZrnGNsG","393216:rnGNsGg","393216:nGNsGgV","393216:GNsGgVy","393216:NsGgVyW","393216:sGgVyWv","393216:GgVyWvh","393216:gVyWvhW","393216:VyWvhWM","393216:yWvhWMr","393216:WvhWMrJ","393216:vhWMrJk","393216:hWMrJkc","393216:WMrJkcW","393216:MrJkcWZ","393216:rJkcWZy","393216:JkcWZy8","393216:kcWZy82","393216:cWZy82A","393216:WZy82Am","393216:Zy82Amg","393216:y82Amgz","393216:82Amgzr","393216:2Amgzr0","393216:Amgzr01","786432:2NOfwtK","786432:NOfwtKj","786432:OfwtKjH","786432:fwtKjH6","786432:wtKjH67","786432:tKjH67v","786432:KjH67vJ","786432:jH67vJm","786432:H67vJm7","786432:67vJm7v","786432:7vJm7vp","786432:vJm7vp/","786432:Jm7vp/Z","786432:m7vp/ZK","786432:7vp/ZKO","786432:vp/ZKOg","786432:p/ZKOgU","786432:/ZKOgUK","786432:ZKOgUK3","786432:KOgUK3G","786432:OgUK3GG","786432:gUK3GGA","786432:UK3GGAU","786432:K3GGAUf","786432:3GGAUf1","786432:GGAUf1f","786432:GAUf1fF","786432:AUf1fFZ","786432:Uf1fFZr","786432:f1fFZrn","786432:1fFZrnG","786432:fFZrnGN","786432:FZrnGNs","786432:ZrnGNsG","786432:rnGNsGg","786432:nGNsGgV","786432:GNsGgVy","786432:NsGgVyW","786432:sGgVyWv","786432:GgVyWvh","786432:gVyWvhW","786432:VyWvhWM","786432:yWvhWMr","786432:WvhWMrJ","786432:vhWMrJk","786432:hWMrJkc","786432:WMrJkcW","786432:MrJkcWZ","786432:rJkcWZy","786432:JkcWZy8","786432:kcWZy82","786432:cWZy82A","786432:WZy82Am","786432:Zy82Amg","786432:y82Amgz","786432:82Amgzr","786432:2Amgzr0","786432:Amgzr01","393216:24fgA67","393216:4fgA67o","393216:fgA67on","393216:gA67onU","393216:A67onUf","393216:67onUfy","393216:7onUfyc","393216:onUfycQ","393216:nUfycQ2","393216:UfycQ2A","393216:fycQ2Am","393216:ycQ2Amg","393216:cQ2Amgz","393216:Q2Amgzr","393216:2Amgzry","393216:AmgzryJ","393216:mgzryJt","393216:gzryJtW","393216:zryJtWG"],"imphash":"Unknown"},"file_info":{"file_name":"Poweramp Music Player v3-build-946 Premium Mod Apk {CracksHash}.apk","file_type":["android"],"file_type_id":"apk","file_size":23786312,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1668454872000,"last_seen":1694535830000,"last_multi_scan":1694535830000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":["agent","faceliker","fbook"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":4},"sandbox_signatures":{"informative_count":5,"suspicious_count":4,"malicious_count":0,"total":9},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"637299d53ae52177815c2f72"},{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"tactic":"Collection","technique":"Audio Capture","attack_id":"T1429","attack_id_wiki":"https://attack.mitre.org/techniques/T1429","identifiers":[{"type":"suspicious","value":"Has the ability to record audio"}],"sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Found API related strings","description":"$36","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"637299d53ae52177815c2f72"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://play.google.com/store/apps/details?id=com.maxmpz.equalizer\"\n Pattern match: \"play.google.com/store/apps/details?id=com.maxmpz.equalizer\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"637299d53ae52177815c2f72"},{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"637299d53ae52177815c2f72"},{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/59 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"637299d53ae52177815c2f72"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/64 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$38","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found - (Indicator: \"cast\") in Source: a38111a4b6bdf26e84f4b219b5e6b894f9cb0c37b213883fa7ab91716265342e.apk.bin\n Found - (Indicator: \"des\") in Source: a38111a4b6bdf26e84f4b219b5e6b894f9cb0c37b213883fa7ab91716265342e.apk.bin\n Found - (Indicator: \"des\") in Source: MANIFEST.MF\n Found - (Indicator: \"rsa\") in Source: MANIFEST.MF\n Found - (Indicator: \"rsa2\") in Source: MANIFEST.MF\n Found - (Indicator: \"rc6\") in Source: MANIFEST.MF\n Found - (Indicator: \"aes\") in Source: MANIFEST.MF\n Found - (Indicator: \"aes\") in Source: LoveDoLove.SF\n Found - (Indicator: \"rsa\") in Source: LoveDoLove.SF\n Found - (Indicator: \"rc4\") in Source: LoveDoLove.SF\n Found - (Indicator: \"des\") in Source: LoveDoLove.SF\n Found - (Indicator: \"rc6\") in Source: LoveDoLove.SF","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"level":"suspicious","category":"General","name":"Uses java reflection classes","description":"Found invoke in \"org.lsposed.hiddenapibypass.HiddenApiBypass.smali\" to \"java.lang.reflect.Method.invoke\"\n Found invoke in \"org.lsposed.lspatch.metaloader.LSPAppComponentFactoryStub.smali\" to \"java.lang.reflect.Method.invoke\"","origin":"Static Parser","relevance":3,"id":"static-47","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Has the ability to record audio","description":"Permission request for \"android.permission.RECORD_AUDIO\"","origin":"Static Parser","mitre_attack_id":"T1429","relevance":10,"id":"static-34","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]}]},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agent","faceliker","fbook"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"63f8bb00938eb8e4d20d3249","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"no specific threat","submit_name":"Poweramp Music Player v3-build-946 Premium Mod Apk CracksHash.apk","analysis_start_time":"2023-02-24T13:26:29+00:00","indicators_count":{"informative":4,"suspicious":4,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"63ada76af462df3617471bd1","environment_id":200,"environment_description":"Android Static Analysis","state":"ERROR","error_type":"File \"Poweramp_Music_Player_3_946_Full__4781_Revdl.com.apk\" was detected as \"java jar\", this format is not supported on ANDROID","verdict":"undetected","submit_name":"Poweramp_Music_Player_3_946_Full__4781_Revdl.com.apk","analysis_start_time":"2022-12-29T14:42:51+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"637e1d079790967bbf21e33d","environment_id":200,"environment_description":"Android Static Analysis","state":"ERROR","error_type":"File \"Poweramp_build-946-uni_LoveDoLove.apk\" was detected as \"java jar\", this format is not supported on ANDROID","verdict":"undetected","submit_name":"Poweramp_build-946-uni_LoveDoLove.apk","analysis_start_time":"2022-11-23T13:15:52+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"6373d07f09ea9b7c3d7182d8","environment_id":200,"environment_description":"Android Static Analysis","state":"ERROR","error_type":"File \"Poweramp_build-946-uni_Unlocked_UserUpload.Net.apk\" was detected as \"java jar\", this format is not supported on ANDROID","verdict":"undetected","submit_name":"Poweramp_build-946-uni_Unlocked_UserUpload.Net.apk","analysis_start_time":"2022-11-15T17:46:40+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"637331ed16503e09b20e93e4","environment_id":200,"environment_description":"Android Static Analysis","state":"ERROR","error_type":"File \"Poweramp_build-946-uni_Unlocked.apk\" was detected as \"java jar\", this format is not supported on ANDROID","verdict":"undetected","submit_name":"Poweramp_build-946-uni_Unlocked.apk","analysis_start_time":"2022-11-15T06:30:07+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"637299d53ae52177815c2f72","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"malware_family":"Android:Evo","submit_name":"Poweramp Music Player v3-build-946 Premium Mod Apk {CracksHash}.apk","analysis_start_time":"2022-11-14T19:41:13+00:00","indicators_count":{"informative":3,"suspicious":1,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AndroidManifest.xml","sha256":"438a1eaf467215f4b0a15184b47a6e520e719782711e8249715a8e51fa525034","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"name":"LoveDoLove.RSA","sha256":"1a613b6f69568fcc5db7b72e32e0a95644f8cf99ecf846e2402e60de2a6ac33c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"name":"LoveDoLove.SF","sha256":"e5fac685054a244be57b2821b4a9d8551b7828ebb05d449a8035e26d795257af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"name":"MANIFEST.MF","sha256":"4c8750ea6270cd97e8af9fa2852197431ad5755d555943920d0db7f2c6b10067","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"name":"_.Sd","sha256":"727c7241ed7f366437e7633874b2dca3edbda1f3669c885d99195784bff3ecea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"name":"_.ey","sha256":"24d0cc1b1ca5b35865afdd753a847e96b1aa4206b64590414a7ad17c3e276a4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"name":"libffmpeg_neon.so","sha256":"b9a4df43cdad963326d74120ef877ddb2109afbf18831260a89a765efa9ba745","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"name":"libffmpeg_neon.so_1677245236556","sha256":"44510af08c79f66432c9b1eb355cedb8c19401e4910d2d5de33a7109e97a0f74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"name":"libpowerampcore.so","sha256":"4cc75d066d784b7757c9b3700b9cce12ff685325141b426efedbd81ec5166bfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]},{"name":"libpowerampcore.so_1677245236556","sha256":"42552eade12aeb732aa199564ddf2dc24e3602046b53655b7202bff48c3d9648","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f8bb00938eb8e4d20d3249"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["637299d53ae52177815c2f72","63f8bb00938eb8e4d20d3249"]}}}]]}] 2c:[["$","title","0",{"children":"Suspicious Sample a38111a4b6bd… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample a38111a4b6bd…. Threat score 35/100. 0/27 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a38111a4b6bdf26e84f4b219b5e6b894f9cb0c37b213883fa7ab91716265342e"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample a38111a4b6bd… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample a38111a4b6bd…. Threat score 35/100. 0/27 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a38111a4b6bdf26e84f4b219b5e6b894f9cb0c37b213883fa7ab91716265342e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample a38111a4b6bd… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample a38111a4b6bd…. Threat score 35/100. 0/27 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]] 32:null