24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T468,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample eb15c72b6530… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample eb15c72b6530…. Threat score 35/100. 0/27 AV engines flagged this file. 1 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/eb15c72b6530e67f80906fd21ba2ba887a41c3099681225e7e24f4c5694fa546","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","eb15c72b6530e67f80906fd21ba2ba887a41c3099681225e7e24f4c5694fa546"],"about":{"@type":"SoftwareApplication","name":"Folio for Facebook \u0026 Messenger v3.9.6 build 946 arm v8 Premium Mod Apk {CracksHash}.apk","applicationCategory":["android"],"identifier":"eb15c72b6530e67f80906fd21ba2ba887a41c3099681225e7e24f4c5694fa546","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T10c4,Pattern match: "www.facebook.com" Heuristic match: "-)>\s*$/g,Lt={option:[1,],legend:[1,

],area:[1,,],param:[1,

],thead:[1,,

],tr:[2,,

],col:[2, 0) { var href = " Pattern match: "facebook.com/l.php" Pattern match: "https://www.facebook.com/watch/?v=" Pattern match: "facebook.com/l.php?u=" Pattern match: "http://m.facebook.com/l.php?u=" Pattern match: "https://m.facebook.com/home.php?sk=h_nor\" Pattern match: "https://www.facebook.com/" Pattern match: "https://www.facebook.com/messages/" Pattern match: "facebook.com/settings/notifications/" Heuristic match: "4 = (rect.bottom - rect.top) / 4; return centerY >= -h_4 && centerY <= (window.innerHeight || document.documentElement.clientHeight) + h_4; }; _.init = function() { _.startTrackingTimer(); $(docume" Pattern match: "https://s3.amazonaws.com/ads.swishly.com/friendly/iwebtv-icon-120x120.png" Pattern match: "https://s3.amazonaws.com/ads.swishly.com/friendly/iwebtv001-1200x627.jpg" Pattern match: "https://www.instagram.com+articlePostTime.parent().attr(href)" Pattern match: "https://www.instagram.com/p/BgEZXYSliI2/" Pattern match: "https://www.instagram.com/p/+post.code" Pattern match: "https://www.instagram.com/p/+post[code]+/" Pattern match: "https://www.instagram.com/accounts/login" Pattern match: "https://www.instagram.com/p/" Pattern match: "https://www.ins" Pattern match: "tagram.com/p/" Pattern match: "www.instagram.com/p/" Pattern match: "https://www.instagram.com/+owner.username" Heuristic match: "(function($, exports) { console.debug(instagram preload ...) var x = /^https?:\/\/(?:(?:(?:m(?:obile)?)|(?:www)|)\.)?twitter\.com/, P = /\/@?([_\w\d]+)\/status(?:es)?\/([\d]+)\/?/, R = new RegExp( + x.source + P.source) " Pattern match: "https://graph.facebook.com/+userID+/picture?type=large" Heuristic match: "(function($,exports){ console.debug(twitter preload ...) var x = /^https?:\/\/(?:(?:(?:m(?:obile)?)|(?:www)|)\.)?twitter\.com/, P = /\/@?([_\w\d]+)\/status(?:es)?\/([\d]+)\/?/, R = new RegExp( + x.source + P.sour" Heuristic match: "if (tweet) { return (entry.entryId.indexOf(promotedTweet-) == 0) || tweet[promotedMetadata] } } catch (ex){ console.error([Twitter ad]," Pattern match: "https://twitter.com/" Heuristic match: "(function($, exports) { console.debug(tweets script, exports); var x = /^https?:\/\/(?:(?:(?:m(?:obile)?)|(?:www)|)\.)?twitter\.com/, P = /\/@?([_\w\d]+)\/status(?:es)?\/([\d]+)\/?/, R = new RegExp( + x.source + P.source) " Pattern match: "https://mobile.twitter.com" Heuristic match: "lib/arm64-v8a/libRSSupport.so" Heuristic match: "lib/arm64-v8a/libglide-webp.so" Heuristic match: "lib/arm64-v8a/librealm-jni.so" Heuristic match: "lib/arm64-v8a/librsjni.so" Heuristic match: "lib/arm64-v8a/librsjni_androidx.so" Heuristic match: "7Fmmm,.ES"26:T4319,"console.debug("show menu"); _fas_.showMenu(r); } else { console.debug("don't show menu"); } } }; function injectionConfigForDocument() { console.debug('injectionConfigForDocument'); var injectionHost = ""; var protocol = document.location.protocol; if (protocol == "resources:") { injectionHost = "about." + document.location.host; console.debug('Injection host : ' + injectionHost); } else if (protocol == "about:") { // we are on a about: document... injectionHost = "about." + document.location.pathname; } else { injectionHost = document.location.host; console.debug('injectionConfigForDocument injectionHost 1',injectionHost); if (injectionHost != "www.facebook.com" && injectionHost.endsWith("fac" (Indicator: "facebook.com"), "ebook.com")) { console.debug('injectionConfigForDocument injectionHost 1.5',injectionHost); injectionHost = "facebook.com"; } else if (injectionHost.endsWith("instagram.com")) { injectionHost = "instagram.com"; } else if (injectionHost.endsWith("twitter.com")) { injectionHost = "twitter.com"; } else if (injectionHost.endsWith("tumblr.com")) { injectionHost = "tumblr.com"; } else if (injectionHost == "www.facebook.com") { injectionHost = "desktop.facebook.com"; } else if (injectionHost.endsWith("tiktok.com")) { injectionHost = "tiktok.com"; } else if (injectionHost.endsWith("youtube.com")) { injectionHost = "youtube.com"; } } console.log("injectionConfigForDocument injectionHost 2", injectionHost)" (Indicator: "facebook.com"), "(function() { try { console.debug('loading prototypes...'); var host = document.location.host; if (host !== undefined && (host.endsWith("facebook.com") || host.endsWith("instagram.com"))) { window.chrome = {}; } window.emptyFunction = function() {}; function setPlatform(window, platform) { if (window.navigator.platform !== platform) { var platformProp = { get: function() { return platform; } }; try { Object.defineProperty(window.navigator, 'platform', platformProp); } catch (e) { window.navigator = Object.create(navigator, { platform: platformProp }); } } } setPlatform(window, "MacIntel"); if (!String.prototype.endsWith) { Strin" (Indicator: "facebook.com"), "pe') > -1) { doc.documentElement.innerHTML = markup; } else { doc.body.innerHTML = markup; } return doc; } else { return nativeParse.apply(this, arguments); } }; }(DOMParser)); _fas_.logCheckPoint("prototype loaded") console.debug("document.body", document.body) if (document.location.hostname.indexOf("facebook.com") >= 1) { console.debug("Facebook overrider") window.ow_defineOverrider = (function() { var _ = {defineQueue:[]} _.defineAndRequire = function(moduleName, dependencies, fn, callback) { try { if (_.ow_define === undefined) { _.defineQueue.push([moduleName, dependencies, fn, callback]) } else { _.ow_define(moduleName, dependencies, fn);" (Indicator: "facebook.com"), "requireLazy([moduleName], function(){ console.debug("[OW_DEFINED] defineAndRequire requireLazy", moduleName, arguments); if (callback) { callback(); } }) } } catch(ex) { console.error("[OW_DEFINED] defineAndRequire moduleName", moduleName); console.error("[OW_DEFINED] defineAndRequire", ex); } } _.onOwDefined = function() { console.debug("[OW_DEFINED] onOwDefined"); try { if (document.location.hostname.indexOf("m.facebook.com") >= 1) { console.debug("Facebook mobile overrider") _.defineAndRequire("Friendly_XOAuthErrorController", ["XOAuthErrorController"], function(module, exports, XOAuthErrorController){ console.debug("[SHIMDEF] Overriding XOAuthErrorControl" (Indicator: "facebook.com") "h.push('

' + section["header"] + '

'); } if (section["all"]) { section["all"].forEach(function(entry) { renderEntry(h, entry); }); } h.push(''); } $("body").on("click", "div[data-href]", function() { var div = $(this); var href = div.attr("data-href"); var refresh = div.attr("data-refresh"); if (refresh === "true") { _fas_.openBookmarkTabWithRefresh("https://m.facebook.com" + href); } else { _fas_.openBookmarkTab("https://m.facebook.com" + href); } }) window.fas_initBookmark = (function() { if (_fas_._windowLevel() != "menu") { $("body").css("padding-top", 0) } var payload = _fas_fb.bookmarks(); console.debug(_fas_fb.bookmarks(), "bookmarkjs") if (payload["0"]) { var h = []; var bookmarks = payload["0"]; var c" (Indicator: "facebook.com") "}); renderSection(h, { "all": [{ "name": "Facebook Help & Settings...", "url": "/bookmarks?", "pic": "https://graph.facebook.com/facebook/picture", "count": 0 }] }); } catch (ex) { console.error("[Bookmark]", ex); } $("body").html(''); $("body").append(h.join('')); } }); window.fas_initBookmark(); })PK" (Indicator: "facebook.com") "assets/script/desktop.facebook.com.conf.json" (Indicator: "facebook.com") "assets/script/desktop.facebook.com_base.css" (Indicator: "facebook.com") "assets/script/desktop.facebook.com_base.js(function($,exports){ console.debug("Desktop Facebook"); if (window.top==window){ if (_fas_._windowLevel()=="sharer_link") { $("head").append(''); $(".unclickable").parent().css("width","auto"); } } try { localStorage.setItem('__MWInboxDetail.info__', "false"); } catch (ex) { console.error("[Desktop localStorage]", ex) } window.fas_loadSpecificDesign = function(){ try { var windowVariable = window.OW_useNightMode || window.OW_useAMOLEDMode; if (document.documentElement !== null && document.documentElement !== undefined) { if (windowVariable) { document.documentElement.classList.add("__fb-dark-mode"); } else { document.documentElement.classList.remove("__fb-dark-mode"); }" (Indicator: "facebook.com") "assets/script/facebook.com.conf.json}" (Indicator: "facebook.com") "assets/script/facebook.com_account.lib.js(function($,exports){ console.debug("account lib..."); exports.AccountLib = (function(){ var _ = {}; _.ifLoggedInThen = function(callback) { requireLazy(["CurrentUserInitialData"], function(data){ try { if (data && data["USER_ID"] && data["USER_ID"] != "0"){ var userID = data["USER_ID"] console.debug("[AVATAR] userID", userID) if (userID) { try { var canvas = $("

") var ctx = canvas[0].getContext("2d") var img = $("img") img[0].onload = function(){ ctx.drawImage(img[0], 0,0, 200,200) var data64 = canvas[0].toDataURL() var arrayS" (Indicator: "facebook.com") "tring = data64.split(" ") var b64 = arrayString[arrayString.length - 1] _fas_session.updateProfilePic64(userID, b64) } img[0].src = 'https://m.facebook.com/search/async/profile_picture/?fbid='+userID+'&width=200&height=200' } catch(ex) { console.error("[CurrentUserInitialData 1]", ex) } } callback(userID); } } catch(ex){ console.error("[CurrentUserInitialData 2]", ex) } }); }; _.fetchAccountProfilePicture = function(userID){ _fas_session.updateProfile_json(JSON.stringify({ currentUserID : userID, picture : "https://graph.facebook.com/"+userID+"/picture?type=large", domain : "com.fa" (Indicator: "facebook.com"), "assets/script/facebook.com_article.lib.js(function($,exports){ console.debug("Loading article.lib.js",exports); String.prototype.cssBackgroundImageURL = function(){ // console.debug("Extracting url from background-image",this); if (this.indexOf("url(")===0){ return this.substring(4,this.length-1).replace(/["']/g, ""); } return null; }; String.prototype.isPhotoDetailURL = function() { var url = this; if (url.indexOf("#!")==0) { url = url.substring(2); } return ((url.indexOf("/photo.php?") == 0) || (url.indexOf("/photos/p.") > 0) || (url.indexOf("/photos/a.") > 0) || (url.indexOf("/photos/pb.") > 0) || (url.indexOf("/photos/pcb.") > 0) || (url.indexOf("/photos/ms.") > 0)|| (url.indexOf("/photos/t.") > 0)|| (url.indexOf("/photos/rpb.")" (Indicator: "facebook.com"), "var videoPlayButton = div.find("div._1o0y") return (videoPlayButton.size() > 0) || div.attr("aria-label") == "video" } _.isProbablyAProfileVideo = function(paramSet) { return paramSet.indexOf("vb.") == 0 } _.markAllAlbumsInDom = function(dom,callback){ $("a:not(.ow_scannedForAlbumPost):not(.touchable-notification .touchable)", dom).each(function() { try{ var a = $(this) a.addClass("ow_scannedForAlbumPost") var href = a.attr("href") if (href && href.isAlbumURL()) { var paramSet = _.getParameterByName("photoset_token", href) var paramId = _.getParameterByName("profileid", href) var paramFbid = _.getParameterByName("photo", href) var finalURL = "https://m.facebook.com/photo.php?fbid=" + paramFbid + "&id=" + paramId + "&set=" +param" (Indicator: "facebook.com") "Set; var thumb = a.find("i").first() if (_.isProbablyAVideo(thumb)) { finalURL = "https://m.facebook.com/photo.php?set=" + paramSet + "&v=" + paramFbid; if (_.isProbablyAProfileVideo(paramSet)) { finalURL = "https://www.facebook.com/plugins/video.php?show_text=0&width=500&href=https://m.facebook.com/watch/?v=" +paramFbid; } } if (a.text() !== "") { finalURL = "https://m.facebook.com/media/set/?set="+paramSet; } a.attr("ow_href", finalURL) a.addClass("ow_markedAsAlbumPost") a.changeElementType('div') } } catch (ex) { console.error("[Article markAllAlbumsInDom]", ex) } });" (Indicator: "facebook.com") "tring(0,idx-1): r; idx = r.indexOf("ref="); r = (idx>0) ? r.substring(0,idx-1): r; //console.debug("canonicalFor",url,r); return r; }; // Returns the current page canonical URL _.canonicalFBPageURL = function(){ try{ if (require(["MPageController"]) === undefined) { return document.location.toString(); } var pageURL = _.canonicalFBURL(require(["MPageController"]).getRenderedPath()); return pageURL; }catch(ex){ console.error("[Article canonicalFBPageURL]", ex) } }; _.desktopURLFormPathAndQuery = function(path, query) { if (path.indexOf("#!") == 0) { path = path.substring(2); } if (path.indexOf("https://m.facebook.com") >= 0) { path = path.replace('https://m.facebook.com', '') } if (path.st" (Indicator: "facebook.com") "artsWith("/story.php")){ // translate story.php links //var query = document.location.search; if (query.indexOf("?") == 0){ query = query.substring(1); } // split the arguments var dict = _.queryDictionary(query); // console.debug(dict); var id = dict["id"]; var story_fbid = dict["story_fbid"]; if (id && story_fbid) { return "https://www.facebook.com/"+id+"/posts/"+story_fbid; } } else if (path.startsWith("/messages/")){ if (query.indexOf("?") == 0){ query = query.substring(1); } var dict = _.queryDictionary(query); var id = dict["pageID"]; if (id) { return "https://www.facebook.com/"+id+"/messages/"; } }" (Indicator: "facebook.com") "return "https://www.facebook.com"+path+query; //document.location.pathname; }; _.backgroundImageURL = function(node) { var bgimage = node.css("background-image"); if (bgimage) { return bgimage.cssBackgroundImageURL(); } return null; }; _.findMediaImage = function(a) { // fb images are in i.img elements within css background-image attribute var imgDef = a.data("ow_imgDef"); // console.debug("already found img def : ",imgDef); if (imgDef) return imgDef; var i = $("div > i.img", a); if (i.size() === 0) { // let's try directly inside i = $("i.img:first-child", a); console.debug("could not find directly in div>i.img"); } if (i.size() > 0) { var inlineURL = _.backgroundImageURL(i); if (inlineURL) { // console.debug("inlineURL",inl" (Indicator: "facebook.com") "ineURL); var postURL = a.attr("href"); if (postURL.indexOf("https://")!=0) postURL = "https://m.facebook.com"+postURL; postURL = postURL.replace(/#!/,""); imgDef = { inlineURL: inlineURL, detailURL: postURL }; // console.debug("*** findMediaImage", imgDef); a.data("ow_imgDef", imgDef); a.data("ow_imgElem", i); } } else { console.debug("i.img not found"); } return imgDef; }; _.extractPhotoStoryInfos = function(node,url) { // console.debug("nodes : ", node); var messageNode = $("div.voice div.msg", node).clone(); var actor = $(".actor", messageNode).text(); var actorURL = $("a.actor-link", messageNode).attr("href"); $(".actor i #voice_replace" (Indicator: "facebook.com")27:T806,"r = function() { mediasAccumulator.accumulateMedias.apply(mediasAccumulator, arguments) } _._queryReportMediasExtractors.forEach(function(extractor){ extractor(accumulator) }) var generic = InspectorMediasAccumulator() var genericAccumulator = function(medias) { console.debug("[Inspector] accumulating generic medias", medias) generic.accumulateMedias(medias) } _.runGenericExtractor(genericAccumulator, container) var report = { fragment: fragment, url: document.location.toString(), desktopURL: document.location.toString(), title: document.title, medias: mediasAccumulator.medias.concat(generic.medias) } console.debug("[Inspect" (Indicator: "icext"), "stname + portSuffix + document.location.pathname + "/../" + src } } return src } _.runGenericExtractor = (function(accumulator, element) { var $ = ow_jQuery element.find("[fas_medias]").addBack("[fas_medias]").each(function(){ var elem = $(this) var medias = JSON.parse(elem.attr("fas_medias")) accumulator(medias) }) element.find("[data-owpost]").addBack("[data-owpost]").each(function(){ var elem = $(this) var data = JSON.parse(elem.attr("data-owpost")) function accumulate(data) { console.debug("[Inspector] IG post", data) try { var resources = data.displayResources var first = resources[0] var last" (Indicator: "icext")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"eb15c72b6530e67f80906fd21ba2ba887a41c3099681225e7e24f4c5694fa546","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1790323313647,"unified_at":"2026-09-25T08:01:53.647Z","metadata":{"hashes":{"sha256":"eb15c72b6530e67f80906fd21ba2ba887a41c3099681225e7e24f4c5694fa546","sha1":"6eff4aa15e403f80062e815feca72a00d2e7ad75","md5":"5137e4276229a78235db5c28a7ca47e5","sha512":"7c41ef53cbb6f4a98834cf1f04c4b05faad6d87ef061a871daa5fd7aa07025d66a5446660e20b0d8f0581461a80ddcfb8a807def15b327c1822d4c79cb81c343","ssdeep":"393216:XiQNqXzDccNi1t5k0Y/av7iYPUIFliFU3QAcwnP4igtK:XiY6Ddi1vLYcrtoGAuPDT","ssdeep_chunks":["393216:XiQNqXz","393216:iQNqXzD","393216:QNqXzDc","393216:NqXzDcc","393216:qXzDccN","393216:XzDccNi","393216:zDccNi1","393216:DccNi1t","393216:ccNi1t5","393216:cNi1t5k","393216:Ni1t5k0","393216:i1t5k0Y","393216:1t5k0Y/","393216:t5k0Y/a","393216:5k0Y/av","393216:k0Y/av7","393216:0Y/av7i","393216:Y/av7iY","393216:/av7iYP","393216:av7iYPU","393216:v7iYPUI","393216:7iYPUIF","393216:iYPUIFl","393216:YPUIFli","393216:PUIFliF","393216:UIFliFU","393216:IFliFU3","393216:FliFU3Q","393216:liFU3QA","393216:iFU3QAc","393216:FU3QAcw","393216:U3QAcwn","393216:3QAcwnP","393216:QAcwnP4","393216:AcwnP4i","393216:cwnP4ig","393216:wnP4igt","393216:nP4igtK","786432:XiQNqXz","786432:iQNqXzD","786432:QNqXzDc","786432:NqXzDcc","786432:qXzDccN","786432:XzDccNi","786432:zDccNi1","786432:DccNi1t","786432:ccNi1t5","786432:cNi1t5k","786432:Ni1t5k0","786432:i1t5k0Y","786432:1t5k0Y/","786432:t5k0Y/a","786432:5k0Y/av","786432:k0Y/av7","786432:0Y/av7i","786432:Y/av7iY","786432:/av7iYP","786432:av7iYPU","786432:v7iYPUI","786432:7iYPUIF","786432:iYPUIFl","786432:YPUIFli","786432:PUIFliF","786432:UIFliFU","786432:IFliFU3","786432:FliFU3Q","786432:liFU3QA","786432:iFU3QAc","786432:FU3QAcw","786432:U3QAcwn","786432:3QAcwnP","786432:QAcwnP4","786432:AcwnP4i","786432:cwnP4ig","786432:wnP4igt","786432:nP4igtK","393216:XiY6Ddi","393216:iY6Ddi1","393216:Y6Ddi1v","393216:6Ddi1vL","393216:Ddi1vLY","393216:di1vLYc","393216:i1vLYcr","393216:1vLYcrt","393216:vLYcrto","393216:LYcrtoG","393216:YcrtoGA","393216:crtoGAu","393216:rtoGAuP","393216:toGAuPD","393216:oGAuPDT"],"imphash":"Unknown"},"file_info":{"file_name":"Folio for Facebook & Messenger v3.9.6 build 946 arm v8 Premium Mod Apk {CracksHash}.apk","file_type":["android"],"file_type_id":"apk","file_size":14221665,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1636793467000,"last_seen":1663153040000,"last_multi_scan":1663153040000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":2},"sandbox_signatures":{"informative_count":3,"suspicious_count":2,"malicious_count":1,"total":6},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Broadcast Receivers","attack_id":"T1402","attack_id_wiki":"https://attack.mitre.org/techniques/T1402","identifiers":[{"type":"malicious","value":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"618f7c7a69325835005f96da"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"618f7c7a69325835005f96da"}]}],"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/59 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"618f7c7a69325835005f96da"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$25","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"618f7c7a69325835005f96da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$26","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"618f7c7a69325835005f96da"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$27","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"618f7c7a69325835005f96da"}]},{"level":"suspicious","category":"General","name":"Requires permissions that could be uesd for malicious intents","description":"Permission request for \"android.permission.CAMERA\"\n Permission request for \"android.permission.INTERNET\"\n Permission request for \"android.permission.REORDER_TASKS\"\n Permission request for \"android.permission.WRITE_EXTERNAL_STORAGE\"\n Permission request for \"android.permission.RECEIVE_BOOT_COMPLETED\"\n Permission request for \"android.permission.WAKE_LOCK\"\n Permission request for \"android.permission.ACCESS_FINE_LOCATION\"\n Permission request for \"android.permission.ACCESS_COARSE_LOCATION\"","origin":"Static Parser","relevance":10,"id":"static-27","sources":[{"report_type":"sandbox","report_id":"618f7c7a69325835005f96da"}]},{"level":"malicious","category":"Installation/Persistence","name":"Has the ability to execute code after reboot","description":"Permission request for \"android.permission.RECEIVE_BOOT_COMPLETED\"","origin":"Static Parser","mitre_attack_id":"T1402","relevance":10,"id":"static-28","sources":[{"report_type":"sandbox","report_id":"618f7c7a69325835005f96da"}]}]},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"618f7c7a69325835005f96da","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"suspicious","threat_score":35,"submit_name":"Folio for Facebook & Messenger v3.9.6 build 946 arm v8 Premium Mod Apk {CracksHash}.apk","analysis_start_time":"2021-11-13T08:51:13+00:00","indicators_count":{"informative":3,"suspicious":2,"malicious":1},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["618f7c7a69325835005f96da"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious Sample eb15c72b6530… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample eb15c72b6530…. Threat score 35/100. 0/27 AV engines flagged this file. 1 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/eb15c72b6530e67f80906fd21ba2ba887a41c3099681225e7e24f4c5694fa546"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample eb15c72b6530… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample eb15c72b6530…. Threat score 35/100. 0/27 AV engines flagged this file. 1 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/eb15c72b6530e67f80906fd21ba2ba887a41c3099681225e7e24f4c5694fa546"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample eb15c72b6530… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample eb15c72b6530…. Threat score 35/100. 0/27 AV engines flagged this file. 1 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]