7/26/24, 12:03 PM Static Analysis

 APP SCORES  FILE INFORMATION  APP INFORMATION

File NameTruCell.apk App Name TruCell

Size 23.66MB Package Name com.truecell.ui
MD5 d23b2c27edaa2f6b3f7a7c383e09b0c9 Main Activity
Security Score 56/100 SHA1 21a21607ee900faf8c8a29d32ab07e672cd44c1b com.truecell.ui.Splash_Screen_Form
Trackers Detection
SHA256 Target SDK 34 Min SDK 26 Max SDK
0/432
0848fc96fe0ad0ab3987337d22c8daa17f869e8f68d506f26b728fdaca Android Version Name 3.6.91
bb77f1 Android Version Code 123

318 5
ACTIVITIES SERVICES

View  View 

11 2
RECEIVERS PROVIDERS

View  View 

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 1/44
7/26/24, 12:03 PM Static Analysis

Exported Exported
 Activities  Services
0 1

Exported Exported
 Receivers  Providers
1 0

 SCAN OPTIONS

 DECOMPILED CODE

 SIGNER CERTIFICATE

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 2/44
7/26/24, 12:03 PM Static Analysis

Binary is signed
v1 signature: False
v2 signature: True
v3 signature: False
v4 signature: False
X.509 Subject: C=91, ST=karnataka, L=Bangalore, O=Craft Silicon Pvt Ltd, OU=India, CN=Siva kumar
Signature Algorithm: rsassa_pkcs1v15
Valid From: 2015-02-20 10:43:45+00:00
Valid To: 2114-01-27 10:43:45+00:00
Issuer: C=91, ST=karnataka, L=Bangalore, O=Craft Silicon Pvt Ltd, OU=India, CN=Siva kumar
Serial Number: 0x6f0cf331
Hash Algorithm: sha256
md5: c7d220c4d8ace14e659ea411d3fcb0a2
sha1: 1e54e384bd19b2732d208665ebc06a761c11fab2
sha256: ef76ebe83ed98e8590e1538170269366d470f4d0e6a59d2725e5a3c822a69ccc
sha512:
14ea70cffbafc5c9d8b5600110ce4ba9f58e5016dfd904e29c1807ebd74abdd1fcc67671ca312d2b43dbe5c468b47f7b293d41e098e29827b36a
41f2fa1af9bf
PublicKey Algorithm: rsa
Bit Size: 2048
Fingerprint: 6556fd50f0998107af224297ef8fd843ae6bb63dd4758f9b5b8f0f97d86a0ac4
Found 1 unique certificates

 APPLICATION PERMISSIONS

Search:

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 3/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ ▲ CODE
▼ ▼ ▼ ▼
PERMISSION STATUS INFO DESCRIPTION MAPP

android.permission.ACCESS_COARSE_LOCATION dangerous coarse (network-based) Access coarse location

location sources, such as the
mobile network
database, to determine
an approximate phone
location, where
available. Malicious
applications can use this
to determine
approximately where
you are.

android.permission.ACCESS_FINE_LOCATION dangerous fine (GPS) location Access fine location

sources, such as the
Global Positioning
System on the phone,
where available.
Malicious applications
can use this to
determine where you
are and may consume
additional battery
power.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 4/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ ▲ CODE
▼ ▼ ▼ ▼
PERMISSION STATUS INFO DESCRIPTION MAPP

android.permission.ACCESS_NETWORK_STATE normal view network status Allows an application to

view the status of all
networks.

android.permission.BLUETOOTH normal create Bluetooth Allows applications to

connections connect to paired
bluetooth devices.

android.permission.BLUETOOTH_ADMIN normal bluetooth Allows applications to

administration discover and pair
bluetooth devices.

android.permission.BLUETOOTH_CONNECT dangerous necessary for Required to be able to

connecting to paired connect to paired
Bluetooth devices. Bluetooth devices.

android.permission.BLUETOOTH_PRIVILEGED SignatureOrSystem allows privileged Allows applications to

Bluetooth operations pair bluetooth devices
without user interaction. without user interaction,
and to allow or disallow
phonebook access or
message access. This is
not available to third
party applications.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 5/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ ▲ CODE
▼ ▼ ▼ ▼
PERMISSION STATUS INFO DESCRIPTION MAPP

android.permission.BLUETOOTH_SCAN dangerous required for discovering Required to be able to

and pairing Bluetooth discover and pair nearby
devices. Bluetooth devices.

android.permission.CAMERA dangerous take pictures and videos Allows application to

take pictures and videos
with the camera. This
allows the application to
collect images that the
camera is seeing at any
time.

android.permission.FOREGROUND_SERVICE normal enables regular apps to Allows a regular

use application to use
Service.startForeground. Service.startForeground.

Showing 1 to 10 of 19 entries

Previous 1 2 Next

 ANDROID API

Search:

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 6/44
7/26/24, 12:03 PM Static Analysis

API ▲ FILES ▲
▼ ▼

Android Notifications

Base64 Decode

Base64 Encode

Certificate Handling

Content Provider

Crypto

Dynamic Class and Dexloading

Execute OS Command

Get Installed Applications

Get Running App Processes

Showing 1 to 10 of 29 entries

Previous 1 2 3 Next

 BROWSABLE ACTIVITIES

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 7/44
7/26/24, 12:03 PM Static Analysis

Search:

ACTIVITY ▲ INTENT ▲
▼ ▼

No data available in table

Showing 0 to 0 of 0 entries

Previous Next

 NETWORK SECURITY

Search:

NO ▲ SCOPE ▲ SEVERITY ▲ DESCRIPTION ▲

▼ ▼ ▼ ▼

No data available in table

Showing 0 to 0 of 0 entries

Previous Next

 CERTIFICATE ANALYSIS

HIGH WARNING INFO

0 0 1

Search:

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 8/44
7/26/24, 12:03 PM Static Analysis

TITLE ▲ SEVERITY ▲ DESCRIPTION ▲

▼ ▼ ▼

Signed Application info Application is signed with a code signing certificate

Showing 1 to 1 of 1 entries

Previous 1 Next

 MANIFEST ANALYSIS

HIGH WARNING INFO SUPPRESSED

0 3 0 0

Search:

NO ▲
▼ ISSUE ▲
▼ SEVERITY ▲
▼ DESCRIPTION ▲
▼ OPTIONS ▲
▼

1 App can be installed on a vulnerable Android version warning This application can be
Android 8.0, minSdk=26] installed on an older
version of android that
has multiple
vulnerabilities. Support
an Android version =>
10, API 29 to receive
reasonable security
updates.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 9/44
7/26/24, 12:03 PM Static Analysis

NO ▲
▼ ISSUE ▲
▼ SEVERITY ▲
▼ DESCRIPTION ▲
▼ OPTIONS ▲
▼

2 Service warning A Service is found to be

(androidx.work.impl.background.systemjob.SystemJobService) shared with other apps
is Protected by a permission, but the protection level of the on the device therefore
permission should be checked. leaving it accessible to
Permission: android.permission.BIND_JOB_SERVICE any other application
[android:exported=true] on the device. It is
protected by a
permission which is not
defined in the analysed
application. As a result,
the protection level of
the permission should
be checked where it is
defined. If it is set to
normal or dangerous, a
malicious application
can request and obtain
the permission and
interact with the
component. If it is set to
signature, only
applications signed
with the same
certificate can obtain
the permission.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 10/44
7/26/24, 12:03 PM Static Analysis

NO ▲
▼ ISSUE ▲
▼ SEVERITY ▲
▼ DESCRIPTION ▲
▼ OPTIONS ▲
▼

3 Broadcast Receiver warning A Broadcast Receiver is

(androidx.work.impl.diagnostics.DiagnosticsReceiver) is found to be shared with
Protected by a permission, but the protection level of the other apps on the
permission should be checked. device therefore leaving
Permission: android.permission.DUMP it accessible to any
[android:exported=true] other application on the
device. It is protected
by a permission which
is not defined in the
analysed application.
As a result, the
protection level of the
permission should be
checked where it is
defined. If it is set to
normal or dangerous, a
malicious application
can request and obtain
the permission and
interact with the
component. If it is set to
signature, only
applications signed
with the same
certificate can obtain
the permission.

Showing 1 to 3 of 3 entries
127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 11/44
7/26/24, 12:03 PM Static Analysis

Previous 1 Next

 CODE ANALYSIS

HIGH WARNING INFO SECURE SUPPRESSED

2 7 2 2 0

Search:

NO ▲
▼ ISSUE ▲
▼ SEVERITY ▲
▼ STANDARDS ▲
▼ FILES ▲
▼ OPTIONS ▲
▼

1 The App logs information. info CWE: CWE-532:

Sensitive information should Insertion of Sensitive
never be logged. Information into Log
File
OWASP MASVS:
MSTG-STORAGE-3

2 App uses SQLite Database warning CWE: CWE-89:

and execute raw SQL query. Improper
Untrusted user input in raw Neutralization of
SQL queries can cause SQL Special Elements used
Injection. Also sensitive in an SQL Command
information should be ('SQL Injection')
encrypted and written to the OWASP Top 10: M7:
database. Client Code Quality

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 12/44
7/26/24, 12:03 PM Static Analysis

NO ▲
▼ ISSUE ▲
▼ SEVERITY ▲
▼ STANDARDS ▲
▼ FILES ▲
▼ OPTIONS ▲
▼

3 The App uses an insecure warning CWE: CWE-330: Use of w4/a.java

Random Number Generator. Insufficiently Random w4/b.java
Values x4/a.java
OWASP Top 10: M5:
Insufficient
Cryptography
OWASP MASVS:
MSTG-CRYPTO-6

4 Files may contain hardcoded warning CWE: CWE-312: e4/a.java

sensitive information like Cleartext Storage of g1/a.java
usernames, passwords, keys Sensitive Information
etc. OWASP Top 10: M9:
Reverse Engineering
OWASP MASVS:
MSTG-STORAGE-14

5 This App may request root warning CWE: CWE-250: com/truecell/util/RootUtil.java

(Super User) privileges. Execution with t3/a.java
Unnecessary
Privileges
OWASP MASVS:
MSTG-RESILIENCE-1

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 13/44
7/26/24, 12:03 PM Static Analysis

NO ▲
▼ ISSUE ▲
▼ SEVERITY ▲
▼ STANDARDS ▲
▼ FILES ▲
▼ OPTIONS ▲
▼

6 App creates temp file. warning CWE: CWE-276:

Sensitive information should Incorrect Default
never be written into a temp Permissions
file. OWASP Top 10: M2:
Insecure Data Storage
OWASP MASVS:
MSTG-STORAGE-2

7 IP Address disclosure warning CWE: CWE-200:

Information Exposure
OWASP MASVS:
MSTG-CODE-2

8 This App uses SSL certificate secure

pinning to detect or prevent OWASP MASVS:
MITM attacks in secure MSTG-NETWORK-4
communication channel.

9 App can read/write to warning CWE: CWE-276:

External Storage. Any App Incorrect Default
can read data written to Permissions
External Storage. OWASP Top 10: M2:
Insecure Data Storage
OWASP MASVS:
MSTG-STORAGE-2

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 14/44
7/26/24, 12:03 PM Static Analysis

NO ▲
▼ ISSUE ▲
▼ SEVERITY ▲
▼ STANDARDS ▲
▼ FILES ▲
▼ OPTIONS ▲
▼

10 This App uses SQL Cipher. info com/truecell/util/TrucellApplication.java

SQLCipher provides 256-bit OWASP MASVS:
AES encryption to sqlite MSTG-CRYPTO-1
database files.

Showing 1 to 10 of 13 entries

Previous 1 2 Next

 SHARED LIBRARY BINARY ANALYSIS

Search:

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 15/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ STACK ▲ ▲ ▲ ▲ ▲
▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
NO SHARED OBJECT NX CANARY RELRO RPATH RUNPATH FORTIFY

1 arm64-v8a/libnative- True True Full RELRO None None True

lib.so info info info info info info

The binary This binary This shared The The binary The binary has the
has NX bit has a stack object has binary does not following fortified
set. This canary full RELRO does not have functions:
marks a value enabled. have RUNPATH ['__memmove_chk',
memory added to RELRO run-time set. '__strlen_chk',
page non- the stack ensures search '__vsnprintf_chk']
executable so that it that the path or
making will be GOT RPATH
attacker overwritten cannot be set.
injected by a stack overwritten
shellcode buffer that in
non- overflows vulnerable
executable. the return ELF
address. binaries. In
This allows Full RELRO,
detection the entire
of GOT (.got
overflows and .got.plt
by verifying both) is
the marked as
integrity of read-only.
the canary
before
function
return.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 16/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ STACK ▲ ▲ ▲ ▲ ▲
▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
NO SHARED OBJECT NX CANARY RELRO RPATH RUNPATH FORTIFY

2 arm64- True True Full RELRO None None False

v8a/libsqlcipher.so info info info info info warning
The binary This binary This shared The The binary The binary does not
has NX bit has a stack object has binary does not have any fortified
set. This canary full RELRO does not have functions. Fortified
marks a value enabled. have RUNPATH functions provides
memory added to RELRO run-time set. buffer overflow checks
page non- the stack ensures search against glibc's
executable so that it that the path or commons insecure
making will be GOT RPATH functions like strcpy,
attacker overwritten cannot be set. gets etc. Use the
injected by a stack overwritten compiler option -
shellcode buffer that in D_FORTIFY_SOURCE=2
non- overflows vulnerable to fortify functions.
executable. the return ELF This check is not
address. binaries. In applicable for
This allows Full RELRO, Dart/Flutter libraries.
detection the entire
of GOT (.got
overflows and .got.plt
by verifying both) is
the marked as
integrity of read-only.
the canary
before
function
return.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 17/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ STACK ▲ ▲ ▲ ▲ ▲
▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
NO SHARED OBJECT NX CANARY RELRO RPATH RUNPATH FORTIFY

3 arm64- True True Full RELRO None None False

v8a/libtoolChecker.so info info info info info warning
The binary This binary This shared The The binary The binary does not
has NX bit has a stack object has binary does not have any fortified
set. This canary full RELRO does not have functions. Fortified
marks a value enabled. have RUNPATH functions provides
memory added to RELRO run-time set. buffer overflow checks
page non- the stack ensures search against glibc's
executable so that it that the path or commons insecure
making will be GOT RPATH functions like strcpy,
attacker overwritten cannot be set. gets etc. Use the
injected by a stack overwritten compiler option -
shellcode buffer that in D_FORTIFY_SOURCE=2
non- overflows vulnerable to fortify functions.
executable. the return ELF This check is not
address. binaries. In applicable for
This allows Full RELRO, Dart/Flutter libraries.
detection the entire
of GOT (.got
overflows and .got.plt
by verifying both) is
the marked as
integrity of read-only.
the canary
before
function
return.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 18/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ STACK ▲ ▲ ▲ ▲ ▲
▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
NO SHARED OBJECT NX CANARY RELRO RPATH RUNPATH FORTIFY

4 armeabi- True True Full RELRO None None True

v7a/libnative-lib.so info info info info info info
The binary This binary This shared The The binary The binary has the
has NX bit has a stack object has binary does not following fortified
set. This canary full RELRO does not have functions:
marks a value enabled. have RUNPATH ['__strlen_chk',
memory added to RELRO run-time set. '__vsnprintf_chk']
page non- the stack ensures search
executable so that it that the path or
making will be GOT RPATH
attacker overwritten cannot be set.
injected by a stack overwritten
shellcode buffer that in
non- overflows vulnerable
executable. the return ELF
address. binaries. In
This allows Full RELRO,
detection the entire
of GOT (.got
overflows and .got.plt
by verifying both) is
the marked as
integrity of read-only.
the canary
before
function
return.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 19/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ STACK ▲ ▲ ▲ ▲ ▲
▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
NO SHARED OBJECT NX CANARY RELRO RPATH RUNPATH FORTIFY

5 armeabi- True True Full RELRO None None False

v7a/libsqlcipher.so info info info info info warning
The binary This binary This shared The The binary The binary does not
has NX bit has a stack object has binary does not have any fortified
set. This canary full RELRO does not have functions. Fortified
marks a value enabled. have RUNPATH functions provides
memory added to RELRO run-time set. buffer overflow checks
page non- the stack ensures search against glibc's
executable so that it that the path or commons insecure
making will be GOT RPATH functions like strcpy,
attacker overwritten cannot be set. gets etc. Use the
injected by a stack overwritten compiler option -
shellcode buffer that in D_FORTIFY_SOURCE=2
non- overflows vulnerable to fortify functions.
executable. the return ELF This check is not
address. binaries. In applicable for
This allows Full RELRO, Dart/Flutter libraries.
detection the entire
of GOT (.got
overflows and .got.plt
by verifying both) is
the marked as
integrity of read-only.
the canary
before
function
return.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 20/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ STACK ▲ ▲ ▲ ▲ ▲
▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
NO SHARED OBJECT NX CANARY RELRO RPATH RUNPATH FORTIFY

6 armeabi- True True Full RELRO None None False

v7a/libtoolChecker.so info info info info info warning
The binary This binary This shared The The binary The binary does not
has NX bit has a stack object has binary does not have any fortified
set. This canary full RELRO does not have functions. Fortified
marks a value enabled. have RUNPATH functions provides
memory added to RELRO run-time set. buffer overflow checks
page non- the stack ensures search against glibc's
executable so that it that the path or commons insecure
making will be GOT RPATH functions like strcpy,
attacker overwritten cannot be set. gets etc. Use the
injected by a stack overwritten compiler option -
shellcode buffer that in D_FORTIFY_SOURCE=2
non- overflows vulnerable to fortify functions.
executable. the return ELF This check is not
address. binaries. In applicable for
This allows Full RELRO, Dart/Flutter libraries.
detection the entire
of GOT (.got
overflows and .got.plt
by verifying both) is
the marked as
integrity of read-only.
the canary
before
function
return.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 21/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ STACK ▲ ▲ ▲ ▲ ▲
▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
NO SHARED OBJECT NX CANARY RELRO RPATH RUNPATH FORTIFY

7 x86/libnative-lib.so True True Full RELRO None None True

info info info info info info
The binary This binary This shared The The binary The binary has the
has NX bit has a stack object has binary does not following fortified
set. This canary full RELRO does not have functions:
marks a value enabled. have RUNPATH ['__memmove_chk',
memory added to RELRO run-time set. '__strlen_chk',
page non- the stack ensures search '__vsnprintf_chk']
executable so that it that the path or
making will be GOT RPATH
attacker overwritten cannot be set.
injected by a stack overwritten
shellcode buffer that in
non- overflows vulnerable
executable. the return ELF
address. binaries. In
This allows Full RELRO,
detection the entire
of GOT (.got
overflows and .got.plt
by verifying both) is
the marked as
integrity of read-only.
the canary
before
function
return.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 22/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ STACK ▲ ▲ ▲ ▲ ▲
▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
NO SHARED OBJECT NX CANARY RELRO RPATH RUNPATH FORTIFY

8 x86/libsqlcipher.so True True Full RELRO None None False

info info info info info warning
The binary This binary This shared The The binary The binary does not
has NX bit has a stack object has binary does not have any fortified
set. This canary full RELRO does not have functions. Fortified
marks a value enabled. have RUNPATH functions provides
memory added to RELRO run-time set. buffer overflow checks
page non- the stack ensures search against glibc's
executable so that it that the path or commons insecure
making will be GOT RPATH functions like strcpy,
attacker overwritten cannot be set. gets etc. Use the
injected by a stack overwritten compiler option -
shellcode buffer that in D_FORTIFY_SOURCE=2
non- overflows vulnerable to fortify functions.
executable. the return ELF This check is not
address. binaries. In applicable for
This allows Full RELRO, Dart/Flutter libraries.
detection the entire
of GOT (.got
overflows and .got.plt
by verifying both) is
the marked as
integrity of read-only.
the canary
before
function
return.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 23/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ STACK ▲ ▲ ▲ ▲ ▲
▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
NO SHARED OBJECT NX CANARY RELRO RPATH RUNPATH FORTIFY

9 x86/libtoolChecker.so True True Full RELRO None None False

info info info info info warning
The binary This binary This shared The The binary The binary does not
has NX bit has a stack object has binary does not have any fortified
set. This canary full RELRO does not have functions. Fortified
marks a value enabled. have RUNPATH functions provides
memory added to RELRO run-time set. buffer overflow checks
page non- the stack ensures search against glibc's
executable so that it that the path or commons insecure
making will be GOT RPATH functions like strcpy,
attacker overwritten cannot be set. gets etc. Use the
injected by a stack overwritten compiler option -
shellcode buffer that in D_FORTIFY_SOURCE=2
non- overflows vulnerable to fortify functions.
executable. the return ELF This check is not
address. binaries. In applicable for
This allows Full RELRO, Dart/Flutter libraries.
detection the entire
of GOT (.got
overflows and .got.plt
by verifying both) is
the marked as
integrity of read-only.
the canary
before
function
return.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 24/44
7/26/24, 12:03 PM Static Analysis

▲ ▲ ▲ STACK ▲ ▲ ▲ ▲ ▲
▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
NO SHARED OBJECT NX CANARY RELRO RPATH RUNPATH FORTIFY

10 x86_64/libnative- True True Full RELRO None None True

lib.so info info info info info info
The binary This binary This shared The The binary The binary has the
has NX bit has a stack object has binary does not following fortified
set. This canary full RELRO does not have functions:
marks a value enabled. have RUNPATH ['__memmove_chk',
memory added to RELRO run-time set. '__strlen_chk',
page non- the stack ensures search '__vsnprintf_chk']
executable so that it that the path or
making will be GOT RPATH
attacker overwritten cannot be set.
injected by a stack overwritten
shellcode buffer that in
non- overflows vulnerable
executable. the return ELF
address. binaries. In
This allows Full RELRO,
detection the entire
of GOT (.got
overflows and .got.plt
by verifying both) is
the marked as
integrity of read-only.
the canary
before
function
return.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 25/44
7/26/24, 12:03 PM Static Analysis

Showing 1 to 10 of 24 entries

Previous 1 2 3 Next

 NIAP ANALYSIS v1.3

Search:

NO ▲ IDENTIFIER ▲ REQUIREMENT ▲ FEATURE ▲ DESCRIPTION ▲

▼ ▼ ▼ ▼ ▼

No data available in table

Showing 0 to 0 of 0 entries

Previous Next

 FILE ANALYSIS

Search:

NO ▲ ISSUE ▲ FILES ▲
▼ ▼ ▼

1 Certificate/Key files hardcoded inside the app. assets/public-may2012.p12

assets/uidai_auth_prod.cer
assets/uidai_auth_stage.cer

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 26/44
7/26/24, 12:03 PM Static Analysis

Showing 1 to 1 of 1 entries

Previous 1 Next

 APKiD ANALYSIS

Search:

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 27/44
7/26/24, 12:03 PM Static Analysis

DEX ▲ DETECTIONS ▲
▼ ▼

classes.dex Search:

FINDINGS ▲ DETAILS ▲
▼ ▼

Anti Debug Code Debug.isDebuggerConnected() check

Anti-VM Code Build.FINGERPRINT check

Build.MODEL check
Build.MANUFACTURER check
Build.PRODUCT check
Build.HARDWARE check
Build.BOARD check
possible Build.SERIAL check
Build.TAGS check
network operator name check
possible ro.secure check
emulator file check

Compiler r8 without marker (suspicious)

Showing 1 to 3 of 3 entries

Previous 1 Next

Showing 1 to 1 of 1 entries

Previous 1 Next

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 28/44
7/26/24, 12:03 PM Static Analysis

 QUARK ANALYSIS

Search:

POTENTIAL MALICIOUS BEHAVIOUR ▲ EVIDENCE ▲

▼ ▼

No data available in table

Showing 0 to 0 of 0 entries

Previous Next

 ABUSED PERMISSIONS

Top Malware Permissions 9/24 Other Common Permissions

android.permission.INTERNET, android.permission.BLUETOOTH_ADMIN,
android.permission.ACCESS_NETWORK_STATE, android.permission.BLUETOOTH,
android.permission.ACCESS_COARSE_LOCATION, com.google.android.c2dm.permission.RECEIVE,
android.permission.ACCESS_FINE_LOCATION, android.permission.FOREGROUND_SERVICE
android.permission.READ_PHONE_STATE,
android.permission.WAKE_LOCK, android.permission.CAMERA,
android.permission.VIBRATE,
android.permission.RECEIVE_BOOT_COMPLETED

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 29/44
7/26/24, 12:03 PM Static Analysis

Malware Permissions are the top permissions that are widely abused by known malware.
Other Common Permissions are permissions that are commonly abused by known malware.

 SERVER LOCATIONS

This app may communicate with the following OFAC sanctioned list of countries.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 30/44
7/26/24, 12:03 PM Static Analysis

Search:

DOMAIN ▲ COUNTRY/REGION ▲
▼ ▼

No data available in table

Showing 0 to 0 of 0 entries

Previous Next

 DOMAIN MALWARE CHECK

Search:

DOMAIN ▲ STATUS ▲ GEOLOCATION ▲

▼ ▼ ▼

103.241.181.108 ok IP: 103.241.181.108

Country: India
Region: Telangana
City: Hyderabad
Latitude: 17.375280
Longitude: 78.474442
View: Google Map

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 31/44
7/26/24, 12:03 PM Static Analysis

DOMAIN ▲ STATUS ▲ GEOLOCATION ▲

▼ ▼ ▼

maps.google.com ok IP: 142.250.183.206

Country: United States of America
Region: California
City: Mountain View
Latitude: 37.405991
Longitude: -122.078514
View: Google Map

mbsreg.brnetsaas.com ok IP: 206.1.34.45

Country: United States of America
Region: District of Columbia
City: Washington
Latitude: 38.901566
Longitude: -77.050781
View: Google Map

mbsreg1.brnetsaas.com ok IP: 66.198.169.149

Country: Singapore
Region: Singapore
City: Singapore
Latitude: 1.289670
Longitude: 103.850067
View: Google Map

ns.adobe.com ok No Geolocation information available.

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 32/44
7/26/24, 12:03 PM Static Analysis

DOMAIN ▲ STATUS ▲ GEOLOCATION ▲

▼ ▼ ▼

plus.google.com ok IP: 172.217.160.174

Country: United States of America
Region: California
City: Mountain View
Latitude: 37.405991
Longitude: -122.078514
View: Google Map

www.esafbank.com ok IP: 65.1.188.54

Country: India
Region: Maharashtra
City: Mumbai
Latitude: 19.014410
Longitude: 72.847939
View: Google Map

www.openssl.org ok IP: 34.36.58.177

Country: United States of America
Region: Texas
City: Houston
Latitude: 29.941401
Longitude: -95.344498
View: Google Map

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 33/44
7/26/24, 12:03 PM Static Analysis

DOMAIN ▲ STATUS ▲ GEOLOCATION ▲

▼ ▼ ▼

www.suryodaybank.com ok IP: 64.185.181.238

Country: United States of America
Region: California
City: Burlingame
Latitude: 37.567020
Longitude: -122.365677
View: Google Map

www.uidai.gov.in ok IP: 103.57.226.101

Country: India
Region: Karnataka
City: Bengaluru
Latitude: 12.976230
Longitude: 77.603287
View: Google Map

Showing 1 to 10 of 11 entries

Previous 1 2 Next

 URLS

Search:

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 34/44
7/26/24, 12:03 PM Static Analysis

URL ▲ FILE ▲
▼ ▼

data:: com/truecell/ui/About_Form.java

data:: com/truecell/ui/DR_Reports_Details_Level1_Form.java

data:: com/truecell/ui/DR_Reports_Details_Level2_Form.java

data:: com/truecell/ui/Report_Branchlist_Form.java

data:: com/truecell/ui/Report_Officerlist_Form.java

data:: com/truecell/ui/Tracking_Option_Form.java

data::: com/truecell/ui/Attendance_Projection_Form.java

data::: com/truecell/ui/Center_Transaction_Form.java

data::: com/truecell/ui/Loan_Collection_Projection_Form.java

data::: com/truecell/util/AutoDataSync.java

Showing 1 to 10 of 39 entries

Previous 1 2 3 4 Next

 FIREBASE DATABASE

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 35/44
7/26/24, 12:03 PM Static Analysis

 EMAILS

Search:

EMAIL ▲ FILE ▲
▼ ▼

[email protected] w1/r.java
[email protected]

Showing 1 to 1 of 1 entries

Previous 1 Next

 TRACKERS

Search:

TRACKER NAME ▲ CATEGORIES ▲ URL ▲

▼ ▼ ▼

No data available in table

Showing 0 to 0 of 0 entries

Previous Next

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 36/44
7/26/24, 12:03 PM Static Analysis

 POSSIBLE HARDCODED SECRETS

Showing all 17 secrets

"eng_resetpassword" : "ಗುಪ್ತ ಪದ"
"eng_username" : "UserName"
"eng_resetpassword" : "पासवर्ड"
"eng_Password" : "ಪಾಸ್ವ ರ್ಡ್"
"eng_Authentication" : "ಅಧಿಕೃತಗೊಳಿಸುವುದು"
"eng_Authentication" : "प्रमाणीकरण"
"eng_Authentication" : "Authentication"
"eng_password" : "Password"
"google_maps_key" : "AIzaSyDgHROepVNz_E3wO91aEMSYxnVKwnLgBhg"
"eng_Password" : "पासवर्ड"
"eng_Password" : "Password"
"eng_resetpassword" : "Password"
706b889da35c4992b71f439d3d70f19a
49f946663a8deb7054212b8adda248c6
AIzaSyDgXNuI5xwtTIwLCcYDRHskDFy5ZPAkcXM
89504E470D0A1A0A0000000D49484452000000240000002408020000006E620FCF0000000373424954050605330B8D80000005AB4944415448
89BD973F681B591EC7BF1B5EE027D0C133B818C116799062674971635244E2B658C16EA1C0C2DADCC1D95C11442A7395778B8B538521D59
44EB5F116BBC8CDE22D16ECE638A550D0140A3307393C01072B85610409E88105F3033F78578C2CC992ECD8DCB13FC48FE1CD9BF779BF3
FEFF77BFAC45A8BDF4BC435E7738FE33E77BB838800000BC51209592A2E91299170FE2F301D1EEFA63AECEA08458681EB54178A1555F4489
408F28A2B7D640A9B5EFCA1D17ED78061069474DDC59AE7AC20074C8AF938EF938B63C6CDE367C987861EA4241600AA3875CF592392DD77
DDB0151E1C1EB046F236AEDCAD6426BBFF55B5FC4515E252AA9D27FDD3A3E7712DE8B89B4D15846E235ECEB2236B6D1446E57B55220240
822040428E9E1D476DFE63333BC9E6AE69AD9D63596F1037DED40166EE030525ABAB77B6B4E695E595E68B260962C3671A6C30F50CA0F9A
25DFE93F771CBD22C0A422F08BD205441C7DD3BDCB0D6469D88882030B609133681CE46C67A776777D6B273B0ECF428E8787EA8365B4E1
0BABBC9FA98846124CE518920208B92882647F2E7C64F8DCB608DD7AB41E8FA2D2708DDE771CDDA2C3BE97B773D08CCEE3DD792E4B4C5
34D651184DAE3FCE9BB8B79D0EE27ED65F282CB0E1FBB71F03E43FF5E357F1F9380DB55C949FBB9F6759561085E6CB8958F258AFFC75E5E
8F0689C9C2317365E2F072D3708DDA0A5760FEBD6DAAC9F911865DD384EE5BBE5A813596BEDE9D9D727D67FE293A0FC37697DF03498766
39436FCD00D42D76F29BFA50EDEEF596BD7FFBE2EA504818AE348AC3F5CBF28B3DBCDF69874B63FF7B63B7C7D7A96FA3BFF59EB7392FB0

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 37/44
7/26/24, 12:03 PM Static Analysis

15858BFFB2F003060C344C40C02D8300CE238A69BC4A74C05E28CE90F677E031368FBC7EDED9FB78723673E8FC2C8BBE7C14000D0A69B99
1E1B0648B3AE7EBA3674F1C87B04000402A3F64D6D141B08CCC6728A4482F6F7F7BD7B1E1BBE0100AC35A74492A1A52029D505D50630D00
39DEB7C5D292409728A0E3313E690D870FB653BF7AD0090E83604E9414F16A5662651BA1046A37A419AF5581B3D3763739DBE4F010C2D23
011826926C20852CCC56F409B968C54B74F226018304DD00D0374C20364C00B3A64B3BC57549B9CEBB810050A2520C96F93BA2BE4925DC3
C42300090675A3EB2F1FD46411400D04D1A56003009E28C87BBB9497CCA003293154401378727010202000907823473EE7D3DE8A188F865B
CF4C5D2E4EEA494DDC3AEFFD4BFCCF02939DFDB6E00507209204904C352C8741001908E9CF286D67AFB87ED8FAEAF7BFAFED7F7593330D
D456F0000A45B5CCA3DAB99D341CCA6A76EA9D2ADD214EFBB47DFF5DEF52E87D5BEADB5C37649959257C9D4AB1C06B5589579361269EE
E6C6F98FFCD9687B65EF221E6BAE942BDD37DDBCD62C9597767ED839376354D9B63A553F549B4DC70FD556A76CADCD4E32754B6154553
1AEB0AB7F5E6DB7DAA36FA338AA3FA8635E0F5AFD7675541BC7B0A3FE9EDF5241A8365B8E1FAA83F7BBD6DABDDFF626EA3D4D74E7AB6A
FF893FBF79EE26F5CDA61384CA6F395B9D72FFF4C85A5B7FB09E9FBC6B31725D7F509F5CFFFCB5204B9FBFAE052D15846ED071770FEBD66
6D6DAFADFEA93BD43922441435D9444E44807188E8F6656BFACDAF317AD990BCF49B41597375B2A88DD20548D64B59F1D596BEB0FEB73F
64E44828632D9C98836BEDF986D7873EE8DE9C9C1F3B8B6F5DADD8A5DBFA51AC97266D33C7EEE6D779237DB9701D4BEAA0DFBF88CCCBF
11B3E9ED1F3FEEEA66DE3524A9CAA7EBEEE23280E63F9B3BBFECB45FB493B7C9E4A9F0FEE855BFACAEFD65CDBB37EFC608E0F2EB7777B
0DF3C7E06EE6B66004A566B9F3D268CFFAA24FF4E78C0EE1D97245D04B8226C880C8F9F1D7C68F60609098281EBD4DCC59A9215E04A806B
C186C8AE6EC7BD5F538EF26E4920252BA5A2AB162B302469810DE7A7F0924D5C1176C6343DCD693A48D8F4D34142020C2A912210154B0B
A2E4142F0CD8B561FFA3FC17F26EDC58405B2F180000000049454E44AE426082
c103703e120ae8cc73c9248622f3cd1e

 STRINGS

From APK Resource

Show all 8507 strings

From Code

Show all 10901 strings

From Shared Objects

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 38/44
7/26/24, 12:03 PM Static Analysis

apktool_out/lib/arm64-v8a/libnative-lib.so

Show all 331 strings

apktool_out/lib/arm64-v8a/libsqlcipher.so

Show all 5929 strings

apktool_out/lib/arm64-v8a/libtoolChecker.so

Showing all 3 strings

LOOKING FOR BINARY: %s Absent :(
LOOKING FOR BINARY: %s PRESENT!!!
RootBeer

apktool_out/lib/armeabi-v7a/libnative-lib.so

Show all 333 strings

apktool_out/lib/armeabi-v7a/libsqlcipher.so

Show all 5401 strings

apktool_out/lib/armeabi-v7a/libtoolChecker.so

Showing all 3 strings

LOOKING FOR BINARY: %s Absent :(
LOOKING FOR BINARY: %s PRESENT!!!
RootBeer

apktool_out/lib/x86/libnative-lib.so

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 39/44
7/26/24, 12:03 PM Static Analysis

Show all 311 strings

apktool_out/lib/x86/libsqlcipher.so

Show all 5735 strings

apktool_out/lib/x86/libtoolChecker.so

Showing all 3 strings

LOOKING FOR BINARY: %s Absent :(
LOOKING FOR BINARY: %s PRESENT!!!
RootBeer

apktool_out/lib/x86_64/libnative-lib.so

Show all 316 strings

apktool_out/lib/x86_64/libsqlcipher.so

Show all 5738 strings

apktool_out/lib/x86_64/libtoolChecker.so

Showing all 3 strings

LOOKING FOR BINARY: %s Absent :(
LOOKING FOR BINARY: %s PRESENT!!!
RootBeer

lib/arm64-v8a/libnative-lib.so

Show all 331 strings

lib/arm64-v8a/libsqlcipher.so
127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 40/44
7/26/24, 12:03 PM Static Analysis

Show all 5929 strings

lib/arm64-v8a/libtoolChecker.so

Showing all 3 strings

LOOKING FOR BINARY: %s Absent :(
LOOKING FOR BINARY: %s PRESENT!!!
RootBeer

lib/armeabi-v7a/libnative-lib.so

Show all 333 strings

lib/armeabi-v7a/libsqlcipher.so

Show all 5401 strings

lib/armeabi-v7a/libtoolChecker.so

Showing all 3 strings

LOOKING FOR BINARY: %s Absent :(
LOOKING FOR BINARY: %s PRESENT!!!
RootBeer

lib/x86/libnative-lib.so

Show all 311 strings

lib/x86/libsqlcipher.so

Show all 5735 strings

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 41/44
7/26/24, 12:03 PM Static Analysis

lib/x86/libtoolChecker.so

Showing all 3 strings

LOOKING FOR BINARY: %s Absent :(
LOOKING FOR BINARY: %s PRESENT!!!
RootBeer

lib/x86_64/libnative-lib.so

Show all 316 strings

lib/x86_64/libsqlcipher.so

Show all 5738 strings

lib/x86_64/libtoolChecker.so

Showing all 3 strings

LOOKING FOR BINARY: %s Absent :(
LOOKING FOR BINARY: %s PRESENT!!!
RootBeer

 ACTIVITIES

Show all 318 activities

 SERVICES

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 42/44
7/26/24, 12:03 PM Static Analysis

Showing all 5 services

com.trucell.gcm.GCMNotificationIntentService
androidx.work.impl.background.systemalarm.SystemAlarmService
androidx.work.impl.background.systemjob.SystemJobService
androidx.work.impl.foreground.SystemForegroundService
androidx.room.MultiInstanceInvalidationService

 RECEIVERS

Showing all 11 receivers

com.truecell.util.AutoDataSync
com.truecell.util.NetworkConnectivityReceiver
com.trucell.gcm.GcmBroadcastReceiver
androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
androidx.work.impl.background.systemalarm.RescheduleReceiver
androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
androidx.work.impl.diagnostics.DiagnosticsReceiver

 PROVIDERS

Showing all 2 providers

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 43/44
7/26/24, 12:03 PM Static Analysis

androidx.core.content.FileProvider
androidx.startup.InitializationProvider

 LIBRARIES

Showing all 1 libraries

org.apache.http.legacy

 FILES

Show all 2546 files

© 2024 Mobile Security Framework - MobSF | Ajin Abraham | OpenSecurity. Version v3.9.7 Beta

127.0.0.1:8000/static_analyzer/d23b2c27edaa2f6b3f7a7c383e09b0c9/ 44/44