INFLOR Silviculture 2.3.15版本 | 静态分析 _南明离火移动安全分析平台

声明：本平台专为移动应用安全风险研究与合规评估设计，严禁用于任何非法用途。如有疑问或建议，欢迎加入微信群交流。

应用图标

应用评分

文件基本信息

文件名称

ea1b09621beff9a464f16b59580d2668ad95a361d20ee6485583c9c5e11c9f44.apk

文件大小

3.45MB

MD5

0e9a3a324e09b397ebd66bafcad6fb33

SHA1

50def0639959b13187b32fd4791f5506b22a2abe

SHA256

ea1b09621beff9a464f16b59580d2668ad95a361d20ee6485583c9c5e11c9f44

病毒检测

文件安全

应用基础信息

应用名称

INFLOR Silviculture

包名

com.inflor.appsilvicultura

主活动

com.inflor.appsilvicultura.controller.view.SplashScreenActivity

目标SDK

29

最小SDK

19

版本号

2.3.15

子版本号

125

加固信息

未加壳

Google Play 应用市场信息

标题 INFLOR Silvicultura
评分 3.7692308
安装 1,000+ 次下载
价格 0
Android版本支持
分类办公
Play 商店链接 com.inflor.appsilvicultura
开发者 INFLOR
开发者 ID INFLOR
开发者地址 None
开发者主页 http://www.inflor.com.br
开发者 Email mobile@inflor.com.br
发布日期 None
隐私政策 Privacy link

关于此应用

集热器应用笔记林业数据。
 - 任命设备和人力与播放/暂停的;
 - 约会区域和投入;
 - 下载服务订单;
 - 注意同步;
 - 通过蓝牙传输的笔记和工作单。

组件导出状态统计

查看 Activity 组件

查看 Service 组件

查看 Receiver 组件

查看 Provider 组件

扫描与分析选项

重新扫描管理规则动态分析

反编译与源码导出

Manifest文件查看

APK文件成为会员，解锁下载

Java源代码查看 -- 下载

文件结构与资源列表

应用签名证书信息

二进制文件已签名
v1 签名: True
v2 签名: True
v3 签名: False
v4 签名: False
主题: C=BR, ST=ES, L=Vitoria, O=INFLOR, OU=Projetos, CN=INFLOR
签名算法: rsassa_pkcs1v15
有效期自: 2015-05-05 20:34:19+00:00
有效期至: 2040-04-28 20:34:19+00:00
发行人: C=BR, ST=ES, L=Vitoria, O=INFLOR, OU=Projetos, CN=INFLOR
序列号: 0x251606dc
哈希算法: sha256
证书MD5: 3e8d93bc3681cecfa6468399a46a76c3
证书SHA1: 40cdf8c6c6a350e96333e4479542535eb51caf4a
证书SHA256: cffd7f62eda804ad1b3405785af5de7dd29ed20e3144134be22b2ebeb4feb4e2
证书SHA512: 328b4e73c0b091483fcd805b3be605cb91a1c5fa1efd039eeb27f7afb424faff2c7cbf5ed61f960fba2a70b626c0fdd3d453179ce7d1cadb0099a6d725c56046
公钥算法: rsa
密钥长度: 2048
指纹: 5bb013dfae0cf5e86e5c2ad98dc17a4f85f8913e2cc27ce480286b2fc03bdc94
找到 1 个唯一证书

权限声明与风险分级

权限名称	安全等级	权限内容	权限描述	关联代码
android.permission.ACCESS_NETWORK_STATE	普通	获取网络状态	允许应用程序查看所有网络的状态。	显示文件 com/inflor/appsilvicultura/controller/Settings.java com/inflor/appsilvicultura/controller/view/SelecaoOSActivity.java com/inflor/appsilvicultura/utils/Permission.java
android.permission.READ_PHONE_STATE	危险	读取手机状态和标识	允许应用程序访问设备的手机功能。有此权限的应用程序可确定此手机的号码和序列号，是否正在通话，以及对方的号码等。	显示文件 com/inflor/appsilvicultura/controller/view/SelecaoOSActivity.java com/inflor/appsilvicultura/utils/Permission.java
android.permission.INTERNET	危险	完全互联网访问	允许应用程序创建网络套接字。	显示文件 com/inflor/appsilvicultura/hubmobile/controller/view/MenuSelectedItem.java com/inflor/appsilvicultura/utils/Communication.java org/ksoap2/transport/HttpTransportSE.java org/ksoap2/transport/HttpsServiceConnectionSE.java org/ksoap2/transport/ServiceConnectionSE.java
android.permission.BLUETOOTH	危险	创建蓝牙连接	允许应用程序查看或创建蓝牙连接。	显示文件 com/inflor/appsilvicultura/controller/Settings.java com/inflor/appsilvicultura/controller/view/SelecaoOSActivity.java com/inflor/appsilvicultura/controller/view/SettingsActivity.java com/inflor/appsilvicultura/controller/view/UpdateApkActivity.java com/inflor/appsilvicultura/controller/view/UploadBoletinsActivity.java com/inflor/appsilvicultura/hubmobile/controller/view/Dispositivos.java com/inflor/appsilvicultura/hubmobile/controller/view/MenuSelectedItem.java com/inflor/appsilvicultura/utils/Bluetooth.java com/inflor/appsilvicultura/utils/BluetoothService.java
android.permission.BLUETOOTH_ADMIN	危险	管理蓝牙	允许程序发现和配对新的蓝牙设备。	显示文件 com/inflor/appsilvicultura/controller/view/SelecaoOSActivity.java com/inflor/appsilvicultura/controller/view/SettingsActivity.java com/inflor/appsilvicultura/controller/view/UpdateApkActivity.java com/inflor/appsilvicultura/controller/view/UploadBoletinsActivity.java com/inflor/appsilvicultura/hubmobile/controller/view/Dispositivos.java com/inflor/appsilvicultura/hubmobile/controller/view/MenuSelectedItem.java com/inflor/appsilvicultura/utils/Bluetooth.java com/inflor/appsilvicultura/utils/BluetoothService.java
android.permission.ACCESS_FINE_LOCATION	危险	获取精确位置	通过GPS芯片接收卫星的定位信息，定位精度达10米以内。恶意程序可以用它来确定您所在的位置。
android.permission.ACCESS_COARSE_LOCATION	危险	获取粗略位置	通过WiFi或移动基站的方式获取用户粗略的经纬度信息，定位精度大概误差在30~1500米。恶意程序可以用它来确定您的大概位置。
android.permission.READ_PRIVILEGED_PHONE_STATE	未知	未知权限	来自 android 引用的未知权限。
android.permission.WRITE_EXTERNAL_STORAGE	危险	读取/修改/删除外部存储内容	允许应用程序写入外部存储。	显示文件 com/inflor/appsilvicultura/controller/view/UpdateApkActivity.java com/inflor/appsilvicultura/dao/DatabaseHandler.java com/inflor/appsilvicultura/hubmobile/dao/DatabaseHandlerHub.java com/inflor/appsilvicultura/hubmobile/dao/DatabaseHandlerHubTemp.java com/inflor/appsilvicultura/hubmobile/dao/DatabaseHandlerTemp.java com/inflor/appsilvicultura/utils/Communication.java com/inflor/appsilvicultura/utils/Utils.java
android.permission.RECEIVE_BOOT_COMPLETED	普通	开机自启	允许应用程序在系统完成启动后即自行启动。这样会延长手机的启动时间，而且如果应用程序一直运行，会降低手机的整体速度。	显示文件 com/inflor/appsilvicultura/controller/BootStarter.java com/inflor/appsilvicultura/controller/Update.java com/inflor/appsilvicultura/controller/view/UpdateApkActivity.java com/inflor/appsilvicultura/controller/view/UploadBoletinsActivity.java com/inflor/appsilvicultura/utils/Bluetooth.java
android.permission.KILL_BACKGROUND_PROCESSES	普通	结束进程	允许应用程序结束其他应用程序的后台进程。
android.permission.REQUEST_INSTALL_PACKAGES	危险	允许安装应用程序	Android8.0 以上系统允许安装未知来源应用程序权限。
android.permission.ACCESS_BACKGROUND_LOCATION	危险	获取后台定位权限	允许应用程序访问后台位置。如果您正在请求此权限，则还必须请求ACCESS COARSE LOCATION或ACCESS FINE LOCATION。单独请求此权限不会授予您位置访问权限。

证书安全合规分析

高危

0

警告

1

信息

1

标题	严重程度	描述信息
已签名应用	信息	应用程序已使用代码签名证书进行签名

Manifest 配置安全分析

高危

0

警告

6

信息

0

屏蔽

0

序号	问题	严重程度	描述信息	操作
1	应用程序可以安装在有漏洞的已更新 Android 版本上 Android 4.4-4.4.4, [minSdk=19]	信息	该应用程序可以安装在具有多个未修复漏洞的旧版本 Android 上。这些设备不会从 Google 接收合理的安全更新。支持 Android 版本 => 10、API 29 以接收合理的安全更新。	对应用 com.inflor.appsilvicultura 屏蔽 vulnerable_os_version 规则
2	应用程序已启用明文网络流量 [android:usesCleartextTraffic=true]	警告	应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。	对应用 com.inflor.appsilvicultura 屏蔽 clear_text_traffic 规则
3	应用程序数据可以被备份 [android:allowBackup=true]	警告	这个标志允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。	对应用 com.inflor.appsilvicultura 屏蔽 app_allowbackup 规则
4	Broadcast Receiver (com.inflor.appsilvicultura.controller.BootStarter) 受权限保护, 但是应该检查权限的保护级别。 Permission: android.permission.RECEIVE_BOOT_COMPLETED [android:exported=true]	警告	发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。	对应用 com.inflor.appsilvicultura 屏蔽 receiver_exported_protected_permission_not_defined 规则
5	Broadcast Receiver (com.inflor.appsilvicultura.controller.Update) 未被保护。存在一个intent-filter。	警告	发现 Broadcast Receiver与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Broadcast Receiver是显式导出的。	对应用 com.inflor.appsilvicultura 屏蔽 receiver_exported_intent_filter_exists 规则
6	Activity (com.inflor.appsilvicultura.controller.view.HomeActionSplashActivity) 未被保护。存在一个intent-filter。	警告	发现 Activity与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity是显式导出的。	对应用 com.inflor.appsilvicultura 屏蔽 activity_exported_intent_filter_exists 规则
7	Service (com.inflor.appsilvicultura.utils.ReopenService) 未被保护。 [android:exported=true]	警告	发现 Service与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。	对应用 com.inflor.appsilvicultura 屏蔽 service_explicitly_exported 规则

可浏览 Activity 组件分析

ACTIVITY	INTENT

网络通信安全风险分析

序号	范围	严重级别	描述

API调用分析

API功能	源码文件
一般功能-> 文件操作	显示文件 com/inflor/appsilvicultura/controller/Settings.java com/inflor/appsilvicultura/controller/Update.java com/inflor/appsilvicultura/controller/adapter/AdapterOperacaoProgramada.java com/inflor/appsilvicultura/controller/seguranca/Encryption.java com/inflor/appsilvicultura/controller/seguranca/PasswordDeriveBytes.java com/inflor/appsilvicultura/controller/view/ApontamentoActivity.java com/inflor/appsilvicultura/controller/view/ApontamentoEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/ApontamentoItemMaoObraActivity.java com/inflor/appsilvicultura/controller/view/ApontamentoListMaoObraActivity.java com/inflor/appsilvicultura/controller/view/BoletimActivity.java com/inflor/appsilvicultura/controller/view/ChangePasswordActivity.java com/inflor/appsilvicultura/controller/view/DadosApontamentoEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/DadosApontamentoMaoObraActivity.java com/inflor/appsilvicultura/controller/view/DialogFixarEquipamento.java com/inflor/appsilvicultura/controller/view/DialogFixarTalhao.java com/inflor/appsilvicultura/controller/view/DialogTalhao.java com/inflor/appsilvicultura/controller/view/EditEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/EditInsumoActivity.java com/inflor/appsilvicultura/controller/view/EditMaoObraActivity.java com/inflor/appsilvicultura/controller/view/EditMaoObraPropriaActivity.java com/inflor/appsilvicultura/controller/view/EditParadaEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/EditServicoActivity.java com/inflor/appsilvicultura/controller/view/EquipamentoActivity.java com/inflor/appsilvicultura/controller/view/HomeActionSplashActivity.java com/inflor/appsilvicultura/controller/view/InsumosActivity.java com/inflor/appsilvicultura/controller/view/LoginActivity.java com/inflor/appsilvicultura/controller/view/MaoObraActivity.java com/inflor/appsilvicultura/controller/view/MenuActivity.java com/inflor/appsilvicultura/controller/view/OsDetalheActivity.java com/inflor/appsilvicultura/controller/view/ParadaEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/SearchActivity.java com/inflor/appsilvicultura/controller/view/SelecaoOSActivity.java com/inflor/appsilvicultura/controller/view/ServicosActivity.java com/inflor/appsilvicultura/controller/view/SettingsActivity.java com/inflor/appsilvicultura/controller/view/SplashScreenActivity.java com/inflor/appsilvicultura/controller/view/UpdateApkActivity.java com/inflor/appsilvicultura/controller/view/UploadBoletinsActivity.java com/inflor/appsilvicultura/dao/DBBoletimInsumo.java com/inflor/appsilvicultura/dao/DBBoletimSilvicultura.java com/inflor/appsilvicultura/dao/DBConfiguracao.java com/inflor/appsilvicultura/dao/DBOperacaoProgramada.java com/inflor/appsilvicultura/dao/DatabaseHandler.java com/inflor/appsilvicultura/hubmobile/controller/view/MenuSelectedItem.java com/inflor/appsilvicultura/hubmobile/dao/DatabaseHandlerHub.java com/inflor/appsilvicultura/hubmobile/dao/DatabaseHandlerHubTemp.java com/inflor/appsilvicultura/hubmobile/dao/DatabaseHandlerTemp.java com/inflor/appsilvicultura/utils/BluetoothService.java com/inflor/appsilvicultura/utils/Communication.java com/inflor/appsilvicultura/utils/Permission.java com/inflor/appsilvicultura/utils/ThreadSyncro.java com/inflor/appsilvicultura/utils/Utils.java org/kobjects/base64/Base64.java org/kobjects/crypt/Crypt.java org/kobjects/io/BoundInputStream.java org/kobjects/io/LookAheadReader.java org/kobjects/mime/Decoder.java org/kobjects/pim/PimParser.java org/kobjects/pim/PimWriter.java org/kobjects/rss/RssReader.java org/kobjects/util/Util.java org/kobjects/xml/XmlReader.java org/kobjects/xmlrpc/Driver.java org/kobjects/xmlrpc/XmlRpcParser.java org/ksoap2/SoapEnvelope.java org/ksoap2/SoapFault.java org/ksoap2/SoapFault12.java org/ksoap2/serialization/DM.java org/ksoap2/serialization/Marshal.java org/ksoap2/serialization/MarshalBase64.java org/ksoap2/serialization/MarshalDate.java org/ksoap2/serialization/MarshalFloat.java org/ksoap2/serialization/MarshalHashtable.java org/ksoap2/serialization/SoapSerializationEnvelope.java org/ksoap2/transport/AndroidHttpTransport.java org/ksoap2/transport/AndroidServiceConnection.java org/ksoap2/transport/HttpTransportSE.java org/ksoap2/transport/HttpsServiceConnectionSE.java org/ksoap2/transport/HttpsTransportSE.java org/ksoap2/transport/KeepAliveHttpsTransportSE.java org/ksoap2/transport/ServiceConnection.java org/ksoap2/transport/ServiceConnectionSE.java org/ksoap2/transport/Transport.java org/kxml2/io/KXmlParser.java org/kxml2/io/KXmlSerializer.java org/kxml2/kdom/Document.java org/kxml2/kdom/Element.java org/kxml2/kdom/Node.java org/kxml2/wap/WbxmlParser.java org/kxml2/wap/WbxmlSerializer.java org/kxml2/wap/wv/WV.java
一般功能-> IPC通信	显示文件 com/inflor/appsilvicultura/controller/BootStarter.java com/inflor/appsilvicultura/controller/Settings.java com/inflor/appsilvicultura/controller/Update.java com/inflor/appsilvicultura/controller/view/ApontamentoActivity.java com/inflor/appsilvicultura/controller/view/ApontamentoEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/ApontamentoItemMaoObraActivity.java com/inflor/appsilvicultura/controller/view/ApontamentoListMaoObraActivity.java com/inflor/appsilvicultura/controller/view/BoletimActivity.java com/inflor/appsilvicultura/controller/view/ChangePasswordActivity.java com/inflor/appsilvicultura/controller/view/DadosApontamentoEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/DadosApontamentoMaoObraActivity.java com/inflor/appsilvicultura/controller/view/DialogFixarEquipamento.java com/inflor/appsilvicultura/controller/view/DialogFixarTalhao.java com/inflor/appsilvicultura/controller/view/DialogOperacaoProgramada.java com/inflor/appsilvicultura/controller/view/DialogTalhao.java com/inflor/appsilvicultura/controller/view/EditEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/EditInsumoActivity.java com/inflor/appsilvicultura/controller/view/EditMaoObraActivity.java com/inflor/appsilvicultura/controller/view/EditMaoObraPropriaActivity.java com/inflor/appsilvicultura/controller/view/EditParadaEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/EditServicoActivity.java com/inflor/appsilvicultura/controller/view/EquipamentoActivity.java com/inflor/appsilvicultura/controller/view/HomeActionSplashActivity.java com/inflor/appsilvicultura/controller/view/InsumosActivity.java com/inflor/appsilvicultura/controller/view/LoginActivity.java com/inflor/appsilvicultura/controller/view/MaoObraActivity.java com/inflor/appsilvicultura/controller/view/MaoObraPropriaActivity.java com/inflor/appsilvicultura/controller/view/MenuActivity.java com/inflor/appsilvicultura/controller/view/OsDetalheActivity.java com/inflor/appsilvicultura/controller/view/ParadaEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/SearchActivity.java com/inflor/appsilvicultura/controller/view/SelecaoOSActivity.java com/inflor/appsilvicultura/controller/view/ServicosActivity.java com/inflor/appsilvicultura/controller/view/SettingsActivity.java com/inflor/appsilvicultura/controller/view/SplashScreenActivity.java com/inflor/appsilvicultura/controller/view/UpdateApkActivity.java com/inflor/appsilvicultura/controller/view/UploadBoletinsActivity.java com/inflor/appsilvicultura/dao/DBBoletimSilvicultura.java com/inflor/appsilvicultura/hubmobile/controller/view/Dispositivos.java com/inflor/appsilvicultura/hubmobile/controller/view/MenuSelectedItem.java com/inflor/appsilvicultura/utils/Bluetooth.java com/inflor/appsilvicultura/utils/ReopenService.java com/inflor/appsilvicultura/utils/Utils.java
组件-> 启动 Activity	显示文件 com/inflor/appsilvicultura/controller/BootStarter.java com/inflor/appsilvicultura/controller/Settings.java com/inflor/appsilvicultura/controller/Update.java com/inflor/appsilvicultura/controller/view/ApontamentoActivity.java com/inflor/appsilvicultura/controller/view/ApontamentoEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/ApontamentoItemMaoObraActivity.java com/inflor/appsilvicultura/controller/view/ApontamentoListMaoObraActivity.java com/inflor/appsilvicultura/controller/view/BoletimActivity.java com/inflor/appsilvicultura/controller/view/EditEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/EditMaoObraActivity.java com/inflor/appsilvicultura/controller/view/EquipamentoActivity.java com/inflor/appsilvicultura/controller/view/HomeActionSplashActivity.java com/inflor/appsilvicultura/controller/view/InsumosActivity.java com/inflor/appsilvicultura/controller/view/LoginActivity.java com/inflor/appsilvicultura/controller/view/MaoObraActivity.java com/inflor/appsilvicultura/controller/view/MaoObraPropriaActivity.java com/inflor/appsilvicultura/controller/view/MenuActivity.java com/inflor/appsilvicultura/controller/view/ParadaEquipamentoActivity.java com/inflor/appsilvicultura/controller/view/SearchActivity.java com/inflor/appsilvicultura/controller/view/SelecaoOSActivity.java com/inflor/appsilvicultura/controller/view/ServicosActivity.java com/inflor/appsilvicultura/controller/view/SettingsActivity.java com/inflor/appsilvicultura/controller/view/SplashScreenActivity.java com/inflor/appsilvicultura/controller/view/UpdateApkActivity.java com/inflor/appsilvicultura/controller/view/UploadBoletinsActivity.java com/inflor/appsilvicultura/hubmobile/controller/view/Dispositivos.java com/inflor/appsilvicultura/utils/ReopenService.java com/inflor/appsilvicultura/utils/Utils.java
调用java反射机制	显示文件 com/inflor/appsilvicultura/utils/TimePickerNougatDialog.java org/kobjects/util/ChainedRuntimeException.java org/ksoap2/serialization/MarshalFloat.java org/ksoap2/serialization/SoapSerializationEnvelope.java se/emilsjolander/stickylistheaders/WrapperViewList.java
一般功能-> 获取系统服务(getSystemService)	显示文件 com/inflor/appsilvicultura/controller/Settings.java com/inflor/appsilvicultura/controller/view/SelecaoOSActivity.java com/inflor/appsilvicultura/dao/DBBoletimSilvicultura.java com/inflor/appsilvicultura/hubmobile/dao/DBBoletimSilvicultura.java com/inflor/appsilvicultura/utils/Permission.java com/inflor/appsilvicultura/utils/ReopenService.java
组件-> 启动 Service	com/inflor/appsilvicultura/controller/Settings.java
进程操作-> 获取运行的进程\服务	com/inflor/appsilvicultura/utils/ReopenService.java
网络通信-> 蓝牙连接	显示文件 com/inflor/appsilvicultura/controller/view/SelecaoOSActivity.java com/inflor/appsilvicultura/controller/view/SettingsActivity.java com/inflor/appsilvicultura/controller/view/UpdateApkActivity.java com/inflor/appsilvicultura/controller/view/UploadBoletinsActivity.java com/inflor/appsilvicultura/hubmobile/controller/view/Dispositivos.java com/inflor/appsilvicultura/hubmobile/controller/view/MenuSelectedItem.java com/inflor/appsilvicultura/utils/Bluetooth.java com/inflor/appsilvicultura/utils/BluetoothService.java
网络通信-> HTTPS建立连接	org/ksoap2/transport/HttpsServiceConnectionSE.java
一般功能-> Android通知	com/inflor/appsilvicultura/dao/DBBoletimSilvicultura.java com/inflor/appsilvicultura/hubmobile/dao/DBBoletimSilvicultura.java
网络通信-> TCP套接字	com/inflor/appsilvicultura/utils/Communication.java
加密解密-> Base64 解密	com/inflor/appsilvicultura/controller/view/LoginActivity.java com/inflor/appsilvicultura/utils/Communication.java
加密解密-> Base64 加密	com/inflor/appsilvicultura/controller/view/ChangePasswordActivity.java com/inflor/appsilvicultura/controller/view/LoginActivity.java
加密解密-> Crypto加解密组件	com/inflor/appsilvicultura/controller/seguranca/Encryption.java
网络通信-> HTTP建立连接	org/ksoap2/transport/ServiceConnectionSE.java
加密解密-> 信息摘要算法	com/inflor/appsilvicultura/controller/seguranca/PasswordDeriveBytes.java
命令执行-> getRuntime.exec()	com/inflor/appsilvicultura/utils/Utils.java
隐私数据-> 获取已安装的应用程序	com/inflor/appsilvicultura/utils/Utils.java

安全漏洞检测

高危

0

警告

5

信息

1

安全

0

屏蔽

0

序号	问题	等级	参考标准	文件位置	操作
1	应用程序记录日志信息,不得记录敏感信息	信息	CWE: CWE-532: 通过日志文件的信息暴露 OWASP MASVS: MSTG-STORAGE-3	升级会员：解锁高级权限	对应用 com.inflor.appsilvicultura 屏蔽 android_logging 规则仅对这些文件屏蔽 android_logging 规则
2	应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据	警告	CWE: CWE-276: 默认权限不正确 OWASP Top 10: M2: Insecure Data Storage OWASP MASVS: MSTG-STORAGE-2	升级会员：解锁高级权限	对应用 com.inflor.appsilvicultura 屏蔽 android_read_write_external 规则仅对这些文件屏蔽 android_read_write_external 规则
3	文件可能包含硬编码的敏感信息，如用户名、密码、密钥等	警告	CWE: CWE-312: 明文存储敏感信息 OWASP Top 10: M9: Reverse Engineering OWASP MASVS: MSTG-STORAGE-14	升级会员：解锁高级权限	对应用 com.inflor.appsilvicultura 屏蔽 android_hardcoded 规则仅对这些文件屏蔽 android_hardcoded 规则
4	应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库	警告	CWE: CWE-89: SQL命令中使用的特殊元素转义处理不恰当（'SQL 注入'） OWASP Top 10: M7: Client Code Quality	升级会员：解锁高级权限	对应用 com.inflor.appsilvicultura 屏蔽 android_sql_raw_query 规则仅对这些文件屏蔽 android_sql_raw_query 规则
5	应用程序使用不安全的随机数生成器	警告	CWE: CWE-330: 使用不充分的随机数 OWASP Top 10: M5: Insufficient Cryptography OWASP MASVS: MSTG-CRYPTO-6	升级会员：解锁高级权限	对应用 com.inflor.appsilvicultura 屏蔽 android_insecure_random 规则仅对这些文件屏蔽 android_insecure_random 规则
6	SHA-1是已知存在哈希冲突的弱哈希	警告	CWE: CWE-327: 使用已被攻破或存在风险的密码学算法 OWASP Top 10: M5: Insufficient Cryptography OWASP MASVS: MSTG-CRYPTO-4	升级会员：解锁高级权限	对应用 com.inflor.appsilvicultura 屏蔽 android_sha1 规则仅对这些文件屏蔽 android_sha1 规则

Native库安全分析

No Shared Objects found.

序号	动态库	NX(堆栈禁止执行)	PIE	STACK CANARY(栈保护)	RELRO	RPATH（指定SO搜索路径）	RUNPATH（指定SO搜索路径）	FORTIFY(常用函数加强检查)	SYMBOLS STRIPPED(裁剪符号表)

文件分析

序号	问题	文件

敏感权限分析

恶意软件常用权限 5/30

android.permission.READ_PHONE_STATE
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.REQUEST_INSTALL_PACKAGES

其它常用权限 6/46

android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_BACKGROUND_LOCATION

恶意软件常用权限 是被已知恶意软件广泛滥用的权限。
其它常用权限 是已知恶意软件经常滥用的权限。

IP地理位置

恶意域名检测

域名	状态	中国境内	位置信息
www.openmobilealliance.org	安全	否	IP地址: 104.26.8.105 国家: 美利坚合众国地区: 加利福尼亚城市: 旧金山查看: Google 地图
www.wireless-village.org	安全	否	IP地址: 172.67.131.214 国家: 美利坚合众国地区: 加利福尼亚城市: 旧金山查看: Google 地图
tempuri.org	安全	否	IP地址: 20.231.239.246 国家: 美利坚合众国地区: 弗吉尼亚州城市: 华盛顿查看: Google 地图

手机号提取

手机号	源码文件
18222222222 19222222222	com/inflor/appsilvicultura/dao/DBConfiguracao.java

URL链接分析

URL信息	源码文件
http://tempuri.org/	com/inflor/appsilvicultura/utils/Communication.java
http://www.wireless-village.org/trc http://www.openmobilealliance.org/dtd/wv-pa http://www.wireless-village.org/csp http://www.wireless-village.org/pa www.wireless-village.org http://www.openmobilealliance.org/dtd/wv-trc http://www.openmobilealliance.org/dtd/wv-csp	org/kxml2/wap/wv/WV.java
http://www.wireless-village.org/trc http://www.openmobilealliance.org/dtd/wv-pa http://www.wireless-village.org/csp http://www.wireless-village.org/pa www.wireless-village.org http://www.openmobilealliance.org/dtd/wv-trc http://tempuri.org/ http://www.openmobilealliance.org/dtd/wv-csp	自研引擎-S

Firebase配置检测

邮箱地址提取

EMAIL	源码文件
igor.pinheiro@inflor.com.br	com/inflor/appsilvicultura/utils/Utils.java
igor.pinheiro@inflor.com.br	自研引擎-S

第三方追踪器

名称	类别	网址

敏感凭证泄露

已显示 7 个secrets

1、 "password" : "Password"
2、 "user" : "User"
3、 "password" : "Senha"
4、 "password" : "Senha"
5、 "password" : "Senha"
6、 "user" : "Utilizador"
7、 fa87c0d0-afac-11de-8a39-0800200c9a66

字符串信息

建议导出为TXT，方便查看。

活动列表

显示 32 个 activities

服务列表

显示 1 个 services

1 . com.inflor.appsilvicultura.utils.ReopenService

广播接收者列表

显示 2 个 receivers

内容提供者列表

显示 1 个 providers

1 . androidx.core.content.FileProvider

第三方SDK

SDK名称	开发者	描述信息
File Provider	Android	FileProvider 是 ContentProvider 的特殊子类，它通过创建 content://Uri 代替 file:///Uri 以促进安全分享与应用程序关联的文件。

污点分析

当apk较大时，代码量会很大，造成数据流图（ICFG）呈现爆炸式增长，所以该功能比较耗时，请先喝杯咖啡，耐心等待……

规则名称	描述信息	操作
病毒分析	使用安卓恶意软件常用的API进行污点分析	开始分析
漏洞挖掘	漏洞挖掘场景下的污点分析	开始分析
隐私合规	隐私合规场景下的污点分析：组件内污点传播、组件间污点传播、组件与库函数之间的污点传播	开始分析
密码分析	分析加密算法是否使用常量密钥、静态初始化的向量（IV）、加密模式是否使用ECB等	开始分析
Callback	因为Android中系统级的Callback并不会出现显式地进行回调方法的调用，所以如果需要分析Callback方法需要在声明文件中将其声明，这里提供一份AndroidCallbacks.txt文件，里面是一些常见的原生回调接口或类，如果有特殊接口需求，可以联系管理员	开始分析

时间	执行功能	执行结果
2024-09-28 03:03:48	生成哈希值	成功
2024-09-28 03:03:48	提取APK	成功
2024-09-28 03:03:48	探测加固信息为：未加壳	成功
2024-09-28 03:03:48	开始解压文件	成功
2024-09-28 03:03:51	获取硬编码证书/密钥库	成功
2024-09-28 03:03:54	解析 AndroidManifest.xml	成功
2024-09-28 03:03:54	使用 androguard 解析 APK	成功
2024-09-28 03:03:55	提取Manifest数据	成功
2024-09-28 03:03:55	提取应用程序基础数据，例如：app名称，版本，包名称等信息	成功
2024-09-28 03:03:55	正在从Play Store获取详细信息: com.inflor.appsilvicultura	成功
2024-09-28 03:03:57	Manifest分析开始	成功
2024-09-28 03:03:57	检查恶意软件权限	成功
2024-09-28 03:03:57	提取APK中所有的类和方法	成功
2024-09-28 03:03:58	解析出1997个class，20869个method	成功
2024-09-28 03:03:58	SO文件分析开始	成功
2024-09-28 03:03:58	读取代码签名证书	成功
2024-09-28 03:03:58	检测追踪器	成功
2024-09-28 03:03:58	将 APK 反编译为 Java	成功
2024-09-28 03:04:04	代码分析开始于 - java_source	成功
2024-09-28 03:04:04	Android SAST 开始	成功
2024-09-28 03:04:05	Android API分析开始	成功
2024-09-28 03:04:06	开始进行Android 权限映射	成功
2024-09-28 03:04:07	Android权限映射已完成	成功
2024-09-28 03:04:07	从 APK 中提取字符串数据	成功
2024-09-28 03:04:08	从代码中提取字符串数据	成功
2024-09-28 03:04:08	从代码中提取字符串值和凭证数据	成功
2024-09-28 03:04:08	对提取的域名执行恶意软件检查	成功
2024-09-28 03:04:09	VirusTotal: 检查现有报告	成功
2024-09-28 03:04:10	VirusTotal: Scan finished, information embedded	成功
2024-09-28 03:04:10	保存到数据库	成功