温馨提示:本平台仅供研究软件风险、安全评估,禁止用于非法用途。由于展示的数据过于全面,请耐心等待加载完成。如有疑问或建议, 可加入我们的微信群讨论

应用图标

应用评分

文件信息

文件名称 9e37d9d159c9b642ad6448834a45910f00dae70e6b052718b5435af12ccafb96.apk
文件大小 6.31MB
MD5 14f9c72da64428be15cfc921381d4366
SHA1 9ddb8b2e9a9ca79532913a657ad2344a1ea94ad5
SHA256 9e37d9d159c9b642ad6448834a45910f00dae70e6b052718b5435af12ccafb96
病毒检测 ⚠️ 30 个厂商报毒⚠️

应用信息

应用名称 Google Chrome
包名 com.fivefrontdfx
主活动 com.fivefrontdfx.p051i
目标SDK 29 最小SDK 21
版本号 3.10 子版本号 3
加固信息 未加壳

非法应用检测 (该功能即将上线,识别赌博、诈骗、色情和黑产等类型应用)

组件导出信息

反编译代码

Manifest文件 查看
Java源代码 查看 -- 下载

证书信息

二进制文件已签名
v1 签名: True
v2 签名: True
v3 签名: False
v4 签名: False
主题: C=CN
签名算法: rsassa_pkcs1v15
有效期自: 2021-05-22 04:58:32+00:00
有效期至: 2120-09-04 04:58:32+00:00
发行人: C=CN
序列号: 0xc11d603
哈希算法: sha1
证书MD5: fa6a1a1aee75bab3541991272a67e612
证书SHA1: e9c3927edd5e040c785de554346d29324e0d61f5
证书SHA256: e702de593abce6259624b294b47a16a0239caa17322c3285b6d1c8acf7fbf30d
证书SHA512: 9b03341b995fa088b8d0ae9eebf6c5ede9b16f6cebca3b10da1d2c84b131ed3b98008b9b4f152083d4d3388b5a4db2da8dd07cca64a3522da2ee9033d0bf2d50
公钥算法: rsa
密钥长度: 2048
指纹: dbba9fd24e1bf4181151f90e2bfdaec6f2e716baf8f720bfe46a1bf9d5041900
找到 1 个唯一证书

应用程序权限

权限名称 安全等级 权限内容 权限描述 关联代码
android.permission.CLEAR_APP_CACHE 危险 删除所有应用程序缓存数据 允许应用程序通过删除应用程序缓存目录中的文件释放手机存储空间。通常此权限只适用于系统进程。
android.permission.USE_FINGERPRINT 普通 允许使用指纹 此常量在 API 级别 28 中已弃用。应用程序应改为请求USE_BIOMETRIC
android.permission.WRITE_EXTERNAL_STORAGE 危险 读取/修改/删除外部存储内容 允许应用程序写入外部存储。
android.permission.ACCESS_NOTIFICATION_POLICY 普通 标记访问通知策略的权限 对希望访问通知政策的应用程序的标记许可。
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS 普通 使用 Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS 的权限 应用程序必须拥有权限才能使用 Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS。
android.permission.FOREGROUND_SERVICE 普通 创建前台Service Android 9.0以上允许常规应用程序使用 Service.startForeground,用于podcast播放(推送悬浮播放,锁屏播放)
android.permission.RECEIVE_BOOT_COMPLETED 普通 开机自启 允许应用程序在系统完成启动后即自行启动。这样会延长手机的启动时间,而且如果应用程序一直运行,会降低手机的整体速度。
android.permission.INTERNET 危险 完全互联网访问 允许应用程序创建网络套接字。
com/amazon/CoralAndroidClient/ClientBase/ClientBase.java
com/amazon/CoralAndroidClient/Connector/Connector.java
com/amazon/CoralAndroidClient/Connector/DefaultHttpURLConnectionFactory.java
com/amazon/aee/resolver/impl/MarketplaceWillChangeHandler.java
com/amazon/alexa/sdk/downchannel/AvsDownchannel.java
com/amazon/alexa/sdk/downchannel/AvsPinger.java
com/amazon/alexa/sdk/primitives/asmdclient/ASMDServiceClient.java
com/amazon/alexa/sdk/primitives/capabilitiesclient/ADCSClient.java
com/amazon/alexa/sdk/primitives/streamingclient/AlexaHttpClient.java
com/amazon/alexa/sdk/settings/AlexaSettingsFetcher.java
com/amazon/alexamediaplayer/parser/HttpDataSourceImpl.java
com/amazon/alexamediaplayer/parser/OkHttpFactory.java
com/amazon/android/oma/hub/AppRewards/AppRewardsClient.java
com/amazon/android/oma/hub/AppRewards/AppRewardsHelper.java
com/amazon/api/authentication/signing/AAPIRequestSigner.java
com/amazon/appunique/appwidget/DiscoverWidgetBridgeReceiver.java
com/amazon/appunique/appwidget/aapi/AAPIHelper.java
com/amazon/aps/shared/util/APSNetworkManager.java
com/amazon/beauty/lipstick/vtolipstick/datalayer/ASIN3DModelDownloadHelper.java
com/amazon/beauty/lipstick/vtolipstick/tracking/LipDetectionMLModelDownloadHelper.java
com/amazon/blueshift/bluefront/android/SpeechClient.java
com/amazon/blueshift/bluefront/android/http/MultipartRequest.java
com/amazon/blueshift/bluefront/android/http/URLWrapper.java
com/amazon/cart/AAPIHelper.java
com/amazonaws/DefaultRequest.java
com/amazonaws/Request.java
com/amazonaws/auth/AWS3Signer.java
com/amazonaws/auth/AWS4Signer.java
com/amazonaws/http/AmazonHttpClient.java
com/amazonaws/http/HttpRequest.java
com/amazonaws/http/UrlHttpClient.java
com/amazonaws/ivs/net/HttpUrlConnectionClient.java
com/amazonaws/ivs/net/NetworkLinkInfo.java
com/amazonaws/ivs/net/OkHttpClient.java
com/amazonaws/mobileconnectors/cognitoauth/util/AuthHttpClient.java
com/amazonaws/mobileconnectors/remoteconfiguration/internal/net/AndroidRemoteConfigurationFetcher.java
com/amazonaws/util/ClassLoaderHelper.java
com/amazonaws/util/HttpUtils.java
com/amazonaws/util/XpathUtils.java
com/mypinpad/tsdk/gj.java
android.permission.RECEIVE_SMS 危险 接收短信 允许应用程序接收短信。 恶意程序会在用户未知的情况下监视或删除。
android.permission.READ_SMS 危险 读取短信 允许应用程序读取您的手机或 SIM 卡中存储的短信。恶意应用程序可借此读取您的机密信息。
android.Manifest.permission.READ_PHONE_STATE 危险 读取手机状态和标识 允许应用程序访问设备的手机功能。有此权限的应用程序可确定此手机的号码和序列号,是否正在通话,以及对方的号码等。
android.permission.SEND_SMS 危险 发送短信 允许应用程序发送短信。恶意应用程序可能会不经您的确认就发送信息,给您带来费用。
android.permission.WAKE_LOCK 危险 防止手机休眠 允许应用程序防止手机休眠,在手机屏幕关闭后后台进程仍然运行。
android.permission.READ_PHONE_STATE 危险 读取手机状态和标识 允许应用程序访问设备的手机功能。有此权限的应用程序可确定此手机的号码和序列号,是否正在通话,以及对方的号码等。
android.permission.CALL_PHONE 危险 直接拨打电话 允许应用程序直接拨打电话。恶意程序会在用户未知的情况下拨打电话造成损失。但不被允许拨打紧急电话。
android.permission.USES_POLICY_FORCE_LOCK 签名(系统) 强制锁定屏幕 这个安卓权限是用于强制锁定屏幕的。它允许应用程序通过调用DevicePolicyManager的lockNow()方法来立即锁定设备,而不需要用户的操作。
android.permission.VIBRATE 普通 控制振动器 允许应用程序控制振动器,用于消息通知振动功能。
android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND 普通 允许配套应用程序在后台运行 允许配套应用在后台运行。
android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND 普通 允许配套应用程序在后台使用数据 允许配套应用在后台使用数据。
android.permission.REQUEST_DELETE_PACKAGES 普通 请求删除应用 允许应用程序请求删除包。
android.permission.MODIFY_AUDIO_SETTINGS 危险 允许应用修改全局音频设置 允许应用程序修改全局音频设置,如音量。多用于消息语音功能。
android.permission.ACCESS_WIFI_STATE 普通 查看Wi-Fi状态 允许应用程序查看有关Wi-Fi状态的信息。
android.permission.ACCESS_NETWORK_STATE 普通 获取网络状态 允许应用程序查看所有网络的状态。
android.permission.WRITE_SETTINGS 危险 修改全局系统设置 允许应用程序修改系统设置方面的数据。恶意应用程序可借此破坏您的系统配置。
android.permission.REORDER_TASKS 危险 对正在运行的应用程序重新排序 允许应用程序将任务移至前端和后台。恶意应用程序可借此强行进入前端,而不受您的控制。

证书安全分析

高危
0
警告
1
信息
1
标题 严重程度 描述信息
已签名应用 信息 应用程序已使用代码签名证书进行签名

MANIFEST分析

高危
0
警告
8
信息
0
屏蔽
0
序号 问题 严重程度 描述信息 操作
1 应用程序可以安装在有漏洞的已更新 Android 版本上
Android 5.0-5.0.2, [minSdk=21]
信息 该应用程序可以安装在具有多个未修复漏洞的旧版本 Android 上。这些设备不会从 Google 接收合理的安全更新。支持 Android 版本 => 10、API 29 以接收合理的安全更新。
2 应用程序已启用明文网络流量
[android:usesCleartextTraffic=true]
警告 应用程序打算使用明文网络流量,例如明文HTTP,FTP协议,DownloadManager和MediaPlayer。针对API级别27或更低的应用程序,默认值为“true”。针对API级别28或更高的应用程序,默认值为“false”。避免使用明文流量的主要原因是缺乏机密性,真实性和防篡改保护;网络攻击者可以窃听传输的数据,并且可以在不被检测到的情况下修改它。
3 Broadcast Receiver (com.fivefrontdfx.p088s) 未被保护。
[android:exported=true]
警告 发现 Broadcast Receiver与设备上的其他应用程序共享,因此可被设备上的任何其他应用程序访问。
4 Broadcast Receiver (com.fivefrontdfx.p069o) 受权限保护, 但是应该检查权限的保护级别。
Permission: android.permission.BROADCAST_SMS
[android:exported=true]
警告 发现一个 Broadcast Receiver被共享给了设备上的其他应用程序,因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此,应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险,一个恶意应用程序可以请求并获得这个权限,并与该组件交互。如果它被设置为签名,只有使用相同证书签名的应用程序才能获得这个权限。
5 Broadcast Receiver (com.fivefrontdfx.p014k) 受权限保护, 但是应该检查权限的保护级别。
Permission: android.permission.BROADCAST_WAP_PUSH
[android:exported=true]
警告 发现一个 Broadcast Receiver被共享给了设备上的其他应用程序,因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此,应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险,一个恶意应用程序可以请求并获得这个权限,并与该组件交互。如果它被设置为签名,只有使用相同证书签名的应用程序才能获得这个权限。
6 Service (com.fivefrontdfx.p042p) 受权限保护, 但是应该检查权限的保护级别。
Permission: android.permission.SEND_RESPOND_VIA_MESSAGE
[android:exported=true]
警告 发现一个 Service被共享给了设备上的其他应用程序,因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此,应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险,一个恶意应用程序可以请求并获得这个权限,并与该组件交互。如果它被设置为签名,只有使用相同证书签名的应用程序才能获得这个权限。
7 Broadcast Receiver (com.fivefrontdfx.p025y) 未被保护。
[android:exported=true]
警告 发现 Broadcast Receiver与设备上的其他应用程序共享,因此可被设备上的任何其他应用程序访问。
8 高优先级的Intent (999)
[android:priority]
警告 通过设置一个比另一个Intent更高的优先级,应用程序有效地覆盖了其他请求。
9 高优先级的Intent (999)
[android:priority]
警告 通过设置一个比另一个Intent更高的优先级,应用程序有效地覆盖了其他请求。

可浏览的Activity组件

ACTIVITY INTENT
com.fivefrontdfx.p044w Schemes: sms://, smsto://, mms://, mmsto://,

网络通信安全

序号 范围 严重级别 描述

API调用分析

API功能 源码文件
一般功能-> 文件操作
TcxnwtGs/Edrcztc.java
TcxnwtGs/Ipozzshq.java
TcxnwtGs/Myxmoc.java
TcxnwtGs/Ov.java
TcxnwtGs/Useebh.java
TcxnwtGs/Yoohtor.java
com/amazon/CoralAndroidClient/Connector/Connector.java
com/amazon/CoralAndroidClient/Connector/DefaultHttpURLConnectionFactory.java
com/amazon/aee/resolver/EEResolverPublicUtils.java
com/amazon/aee/resolver/impl/MarketplaceWillChangeHandler.java
com/amazon/alexa/sdk/audio/BlueAudioInputStream.java
com/amazon/alexa/sdk/audio/FileAudioInputStream.java
com/amazon/alexa/sdk/audio/channel/content/amp/InternalFileManagerImpl.java
com/amazon/alexa/sdk/audio/channel/content/amp/service/AmpService.java
com/amazon/alexa/sdk/downchannel/AvsPinger.java
com/amazon/alexa/sdk/internal/InternalFileManager.java
com/amazon/alexa/sdk/orchestration/handler/SpeechRecognizer.java
com/amazon/alexa/sdk/orchestration/okhttp/StreamResetException.java
com/amazon/alexa/sdk/primitives/alexaclient/AlexaClient.java
com/amazon/alexa/sdk/primitives/alexaclient/AlexaClientService.java
com/amazon/alexa/sdk/primitives/alexaclient/MultipartRequestListenerImpl.java
com/amazon/alexa/sdk/primitives/alexaclient/contexts/DynamicContext.java
com/amazon/alexa/sdk/primitives/alexaclient/directives/DirectiveFactory.java
com/amazon/alexa/sdk/primitives/alexaclient/events/EventDecorator.java
com/amazon/alexa/sdk/primitives/alexaclient/events/dynamic/HeaderSerializer.java
com/amazon/alexa/sdk/primitives/alexaclient/events/dynamic/PayloadSerializer.java
com/amazon/alexa/sdk/primitives/alexaclient/events/dynamic/Serializer.java
com/amazon/alexa/sdk/primitives/asmdclient/ASMDConstantsResponseCallback.java
com/amazon/alexa/sdk/primitives/asmdclient/ASMDEligibilityResponseCallback.java
com/amazon/alexa/sdk/primitives/asmdclient/ASMDEulaResponseCallback.java
com/amazon/alexa/sdk/primitives/asmdclient/ASMDResponseCallback.java
com/amazon/alexa/sdk/primitives/capabilitiesclient/ADCSClient.java
com/amazon/alexa/sdk/primitives/capabilitiesclient/ADCSResponseCallback.java
com/amazon/alexa/sdk/primitives/streamingclient/AlexaHttpClient.java
com/amazon/alexa/sdk/primitives/streamingclient/MultipartRequestFactory.java
com/amazon/alexa/sdk/primitives/streamingclient/MultipartRequestFactoryService.java
com/amazon/alexa/sdk/primitives/streamingclient/MultipartResponseParser.java
com/amazon/alexa/sdk/primitives/streamingclient/MultipartResponseParserService.java
com/amazon/alexa/sdk/primitives/streamingclient/MultipartStream.java
com/amazon/alexa/sdk/primitives/streamingclient/MultipartStreamingClient.java
com/amazon/alexa/sdk/primitives/streamingclient/NetworkResponse.java
com/amazon/alexa/sdk/primitives/streamingclient/ResponseCallback.java
com/amazon/alexa/sdk/settings/AlexaSettings.java
com/amazon/alexa/sdk/settings/AlexaSettingsFetcher.java
com/amazon/alexa/sdk/settings/AlexaSettingsParser.java
com/amazon/alexa/sdk/utils/Close.java
com/amazon/alexamediaplayer/avscomponent/mediaplayer/MediaPlayerTrackInfo.java
com/amazon/alexamediaplayer/exceptions/FetchException.java
com/amazon/alexamediaplayer/metadata/IcyMetadataInputStream.java
com/amazon/alexamediaplayer/parser/HlsTagReader.java
com/amazon/alexamediaplayer/parser/HttpDataSourceImpl.java
com/amazon/alexamediaplayer/parser/HttpTimingInterceptor.java
com/amazon/alexamediaplayer/parser/MediaPlaylist.java
com/amazon/alexamediaplayer/parser/PlaylistDeterminator.java
com/amazon/alexamediaplayer/parser/PlaylistParser.java
com/amazon/alexamediaplayer/playback/AlexaHlsSource.java
com/amazon/alexamediaplayer/playback/AudioPlayerDispatcher.java
com/amazon/alexamediaplayer/playback/HlsRendererBuilder.java
com/amazon/alexamediaplayer/playback/MainPlayer.java
com/amazon/alexamediaplayer/playback/MediaPlayerDispatcher.java
com/amazon/alexamediaplayer/playback/RendererBuilder.java
com/amazon/alexamediaplayer/playback/SpotifyWhaPlayerDispatcher.java
com/amazon/alexamediaplayer/playback/TypedStream.java
com/amazon/alexamediaplayer/spotify/AudioDataBuffer.java
com/amazon/alexamediaplayer/spotify/AudioDataFileBuffer.java
com/amazon/alexamediaplayer/spotify/DefaultDisplayNameProvider.java
com/amazon/alexamediaplayer/spotify/EmbeddedSDKWrapper.java
com/amazon/alexamediaplayer/spotify/ExoPlayerOggDataSource.java
com/amazon/alexamediaplayer/spotify/SpotifyDataSource.java
com/amazon/alexamediaplayer/spotify/SpotifyGuestConnectHelper.java
com/amazon/alexamediaplayer/spotify/SpotifySampleSource.java
com/amazon/alexamediaplayer/spotify/SpotifyServer.java
com/amazon/android/address/lib/util/AddressPreferences.java
com/amazon/android/oma/hub/AppRewards/AppRewardsClient.java
com/amazon/android/oma/hub/AppRewards/AppRewardsHelper.java
com/amazon/android/oma/hub/NotificationHubServiceImpl.java
com/amazon/android/oma/hub/badging/BadgingHandler.java
com/amazon/api/authentication/signing/AAPIRequestSigner.java
com/amazon/appflow/datastream/SimpleDataStream.java
com/amazon/appflow/datastream/react/AAPIDataStreamModuleV3.java
com/amazon/appflow/datastream/react/AAPIJSIValueConversionHelper.java
com/amazon/appmanager/lib/DefaultPreloadManager.java
com/amazon/appmanager/lib/PreloadManager.java
com/amazon/appunique/appwidget/CacheApi$MainProcess.java
com/amazon/appunique/appwidget/CacheApi$SubProcess.java
com/amazon/appunique/appwidget/DiscoverActionsReceiver.java
com/amazon/appunique/appwidget/DiscoverWidgetBridgeReceiver.java
com/amazon/appunique/appwidget/DiscoverWidgetCache.java
com/amazon/appunique/appwidget/DiscoverWidgetTranslations.java
com/amazon/appunique/appwidget/DiscoverWidgetUtils.java
com/amazon/appunique/appwidget/aapi/AAPIClient.java
com/amazon/appunique/appwidget/aapi/AAPIHelper.java
com/amazon/appunique/appwidget/aapi/model/GetMissionIngress.java
com/amazon/appunique/appwidget/aapi/model/GetNativeWidgets.java
com/amazon/appunique/appwidget/metrics/QueuedMetricsProcessor.java
com/amazon/appunique/appwidget/metrics/QueuingMetricsEngine.java
com/amazon/appunique/appwidget/plugins/MarketplaceListener.java
com/amazon/appunique/splashscreen/SplashFutureConfigLoader.java
com/amazon/appunique/splashscreen/SplashScreenController.java
com/amazon/appunique/splashscreen/config/SplashAsset.java
com/amazon/appunique/splashscreen/config/SplashConfig.java
com/amazon/appunique/splashscreen/config/SplashConfigParser.java
com/amazon/appunique/splashscreen/config/SplashEvent.java
com/amazon/appunique/splashscreen/config/json/JsonConfigParser.java
com/amazon/aps/shared/analytics/APSEvent.java
com/amazon/aps/shared/util/APSNetworkManager.java
com/amazon/beauty/lipstick/engine/product/VTOLipstick/ARLipstickProduct.java
com/amazon/beauty/lipstick/ui/components/CameraPreviewComponent.java
com/amazon/beauty/lipstick/vtolipstick/FaceSwatchesViewModel.java
com/amazon/beauty/lipstick/vtolipstick/ProductMetadataRxJavaWrapper.java
com/amazon/beauty/lipstick/vtolipstick/datalayer/ASIN3DModelDownloadHelper.java
com/amazon/beauty/lipstick/vtolipstick/datalayer/ASINModelExtractor.java
com/amazon/beauty/lipstick/vtolipstick/datalayer/VariantsRepositoryRxJavaWrapper.java
com/amazon/beauty/lipstick/vtolipstick/livemode/VTOLipstickLiveModePresenter.java
com/amazon/beauty/lipstick/vtolipstick/livemode/VTOLipstickLiveModeRepository.java
com/amazon/beauty/lipstick/vtolipstick/staticmode/VTOLipstickStaticModeFragment.java
com/amazon/beauty/lipstick/vtolipstick/tracking/LipDetectionMLModelDownloadHelper.java
com/amazon/beauty/lipstick/vtolipstick/tracking/LipLandmarkDetectionInterpreter.java
com/amazon/beauty/lipstick/vtolipstick/tracking/LipLandmarkDetector.java
com/amazon/beauty/lipstick/vtolipstick/tracking/MLModelSaveHelper.java
com/amazon/blueshift/bluefront/android/SpeechClient.java
com/amazon/blueshift/bluefront/android/audio/AudioRecorder.java
com/amazon/blueshift/bluefront/android/audio/AudioSource.java
com/amazon/blueshift/bluefront/android/audio/AudioStream.java
com/amazon/blueshift/bluefront/android/audio/WakewordAudioRecorder.java
com/amazon/blueshift/bluefront/android/audio/encoder/AudioEncoder.java
com/amazon/blueshift/bluefront/android/common/AndroidDevice.java
com/amazon/blueshift/bluefront/android/http/MultipartRequest.java
com/amazon/blueshift/bluefront/android/http/URLWrapper.java
com/amazon/blueshift/bluefront/android/http/part/InputStreamPart.java
com/amazon/blueshift/bluefront/android/http/part/OptionalSerializedJsonPart.java
com/amazon/blueshift/bluefront/android/http/part/Part.java
com/amazon/blueshift/bluefront/android/http/part/SerializedJsonPart.java
com/amazon/blueshift/bluefront/android/vad/VoiceActivityDetector.java
com/amazon/bodylabs/camera/RNBodyLabsMLCameraModule.java
com/amazon/bodylabs/camera/RNCameraView.java
com/amazon/bodylabs/camera/landmarker/Landmarker.java
com/amazon/bodylabs/camera/tasks/ResolveTakenPictureAsyncTask.java
com/amazon/bodylabs/camera/utils/RNFileUtils.java
com/amazon/bodylabs/camera/utils/ScopedContext.java
com/amazon/bodylabs/camera/view/Camera1.java
com/amazon/bodylabs/camera/view/Camera2.java
com/amazon/cart/AAPICartClient.java
com/amazon/cart/AAPIHelper.java
com/amazon/mShop/android/platform/dex/DexUtils.java
com/amazon/mShop/android/platform/dex/SecondDexEntry.java
com/amazon/mShop/android/platform/services/ProxyIntentService.java
com/amazon/mShop/android/platform/services/ProxyService.java
com/amazon/mShop/android/platform/services/ServiceDelegateBase.java
com/amazon/mShop/android/platform/services/api/IAndroidServiceDelegate.java
com/amazon/mShop/android/platform/services/api/IAndroidServiceProxy.java
com/amazon/retailsearch/android/categoryBrowse/RefinementsLoader.java
com/amazon/retailsearch/client/SearchCallInterceptor.java
com/amazon/retailsearch/metrics/MinervaLogger.java
com/amazon/retailsearch/util/UrlUtils.java
com/amazonaws/DefaultRequest.java
com/amazonaws/Request.java
com/amazonaws/auth/AWS4Signer.java
com/amazonaws/auth/AbstractAWSSigner.java
com/amazonaws/auth/ClasspathPropertiesFileCredentialsProvider.java
com/amazonaws/auth/PropertiesCredentials.java
com/amazonaws/auth/PropertiesFileCredentialsProvider.java
com/amazonaws/auth/policy/internal/JsonPolicyReader.java
com/amazonaws/auth/policy/internal/JsonPolicyWriter.java
com/amazonaws/cognito/clientcontext/datacollection/DeviceDataCollector.java
com/amazonaws/event/ProgressReportingInputStream.java
com/amazonaws/handlers/HandlerChainFactory.java
com/amazonaws/http/AmazonHttpClient.java
com/amazonaws/http/DefaultErrorResponseHandler.java
com/amazonaws/http/HttpClient.java
com/amazonaws/http/HttpRequest.java
com/amazonaws/http/HttpRequestFactory.java
com/amazonaws/http/HttpResponse.java
com/amazonaws/http/JsonErrorResponseHandler.java
com/amazonaws/http/JsonResponseHandler.java
com/amazonaws/http/StaxResponseHandler.java
com/amazonaws/http/UrlHttpClient.java
com/amazonaws/internal/CRC32MismatchException.java
com/amazonaws/internal/ReleasableInputStream.java
com/amazonaws/internal/ResettableInputStream.java
com/amazonaws/internal/SdkDigestInputStream.java
com/amazonaws/internal/SdkFilterInputStream.java
com/amazonaws/internal/SdkFilterOutputStream.java
com/amazonaws/internal/SdkInputStream.java
com/amazonaws/internal/keyvaluestore/AWSKeyValueStore.java
com/amazonaws/ivs/net/HttpUrlConnectionClient.java
com/amazonaws/ivs/net/InputStreamConsumer.java
com/amazonaws/ivs/net/OkHttpClient.java
com/amazonaws/ivs/player/MediaCodecFactory.java
com/amazonaws/ivs/player/MediaPlayer.java
com/amazonaws/metrics/AwsSdkMetrics.java
com/amazonaws/metrics/MetricFilterInputStream.java
com/amazonaws/mobile/config/AWSConfiguration.java
com/amazonaws/mobileconnectors/cognitoauth/util/AuthHttpClient.java
com/amazonaws/mobileconnectors/cognitoauth/util/LocalDataManager.java
com/amazonaws/mobileconnectors/remoteconfiguration/RemoteConfigurationManager.java
com/amazonaws/mobileconnectors/remoteconfiguration/internal/ConfigurationDb.java
com/amazonaws/mobileconnectors/remoteconfiguration/internal/net/AndroidRemoteConfigurationFetcher.java
com/amazonaws/regions/RegionMetadataParser.java
com/amazonaws/regions/RegionUtils.java
com/amazonaws/retry/PredefinedRetryPolicies.java
com/amazonaws/retry/RetryUtils.java
com/amazonaws/services/cognitoidentity/model/CognitoIdentityProvider.java
com/amazonaws/services/cognitoidentity/model/CreateIdentityPoolRequest.java
com/amazonaws/services/cognitoidentity/model/CreateIdentityPoolResult.java
com/amazonaws/services/cognitoidentity/model/Credentials.java
com/amazonaws/services/cognitoidentity/model/DeleteIdentitiesRequest.java
com/amazonaws/services/cognitoidentity/model/DeleteIdentitiesResult.java
com/amazonaws/services/cognitoidentity/model/DeleteIdentityPoolRequest.java
com/amazonaws/services/cognitoidentity/model/DescribeIdentityPoolRequest.java
com/amazonaws/services/cognitoidentity/model/DescribeIdentityPoolResult.java
com/amazonaws/services/cognitoidentity/model/DescribeIdentityRequest.java
com/amazonaws/services/cognitoidentity/model/DescribeIdentityResult.java
com/amazonaws/services/cognitoidentity/model/GetCredentialsForIdentityRequest.java
com/amazonaws/services/cognitoidentity/model/GetCredentialsForIdentityResult.java
com/amazonaws/services/cognitoidentity/model/GetIdRequest.java
com/amazonaws/services/cognitoidentity/model/GetIdResult.java
com/amazonaws/services/cognitoidentity/model/GetIdentityPoolRolesRequest.java
com/amazonaws/services/cognitoidentity/model/GetIdentityPoolRolesResult.java
com/amazonaws/services/cognitoidentity/model/GetOpenIdTokenForDeveloperIdentityRequest.java
com/amazonaws/services/cognitoidentity/model/GetOpenIdTokenForDeveloperIdentityResult.java
com/amazonaws/services/cognitoidentity/model/GetOpenIdTokenRequest.java
com/amazonaws/services/cognitoidentity/model/GetOpenIdTokenResult.java
com/amazonaws/services/cognitoidentity/model/IdentityDescription.java
com/amazonaws/services/cognitoidentity/model/IdentityPoolShortDescription.java
com/amazonaws/services/cognitoidentity/model/ListIdentitiesRequest.java
com/amazonaws/services/cognitoidentity/model/ListIdentitiesResult.java
com/amazonaws/services/cognitoidentity/model/ListIdentityPoolsRequest.java
com/amazonaws/services/cognitoidentity/model/ListIdentityPoolsResult.java
com/amazonaws/services/cognitoidentity/model/ListTagsForResourceRequest.java
com/amazonaws/services/cognitoidentity/model/ListTagsForResourceResult.java
com/amazonaws/services/cognitoidentity/model/LookupDeveloperIdentityRequest.java
com/amazonaws/services/cognitoidentity/model/LookupDeveloperIdentityResult.java
com/amazonaws/services/cognitoidentity/model/MappingRule.java
com/amazonaws/services/cognitoidentity/model/MergeDeveloperIdentitiesRequest.java
com/amazonaws/services/cognitoidentity/model/MergeDeveloperIdentitiesResult.java
com/amazonaws/services/cognitoidentity/model/RoleMapping.java
com/amazonaws/services/cognitoidentity/model/RulesConfigurationType.java
com/amazonaws/services/cognitoidentity/model/SetIdentityPoolRolesRequest.java
com/amazonaws/services/cognitoidentity/model/TagResourceRequest.java
com/amazonaws/services/cognitoidentity/model/TagResourceResult.java
com/amazonaws/services/cognitoidentity/model/UnlinkDeveloperIdentityRequest.java
com/amazonaws/services/cognitoidentity/model/UnlinkIdentityRequest.java
com/amazonaws/services/cognitoidentity/model/UnprocessedIdentityId.java
com/amazonaws/services/cognitoidentity/model/UntagResourceRequest.java
com/amazonaws/services/cognitoidentity/model/UntagResourceResult.java
com/amazonaws/services/cognitoidentity/model/UpdateIdentityPoolRequest.java
com/amazonaws/services/cognitoidentity/model/UpdateIdentityPoolResult.java
com/amazonaws/services/cognitoidentity/model/transform/CreateIdentityPoolRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/DeleteIdentitiesRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/DeleteIdentityPoolRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/DescribeIdentityPoolRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/DescribeIdentityRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/GetCredentialsForIdentityRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/GetIdRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/GetIdentityPoolRolesRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/GetOpenIdTokenForDeveloperIdentityRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/GetOpenIdTokenRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/ListIdentitiesRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/ListIdentityPoolsRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/ListTagsForResourceRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/LookupDeveloperIdentityRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/MergeDeveloperIdentitiesRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/SetIdentityPoolRolesRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/TagResourceRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/UnlinkDeveloperIdentityRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/UnlinkIdentityRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/UntagResourceRequestMarshaller.java
com/amazonaws/services/cognitoidentity/model/transform/UpdateIdentityPoolRequestMarshaller.java
com/amazonaws/services/securitytoken/model/AssumeRoleRequest.java
com/amazonaws/services/securitytoken/model/AssumeRoleResult.java
com/amazonaws/services/securitytoken/model/AssumeRoleWithSAMLRequest.java
com/amazonaws/services/securitytoken/model/AssumeRoleWithSAMLResult.java
com/amazonaws/services/securitytoken/model/AssumeRoleWithWebIdentityRequest.java
com/amazonaws/services/securitytoken/model/AssumeRoleWithWebIdentityResult.java
com/amazonaws/services/securitytoken/model/AssumedRoleUser.java
com/amazonaws/services/securitytoken/model/Credentials.java
com/amazonaws/services/securitytoken/model/DecodeAuthorizationMessageRequest.java
com/amazonaws/services/securitytoken/model/DecodeAuthorizationMessageResult.java
com/amazonaws/services/securitytoken/model/FederatedUser.java
com/amazonaws/services/securitytoken/model/GetAccessKeyInfoRequest.java
com/amazonaws/services/securitytoken/model/GetAccessKeyInfoResult.java
com/amazonaws/services/securitytoken/model/GetCallerIdentityRequest.java
com/amazonaws/services/securitytoken/model/GetCallerIdentityResult.java
com/amazonaws/services/securitytoken/model/GetFederationTokenRequest.java
com/amazonaws/services/securitytoken/model/GetFederationTokenResult.java
com/amazonaws/services/securitytoken/model/GetSessionTokenRequest.java
com/amazonaws/services/securitytoken/model/GetSessionTokenResult.java
com/amazonaws/services/securitytoken/model/PolicyDescriptorType.java
com/amazonaws/services/securitytoken/model/Tag.java
com/amazonaws/transform/StaxUnmarshallerContext.java
com/amazonaws/util/BinaryUtils.java
com/amazonaws/util/CRC32ChecksumCalculatingInputStream.java
com/amazonaws/util/ClassLoaderHelper.java
com/amazonaws/util/Classes.java
com/amazonaws/util/CountingInputStream.java
com/amazonaws/util/HttpUtils.java
com/amazonaws/util/IOUtils.java
com/amazonaws/util/LengthCheckInputStream.java
com/amazonaws/util/Md5Utils.java
com/amazonaws/util/NamespaceRemovingInputStream.java
com/amazonaws/util/ServiceClientHolderInputStream.java
com/amazonaws/util/StringInputStream.java
com/amazonaws/util/XMLWriter.java
com/amazonaws/util/XmlUtils.java
com/amazonaws/util/XpathUtils.java
com/amazonaws/util/json/AwsJsonFactory.java
com/amazonaws/util/json/AwsJsonReader.java
com/amazonaws/util/json/AwsJsonWriter.java
com/amazonaws/util/json/GsonFactory.java
com/amazonaws/util/json/JsonUtils.java
com/mypinpad/tsdk/d.java
com/mypinpad/tsdk/getDiscoveryTimeout.java
com/mypinpad/tsdk/getHapticFeedbackEnabled.java
com/mypinpad/tsdk/getProcessingTimeout.java
com/mypinpad/tsdk/gj.java
com/mypinpad/tsdk/hy.java
com/mypinpad/tsdk/i.java
com/mypinpad/tsdk/ig.java
com/mypinpad/tsdk/ik.java
com/mypinpad/tsdk/il.java
com/mypinpad/tsdk/im.java
com/mypinpad/tsdk/initialise.java
com/mypinpad/tsdk/io.java
com/mypinpad/tsdk/j.java
iq/G.java
iq/Ld.java
iq/Rk.java
iq/Rszxc.java
iq/Wueqck.java
rLdebutvkV/Aqk.java
rLdebutvkV/Gtp.java
rLdebutvkV/Tdjmyyj.java
rLdebutvkV/Tuatnz.java
rLdebutvkV/Uuicbv.java
网络通信-> NFC连接 com/mypinpad/tsdk/d.java
com/mypinpad/tsdk/ib.java
DEX-> 动态加载
调用java反射机制
一般功能-> 获取系统服务(getSystemService)
com/amazon/alexa/sdk/audio/channel/content/amp/DeviceVolumeController.java
com/amazon/alexa/sdk/audio/focus/AudioFocus.java
com/amazon/alexa/sdk/downchannel/AvsHelper.java
com/amazon/alexa/sdk/utils/AccessibilityService.java
com/amazon/alexamediaplayer/spotify/SpotifyCommander.java
com/amazon/alexamediaplayer/spotify/SpotifyGuestConnectHelper.java
com/amazon/alexamediaplayer/util/WifiLockController.java
com/amazon/android/address/lib/location/LocationManagerHandler.java
com/amazon/android/address/lib/util/LocationUtil.java
com/amazon/android/oma/hub/NotificationHubServiceImpl.java
com/amazon/ansel/fetch/LoaderContext.java
com/amazon/beauty/lipstick/vtolipstick/VTOLipstickContainerFragment.java
com/amazon/blueshift/bluefront/android/audio/AudioRecorder.java
com/amazon/blueshift/bluefront/android/audio/WakewordAudioRecorder.java
com/amazon/blueshift/bluefront/android/common/DeviceUtils.java
com/amazon/blueshift/bluefront/android/common/NetworkAnalyzer.java
com/amazon/bodylabs/camera/view/Camera2.java
com/amazon/retailsearch/android/ui/UIUtils.java
com/amazonaws/cognito/clientcontext/datacollection/DeviceDataCollector.java
com/amazonaws/cognito/clientcontext/datacollection/TelephonyDataCollector.java
com/amazonaws/ivs/net/NetworkLinkInfo.java
com/amazonaws/ivs/player/AudioFocusHandler.java
com/amazonaws/ivs/player/Platform.java
com/amazonaws/ivs/player/SurfaceRenderer.java
com/amazonaws/mobileconnectors/remoteconfiguration/internal/net/AndroidRemoteConfigurationFetcher.java
com/mypinpad/tsdk/gk$Terminal$DefaultImpls.java
com/mypinpad/tsdk/ia.java
rLdebutvkV/Tuatnz.java
一般功能-> IPC通信
com/amazon/aee/resolver/impl/AddressChangeHandler.java
com/amazon/aee/resolver/impl/DaggerEEResolverComponent.java
com/amazon/aee/resolver/impl/EEResolverModule.java
com/amazon/aee/resolver/impl/EEResolverModule_GetAddressChangeHandlerFactory.java
com/amazon/aee/resolver/impl/EEResolverModule_GetDexPackardUpdateAisContextNotificationIntentFactory.java
com/amazon/aee/resolver/impl/EEResolverModule_GetMarketplaceWillChangeHandlerFactory.java
com/amazon/aee/resolver/impl/MarketplaceWillChangeHandler.java
com/amazon/alexa/sdk/audio/channel/content/ContentChannelController.java
com/amazon/alexa/sdk/audio/channel/content/amp/service/AmpService.java
com/amazon/alexa/sdk/compat/AlexaContextCompat.java
com/amazon/alexa/sdk/notification/AlexaNotification.java
com/amazon/alexa/sdk/notification/AlexaNotificationService.java
com/amazon/alexa/sdk/orchestration/handler/RequestProcessingStartedHandler.java
com/amazon/alexa/sdk/orchestration/preprocessor/ResponseTypePreprocessor.java
com/amazon/alexa/sdk/primitives/alexaclient/directives/speechrecognizer/RequestProcessingStartedPayload.java
com/amazon/alexamediaplayer/spotify/SpotifyNetworkMonitor.java
com/amazon/android/address/lib/LocationUpdateRequestFragment.java
com/amazon/android/address/lib/PermissionRequestFragment.java
com/amazon/android/oma/badging/AppIconBadgingServiceImpl.java
com/amazon/android/oma/badging/AppIconBadgingUtils.java
com/amazon/android/oma/badging/DefaultLauncherBadging.java
com/amazon/android/oma/badging/HTCLauncherBadging.java
com/amazon/android/oma/hub/NotificationHubActivity.java
com/amazon/android/oma/hub/NotificationHubServiceImpl.java
com/amazon/android/oma/hub/api/NotificationHubService.java
com/amazon/appunique/appwidget/DiscoverActionsReceiver.java
com/amazon/appunique/appwidget/DiscoverRemoteViewsRenderer.java
com/amazon/appunique/appwidget/DiscoverWidgetBridgeReceiver.java
com/amazon/appunique/appwidget/DiscoverWidgetCardsProvider.java
com/amazon/appunique/appwidget/DiscoverWidgetProxyNavActivity.java
com/amazon/appunique/appwidget/plugins/MarketplaceListener.java
com/amazon/appunique/appwidget/plugins/UserLoginListener.java
com/amazon/bluefront/api/v2/IntentParameters.java
com/amazon/bluefront/api/v2/SpeechToIntentInputParameters.java
com/amazon/blueshift/bluefront/android/request/SpeechRequest.java
com/amazon/blueshift/bluefront/android/request/SpeechToIntentRequestBuilder.java
com/amazon/mShop/android/R.java
com/amazon/mShop/android/platform/services/IntentServiceDelegateBase.java
com/amazon/mShop/android/platform/services/ProxyIntentService.java
com/amazon/mShop/android/platform/services/ProxyService.java
com/amazon/mShop/android/platform/services/ServiceDelegateBase.java
com/amazon/mShop/android/platform/services/api/IAndroidIntentServiceDelegate.java
com/amazon/mShop/android/platform/services/api/IAndroidIntentServiceProxy.java
com/amazon/mShop/android/platform/services/api/IAndroidServiceDelegate.java
com/amazon/mShop/android/platform/services/api/IAndroidServiceProxy.java
com/amazon/retailsearch/android/api/intent/search/SearchIntentUriBuilder.java
com/amazonaws/mobileconnectors/cognitoauth/AuthClient.java
com/amazonaws/mobileconnectors/cognitoauth/activities/CustomTabsManagerActivity.java
com/amazonaws/mobileconnectors/cognitoauth/activities/CustomTabsRedirectActivity.java
com/mypinpad/tsdk/gw.java
com/mypinpad/tsdk/i.java
rLdebutvkV/V.java
进程操作-> 获取进程pid
组件-> 启动 Activity
网络通信-> HTTPS建立连接
网络通信-> OkHttpClient Connection
敏感行为-> 检测了是否被jdb调试 com/mypinpad/tsdk/ch.java
com/mypinpad/tsdk/gy.java
隐私数据-> 录制音频行为 com/amazon/blueshift/bluefront/android/audio/AudioRecordWrapper.java
com/amazon/blueshift/bluefront/android/audio/AudioRecorder.java
com/amazon/blueshift/bluefront/android/audio/WakewordAudioRecorder.java
DEX-> 加载和操作Dex文件 com/amazon/mShop/android/platform/dex/DexUtils.java
隐私数据-> 获取GPS位置信息 com/amazon/android/address/lib/location/LocationManagerHandler.java
com/amazon/android/address/lib/location/LocationServiceHandler.java
一般功能-> 获取活动网路信息
隐私数据-> 获取已安装的应用程序 com/amazon/android/oma/badging/AppIconBadgingUtils.java
com/mypinpad/tsdk/gh.java
rLdebutvkV/Aqk.java
加密解密-> Crypto加解密组件
网络通信-> HTTP建立连接
加密解密-> Base64 加密
组件-> 发送广播
加密解密-> 信息摘要算法
一般功能-> 获取WiFi相关信息 com/amazonaws/ivs/net/NetworkLinkInfo.java
设备指纹-> getSimOperator com/amazonaws/cognito/clientcontext/datacollection/TelephonyDataCollector.java
设备指纹-> 查看运营商信息 com/amazonaws/cognito/clientcontext/datacollection/TelephonyDataCollector.java
一般功能-> 加载so文件
网络通信-> TCP套接字 com/amazon/blueshift/bluefront/android/http/MultipartRequest.java
com/amazonaws/retry/RetryUtils.java
com/mypinpad/tsdk/gj.java
加密解密-> Base64 解密
进程操作-> 杀死进程
网络通信-> URLConnection com/amazon/CoralAndroidClient/Connector/DefaultHttpURLConnectionFactory.java
com/amazon/blueshift/bluefront/android/http/URLWrapper.java
隐私数据-> 拍照摄像 com/amazon/beauty/lipstick/ui/components/CameraPreviewComponent.java
com/amazon/bodylabs/camera/RNBodyLabsMLCameraModule.java
com/amazon/bodylabs/camera/view/Camera1.java
一般功能-> 获取网络接口信息 rLdebutvkV/Adaxao.java
一般功能-> 设置手机铃声,媒体音量 com/amazon/alexa/sdk/audio/channel/content/amp/DeviceVolumeController.java
命令执行-> getRuntime.exec() com/mypinpad/tsdk/getDiscoveryTimeout.java
rLdebutvkV/Gtp.java
rLdebutvkV/Uuicbv.java
网络通信-> Volley Connection com/amazon/beauty/lipstick/vtolipstick/ProductMetadataRxJavaWrapper.java
隐私数据-> 录制视频 com/amazon/bodylabs/camera/view/Camera1.java
com/amazon/bodylabs/camera/view/Camera2.java
组件-> 启动 Service
组件-> ContentProvider com/amazon/mShop/android/platform/content/ContentProviderDelegateBase.java
com/amazon/mShop/android/platform/content/ProxyContentProvider.java
com/amazon/mShop/android/platform/dex/SecondDexEntry.java

安全漏洞检测

高危
0
警告
8
信息
1
安全
2
屏蔽
0
序号 问题 等级 参考标准 文件位置 操作
1 应用程序记录日志信息,不得记录敏感信息 信息 CWE: CWE-532: 通过日志文件的信息暴露
OWASP MASVS: MSTG-STORAGE-3
升级会员:解锁高级权限
2 文件可能包含硬编码的敏感信息,如用户名、密码、密钥等 警告 CWE: CWE-312: 明文存储敏感信息
OWASP Top 10: M9: Reverse Engineering
OWASP MASVS: MSTG-STORAGE-14
升级会员:解锁高级权限
3 应用程序使用不安全的随机数生成器 警告 CWE: CWE-330: 使用不充分的随机数
OWASP Top 10: M5: Insufficient Cryptography
OWASP MASVS: MSTG-CRYPTO-6
升级会员:解锁高级权限
4 MD5是已知存在哈希冲突的弱哈希 警告 CWE: CWE-327: 使用已被攻破或存在风险的密码学算法
OWASP Top 10: M5: Insufficient Cryptography
OWASP MASVS: MSTG-CRYPTO-4
升级会员:解锁高级权限
5 此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击 安全
OWASP MASVS: MSTG-NETWORK-4
升级会员:解锁高级权限
6 SHA-1是已知存在哈希冲突的弱哈希 警告 CWE: CWE-327: 使用已被攻破或存在风险的密码学算法
OWASP Top 10: M5: Insufficient Cryptography
OWASP MASVS: MSTG-CRYPTO-4
升级会员:解锁高级权限
7 IP地址泄露 警告 CWE: CWE-200: 信息泄露
OWASP MASVS: MSTG-CODE-2
升级会员:解锁高级权限
8 此应用程序可能具有Root检测功能 安全
OWASP MASVS: MSTG-RESILIENCE-1
升级会员:解锁高级权限
9 应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库 警告 CWE: CWE-89: SQL命令中使用的特殊元素转义处理不恰当('SQL 注入')
OWASP Top 10: M7: Client Code Quality
升级会员:解锁高级权限
10 应用程序可以读取/写入外部存储器,任何应用程序都可以读取写入外部存储器的数据 警告 CWE: CWE-276: 默认权限不正确
OWASP Top 10: M2: Insecure Data Storage
OWASP MASVS: MSTG-STORAGE-2
升级会员:解锁高级权限
11 此应用程序可能会请求root(超级用户)权限 警告 CWE: CWE-250: 以不必要的权限执行
OWASP MASVS: MSTG-RESILIENCE-1
升级会员:解锁高级权限

Native库安全分析

序号 动态库 NX(堆栈禁止执行) PIE STACK CANARY(栈保护) RELRO RPATH(指定SO搜索路径) RUNPATH(指定SO搜索路径) FORTIFY(常用函数加强检查) SYMBOLS STRIPPED(裁剪符号表)
1 arm64-v8a/libHrOd.so
True
info
二进制文件设置了 NX 位。这标志着内存页面不可执行,使得攻击者注入的 shellcode 不可执行。


True
info
这个二进制文件在栈上添加了一个栈哨兵值,以便它会被溢出返回地址的栈缓冲区覆盖。这样可以通过在函数返回之前验证栈哨兵的完整性来检测溢出
Full RELRO
info
此共享对象已完全启用 RELRO。 RELRO 确保 GOT 不会在易受攻击的 ELF 二进制文件中被覆盖。在完整 RELRO 中,整个 GOT(.got 和 .got.plt 两者)被标记为只读。
None
info
二进制文件没有设置运行时搜索路径或RPATH
None
info
二进制文件没有设置 RUNPATH
True
info
二进制文件有以下加固函数: ['__strcat_chk', '__strcpy_chk', '__vsprintf_chk']
False
warning
符号可用
2 arm64-v8a/libSigVer.so
True
info
二进制文件设置了 NX 位。这标志着内存页面不可执行,使得攻击者注入的 shellcode 不可执行。


True
info
这个二进制文件在栈上添加了一个栈哨兵值,以便它会被溢出返回地址的栈缓冲区覆盖。这样可以通过在函数返回之前验证栈哨兵的完整性来检测溢出
Full RELRO
info
此共享对象已完全启用 RELRO。 RELRO 确保 GOT 不会在易受攻击的 ELF 二进制文件中被覆盖。在完整 RELRO 中,整个 GOT(.got 和 .got.plt 两者)被标记为只读。
None
info
二进制文件没有设置运行时搜索路径或RPATH
None
info
二进制文件没有设置 RUNPATH
True
info
二进制文件有以下加固函数: ['__vsprintf_chk', '__memmove_chk', '__fgets_chk', '__vsnprintf_chk', '__read_chk', '__strlen_chk']
False
warning
符号可用
3 arm64-v8a/libvalley.so
True
info
二进制文件设置了 NX 位。这标志着内存页面不可执行,使得攻击者注入的 shellcode 不可执行。


True
info
这个二进制文件在栈上添加了一个栈哨兵值,以便它会被溢出返回地址的栈缓冲区覆盖。这样可以通过在函数返回之前验证栈哨兵的完整性来检测溢出
Full RELRO
info
此共享对象已完全启用 RELRO。 RELRO 确保 GOT 不会在易受攻击的 ELF 二进制文件中被覆盖。在完整 RELRO 中,整个 GOT(.got 和 .got.plt 两者)被标记为只读。
None
info
二进制文件没有设置运行时搜索路径或RPATH
None
info
二进制文件没有设置 RUNPATH
True
info
二进制文件有以下加固函数: ['__strlen_chk', '__memmove_chk', '__vsnprintf_chk']
False
warning
符号可用

文件分析

序号 问题 文件

敏感权限分析

恶意软件常用权限 10/30
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECEIVE_SMS
android.permission.READ_SMS
android.permission.SEND_SMS
android.permission.WAKE_LOCK
android.permission.READ_PHONE_STATE
android.permission.CALL_PHONE
android.permission.VIBRATE
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.WRITE_SETTINGS
其它常用权限 8/46
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.FOREGROUND_SERVICE
android.permission.INTERNET
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.REORDER_TASKS

恶意软件常用权限 是被已知恶意软件广泛滥用的权限。
其它常用权限 是已知恶意软件经常滥用的权限。

IP地理位置

恶意域名检测

域名 状态 中国境内 位置信息 解析
arcus-uswest.amazon.com 安全
IP地址: 44.231.61.240
国家: 美利坚合众国
地区: 俄勒冈
城市: 博德曼
查看: Google 地图

device-metrics-us-2.amazon.com 安全
IP地址: 54.221.200.137
国家: 美利坚合众国
地区: 弗吉尼亚州
城市: 阿什本
查看: Google 地图

www.amazon.com 安全
IP地址: 54.230.62.214
国家: 大韩民国
地区: 京畿道
城市: 利川市
查看: Google 地图

d191e38moeep0w.cloudfront.net 安全
IP地址: 13.225.131.39
国家: 大韩民国
地区: 京畿道
城市: 利川市
查看: Google 地图

m.media-amazon.com 安全
IP地址: 13.225.117.66
国家: 大韩民国
地区: 京畿道
城市: 利川市
查看: Google 地图

images-na.ssl-images-amazon.com 安全
IP地址: 146.75.49.16
国家: 瑞典
地区: Vastra Gotalands lan
城市: 哥德堡
查看: Google 地图

device-metrics-us.amazon.com 安全
IP地址: 184.73.130.219
国家: 美利坚合众国
地区: 弗吉尼亚州
城市: 阿什本
查看: Google 地图

api.amazon.com 安全
IP地址: 209.54.177.157
国家: 美利坚合众国
地区: 弗吉尼亚州
城市: 阿什本
查看: Google 地图

www.android.com 安全
IP地址: 13.225.117.66
国家: 美利坚合众国
地区: 加利福尼亚
城市: 山景城
查看: Google 地图

d1s44l2n6n3ub3.cloudfront.net 安全
IP地址: 54.230.169.175
国家: 大韩民国
地区: 京畿道
城市: 利川市
查看: Google 地图

prod.cm.publishers.advertising.a2z.com 安全
IP地址: 146.75.49.16
国家: 美利坚合众国
地区: 俄勒冈
城市: 博德曼
查看: Google 地图

手机号提取

URL链接分析

URL信息 源码文件
https://api.amazon.com/shop
com/amazon/appunique/appwidget/aapi/AAPIClient.java
https://m.media-amazon.com/images/i/%1$s.%2$s_ac.%2$s
com/amazon/appunique/appwidget/DiscoverWidgetBridgeReceiver.java
https://images-na.ssl-images-amazon.com/images/
com/amazon/beauty/lipstick/vtolipstick/datalayer/ASIN3DModelDownloadHelper.java
28.10.0.100
com/amazon/mShop/android/BuildConfig.java
https://arcus-uswest.amazon.com
com/amazonaws/mobileconnectors/remoteconfiguration/RemoteConfigurationManager.java
https://prod.cm.publishers.advertising.a2z.com/logrecord/putlog
com/amazon/aps/shared/APSAnalytics.java
https://d1s44l2n6n3ub3.cloudfront.net/mars/arview/android/
com/amazon/beauty/lipstick/vtolipstick/tracking/LipDetectionMLModelDownloadHelper.java
https://d1s44l2n6n3ub3.cloudfront.net/arproductpreview/ibl_vtolip_filament.zip
com/amazon/beauty/lipstick/vtolipstick/staticmode/VTOLipstickStaticModeFragment.java
https://d1s44l2n6n3ub3.cloudfront.net/arproductpreview/ibl_vtolip_filament.zip
com/amazon/beauty/lipstick/vtolipstick/livemode/VTOLipstickLiveModeRepository.java
https://device-metrics-us.amazon.com:443
https://device-metrics-us-2.amazon.com:443
com/amazon/blueshift/bluefront/android/metrics/MetricsCollector.java
www.amazon.com
com/amazonaws/auth/policy/Principal.java
https://d191e38moeep0w.cloudfront.net/mshop-alexa-config-mbp-v1.json
https://d191e38moeep0w.cloudfront.net/mshop-alexa-config-v1.json
com/amazon/alexa/sdk/settings/AlexaSettingsFetcher.java
https://m.media-amazon.com/images/i/%1$s.%2$s_ac.%2$s
http://%s/status
10.0.2.2
ws://%s/debugger-proxy?role=client
http://%s/open-url
http://%s/symbolicate
10.0.1.1
10.0.3.2
https://d191e38moeep0w.cloudfront.net/mshop-alexa-config-mbp-v1.json
https://arcus-uswest.amazon.com
http://%s/open-stack-frame
https://d191e38moeep0w.cloudfront.net/mshop-alexa-config-v1.json
https://device-metrics-us-2.amazon.com:443
https://d1s44l2n6n3ub3.cloudfront.net/mars/arview/android/
http://%s/launch-js-devtools
https://device-metrics-us.amazon.com:443
https://d1s44l2n6n3ub3.cloudfront.net/arproductpreview/ibl_vtolip_filament.zip
https://prod.cm.publishers.advertising.a2z.com/logrecord/putlog
http://www.android.com/
https://api.amazon.com/shop
http://%s/%s.%s?platform=android&dev=%s&minify=%s&app=%s&modulesonly=%s&runmodule=%s
www.amazon.com
http://%s/inspector/device?name=%s&app=%s
https://images-na.ssl-images-amazon.com/images/
28.10.0.100
自研引擎-S

Firebase配置检测

邮箱地址提取

第三方追踪器

名称 类别 网址

敏感凭证泄露

已显示 15 个secrets
1、 9a50c3-a046-3805-4789-14f
2、 3082056130820349020601200123ab56300d06092a864886f70d01010b05003074311430120603550408130b4e657661646120433d5553313e303c060355040b13354a617661204f626a656374205369676e696e67204f3d416d617a6f6e205365727669636573204c4c43204c3d4c6173205665676173311c301a06035504031313416d617a6f6e2053656c662d5369676e204341301e170d3039303331333138343132365a170d3333313032333030303030305a3074311430120603550408130b4e657661646120433d5553313e303c060355040b13354a617661204f626a656374205369676e696e67204f3d416d617a6f6e205365727669636573204c4c43204c3d4c6173205665676173311c301a06035504031313416d617a6f6e205365727669636573204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ac60dafe1c962683e46a6e5b5c2945f0f1a75ef8f268f67994c3841a9366aec784ab1baf7ef8c90e95616272fbc71535a478812f872163e0c07a562c6e5acda475f12ec78212ba395ff90b21bc8c0e4ffc927cbdcec695d91c9c369481a7a230956ff3150f43e5ba307c345558095f52c8d830bfd3b29e0f4c81e7e2cf7154dc1a4ae7b6647a983079256fa507eefada8cab1c59c8220e65feee0c0f46f0c2010df8749d4011508f2ae92d73d4b16247e5f068ce826897ff6fe1986a5f296910ab402f8c9625dedd7acf40ea15f11b012f6fde1569527d7604139d3d7f072a71747c6bf0de03e4fe84fa246a9ce581f483d0922e10225e732e632e98861644bf3b5919927086a2ace441daec6bfa237d9a61ea4a529126f7d55dde74039bad8dbfa1d5c51b9c845f504b24893a2857202b1b6e9cb9f1d0746140b58c4aff193446cd20b1d0346258b33dc8ed6fc454d872e255e8cc6d357cc4483b1473adf20bba5243979b63374ae989d8c11b46a136c698c52558593bd5bbcbbad3b5c42a74a2b91387d03d952dd84090aa033cc36b20b8781713544b2a7049725f745d9d2849c9e0199ff6c27bb002831dbe4183b87caf311852bc4709134417a8f4f4887f02f2c550cfd1bcdf6bfba151aef437e4bb67aa48315224c2052bd6e2d5c2daf533e00e73816885dd30ec16f6b0c5eb5876bb2f619986ba30fbad68139c4c08c70203010001300d06092a864886f70d01010b0500038202010050c9ccc6a3ea540ba5e7a0e9723e1e92d4e250edd32b33b56b3400b9b3a9648c2a830df99040226dd223d64f68088192188f790e0a44db321f487774f119ce9f72528e57b38456b17def3a59353211fa3e3510500359e787e075007f52edf39a45cd376a7b8988910ebefb9b09c2a6ace54526a540ab50bac457e5a45e3f17acc27c2ff7beed697c403fdca64396057e4c3780e21ff47cdba1cb7579ef72ac6c0917d8dad13083d6648ba42a1af8dc5176258ea265f7aa255738a429ea6a4363ca93185fb8ae1774684c3633a6762b22f0582f844fcf4cb6fe266eb986a2ac028e5f7fc8cf99d91ac36a556a4be9ea250fa440a958e2c4f9a05387b333b947ae7a40e107a8d9dd28b327c5645f5e5fbdd114f03770970f6c288bb7c4ce690209b1c44e6839c433c2c3cceb9b2a32c98a33144ed3d323a749dec1d0ecd73e0f1bdc37fffcb89ee2c19b413f8442aeaf2aaaa2272f54ce88653bdcd5c81073f32d07907750ee75b09244c3bbb1653021574289107fb39abe22227b8825cb4fbe469b7aca007b49e3f57716cc96f0f89770254233cb4ef86b3c9d76a79e0401816ed9695c5b4728be2df38455050091a3182968bf02a7cd7a7d16995a2463116c2b76ea722cb550864146c52bebeaa39d9ad32a2da1556dc54e79d7c6a3d16756bf26c7eb499e6e369170b732c67d2ee2377d38e157f440e7c63642d581ea65dd1e
3、 08e6b9c8bdfc91895ce634a035f3d00febd36433
4、 9a04f079-9840-4286-ab92-e65be0885f95
5、 d2c4ce878f78d258ac8fdbc00005c4ed1f3f89f27458792d76ea4001e0f3cf7a
6、 30820122300d06092a864886f70d01010105000382010f003082010a0282010100db02a7da088a5fbeb8a446f905d2c43eae77c03cc0ce077ddd462aa0b2cb9ca4d53803e93f901731d8e02cc1d3a3fa1f0c86acd2107f34be3596cc77c9fb771efa208136716b09033ef9d21831561b1ca5dcb00fc0c0032f0861cbc9a34327aa26e3bca96f1377a7d1356755002dc65f53b0b8b1b52096c1e2b461b98816f899a556dc0c95459b958943e1de8dbb5ce9ad4ddeeaa0e0d62665ec0d4851df2d8f276b644f0a0545dcd3c9e56ff6c99785007aef33e229b9388622dde2106952fcd347628c443e7ec0590fb2a478595c7cb7330c1a6876e9f996a61f7fb69f79c1186324747bc8ce512860cb8bbc89f203cfc855828392abce859cb9811de4c6e10203010001
7、 edef8ba9-79d6-4ace-a3c8-27dcd51d21ed
8、 27d4dfe427b34d57995b463e5d63198d
9、 e9026ffd475a1a3691e6b2ce637a9b92aab1073ebf53a67c5f2583be8a804ecb
10、 9f25a05e-8cea-478e-ae72-299e0c6f4ced
11、 300d24441633230b092d00172b0a231e
12、 cf9b70e6-d056-4301-95f4-07cc2785f3dd
13、 35037f0b413b640f0a3a584c3d0f2755517a70434a724152791b67450d747c44
14、 0152fcf4-e49f-4db5-927f-8902f53257da
15、 a8d5b8f8-2eda-acff-80aa-e421a7b01bd8

字符串信息

建议导出为TXT,方便查看。

内容提供者列表

第三方SDK

SDK名称 开发者 描述信息

文件列表

    污点分析

    当apk较大时,代码量会很大,造成数据流图(ICFG)呈现爆炸式增长,所以该功能比较耗时,请先喝杯咖啡,耐心等待……
    规则名称 描述信息 操作
    病毒分析 使用安卓恶意软件常用的API进行污点分析 开始分析  
    漏洞挖掘 漏洞挖掘场景下的污点分析 开始分析  
    隐私合规 隐私合规场景下的污点分析:组件内污点传播、组件间污点传播、组件与库函数之间的污点传播 开始分析  
    密码分析 分析加密算法是否使用常量密钥、静态初始化的向量(IV)、加密模式是否使用ECB等 开始分析  
    Callback 因为Android中系统级的Callback并不会出现显式地进行回调方法的调用,所以如果需要分析Callback方法需要在声明文件中将其声明,这里提供一份AndroidCallbacks.txt文件,里面是一些常见的原生回调接口或类,如果有特殊接口需求,可以联系管理员 开始分析