Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Plague.1.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) zdwe####.com:80
- TCP zdwe####.com:2196
DNS requests:
- ms.i####.com
- ms1.i####.com
- ms2.i####.com
- zdwe####.com
HTTP GET requests:
- zdwe####.com/app/extents/NavMenu1.css
- zdwe####.com/app/extents/NavMenu1_blue.css
- zdwe####.com/app/extents/design/common.css
- zdwe####.com/app/extents/font-awesome.min.css
- zdwe####.com/app/extents/font/fontawesome-webfont.svg
- zdwe####.com/app/extents/font/fontawesome-webfont.ttf?v=####
- zdwe####.com/app/extents/fv.js
- zdwe####.com/app/extents/z/iScroll.js
- zdwe####.com/app/extents/z/min.js
- zdwe####.com/data/images/icons/c0/arow.png
- zdwe####.com/data/images/icons/c0/arrow06.png
- zdwe####.com/data/images/icons/c0/back_top_btn.gif
- zdwe####.com/data/images/icons/c0/bgindicator.png
- zdwe####.com/data/images/menu2x/215-writepage@2x.png
- zdwe####.com/disturb?next=####
- zdwe####.com/disturb?web=####
- zdwe####.com/images/menu2x//zhidian/images/cd/201404071.jpg
- zdwe####.com/images/menu2x//zhidian/images/cd/201404072.jpg
- zdwe####.com/images/menu2x//zhidian/images/cd/201404073.jpg
- zdwe####.com/images/menu2x//zhidian/images/cd/201404074.jpg
- zdwe####.com/images/menu2x/011-phone@2x.png
- zdwe####.com/images/menu2x/048-smiliehappyalt@2x.png
- zdwe####.com/images/menu2x/082-location@2x.png
- zdwe####.com/images/menu2x/269-ninecolumn@2x.png
- zdwe####.com/sites/zhidian/images/2014040710.jpg
- zdwe####.com/sites/zhidian/images/2014040711.jpg
- zdwe####.com/sites/zhidian/images/2014040712.jpg
- zdwe####.com/sites/zhidian/images/2014040713.jpg
- zdwe####.com/sites/zhidian/images/201404078.jpg
- zdwe####.com/sites/zhidian/images/201404079.jpg
- zdwe####.com/sites/zhidian/images/2014041110.png
- zdwe####.com/sites/zhidian/images/201404118.png
- zdwe####.com/sites/zhidian/images/201404119.png
- zdwe####.com/ta/pe21/css/style.css
- zdwe####.com/zghzp/_webrowser_page3.wml
- zdwe####.com/zghzp/webrowserapkver/WeBrowser
- zdwe####.com/zhidian/024-inbox@2x.png
- zdwe####.com/zhidian/077-government@2x.png
- zdwe####.com/zhidian/098-sharethis@2x.png
- zdwe####.com/zhidian/197-arrowstandard@2x.png
- zdwe####.com/zhidian/SC_usercenter
- zdwe####.com/zhidian/_webrowser_class146.wml
- zdwe####.com/zhidian/_webrowser_class6.wml
HTTP HEAD requests:
- zdwe####.com/zghzp/_webrowser_page3.wml
File system changes:
Creates the following files:
- /data/data/####/WebViewSettings.xml
- /data/data/####/classes.jar
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dbwwxkv-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Uses the following algorithms to encrypt data:
- DES-ECB-PKCS5Padding
Gets information about phone status (number, IMEI, etc.).
Gets information about running apps.
Displays its own windows over windows of other apps.
