Mobile Malware · Inside a Malicious App · Lesson 5 of 5

Challenge: The Invoice Viewer

Triage, run and report on a suspicious app found on a company phone.

The first look

Dana works on the security team at a regional delivery company. A driver tapped a link in a text about an unpaid invoice and installed an app called InvoiceView on his work phone. The phone is now isolated, and Dana has a copy of the APK in the team's analysis lab.

Before anything runs, Dana does a static triage pass. She opens the manifest, checks the signer, pulls out the readable strings, and looks at how the files are laid out. Her notes say:

• Claims to open PDF invoices.
• Permissions: INTERNET, REQUEST_INSTALL_PACKAGES, BIND_ACCESSIBILITY_SERVICE, RECEIVE_SMS.
• Signer: CN=Android Debug.
• A string pointing to https://files-cdn[.]example/update.apk.
• Most class names are one or two letters long.

Her manager asks which finding, taken alone, says the least about whether InvoiceView is malicious.

A tiny dex and a big blob

Dana also notices that classes.dex is very small, while an asset file called res.dat is several megabytes of random-looking bytes. The visible code seems to do little more than open that file.

One colleague says, "It is packed, so it is malware, case closed." Another says, "It is packed, so there is nothing more we can learn." Dana disagrees with both and writes down her plan for the next step.

Two sandbox runs

Dana's first automated run lasts 20 minutes on a standard emulator. InvoiceView shows a plain file list and makes no unusual connections.

She runs it again on a more realistic test device for several hours. This time it looks up a few random-looking domains, uploads a list of installed apps, downloads update.apk, and then contacts the same server every 60 seconds.

Searching the fleet

The company has 400 managed phones. Dana wants to check them all for InvoiceView without flooding the team with false alarms, and she wants to catch any phone that has already talked to the operators, even if the app was later removed.

She has the app's display name, package name, SHA-256 hash, signer fingerprint, the C2 domain, and the IP address of the large shared hosting provider behind it.