ID:	232039
Product:	CloudBasic
Start time:	10:08:48
Start date:	21.05.2020
Sample:	nz.govt.health.covidtracer.apk
Cookbook:	defaultandroidfilecookbook.jbs
System description:	Android 6.0
Architecture:	ANDROID
MD5:	fe1cd8e46ea487c835eea348d4100d37
SHA1:	d88facbc9c7631a4dab76ce6a48311069dbf92a6
SHA256:	b6c1f764e03709f2902bfb10ce2daa79e802bf8a7ba01e2e9ed1815efd86d645
Filetype:	Android Package (27504/1) 56.12%

Name	Type	MD5	SHA1	SHA256

Location Tracking:

Queries the phones location (GPS)

Source: androidx.appcompat.app.TwilightManager;->getLastKnownLocationForProvider:24	API Call: android.location.LocationManager.getLastKnownLocation
Source: androidx.appcompat.app.TwilightManager;->updateState:33	API Call: android.location.Location.getLatitude
Source: androidx.appcompat.app.TwilightManager;->updateState:34	API Call: android.location.Location.getLongitude
Source: androidx.appcompat.app.TwilightManager;->updateState:36	API Call: android.location.Location.getLatitude
Source: androidx.appcompat.app.TwilightManager;->updateState:37	API Call: android.location.Location.getLongitude
Source: androidx.appcompat.app.TwilightManager;->updateState:39	API Call: android.location.Location.getLatitude
Source: androidx.appcompat.app.TwilightManager;->updateState:40	API Call: android.location.Location.getLongitude
Source: androidx.core.location.LocationKt;->component1:3	API Call: android.location.Location.getLatitude
Source: androidx.core.location.LocationKt;->component2:6	API Call: android.location.Location.getLongitude

Spreading:

Accesses external storage location

Source: androidx.core.content.FileProvider;->parsePathStrategy:63	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.orhanobut.logger.CsvFormatStrategy$Builder;->build:11	API Call: android.os.Environment.getExternalStorageDirectory
Source: androidx.core.os.EnvironmentCompat;->getStorageState:2	API Call: android.os.Environment.getExternalStorageState
Source: androidx.core.os.EnvironmentCompat;->getStorageState:5	API Call: android.os.Environment.getExternalStorageDirectory
Source: androidx.core.os.EnvironmentCompat;->getStorageState:8	API Call: android.os.Environment.getExternalStorageState

Networking:

Checks an internet connection is available

Source: com.amazonaws.mobile.client.AWSMobileClient;->isNetworkAvailable:612	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.amazonaws.mobile.client.AWSMobileClient;->isNetworkAvailable:613	API Call: android.net.NetworkInfo.isConnected
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.PinpointContext;->getNetworkType:19	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.PinpointContext;->getNetworkType:20	API Call: android.net.NetworkInfo.isConnected
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.PinpointContext;->getNetworkType:21	API Call: android.net.NetworkInfo.isAvailable
Source: androidx.core.net.ConnectivityManagerCompat;->getNetworkInfoFromBroadcast:5	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: androidx.core.net.ConnectivityManagerCompat;->isActiveNetworkMetered:8	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.system.AndroidConnectivity;->determineAvailability:18	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.system.AndroidConnectivity;->determineAvailability:19	API Call: android.net.NetworkInfo.isConnectedOrConnecting
Source: com.microsoft.appcenter.utils.NetworkStateHelper;->isAnyNetworkConnected:23	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: com.microsoft.appcenter.utils.NetworkStateHelper;->isAnyNetworkConnected:24	API Call: android.net.NetworkInfo.isConnected
Source: com.microsoft.appcenter.utils.NetworkStateHelper;->isAnyNetworkConnected:26	API Call: android.net.ConnectivityManager.getAllNetworkInfo
Source: com.microsoft.appcenter.utils.NetworkStateHelper;->isAnyNetworkConnected:27	API Call: android.net.NetworkInfo.isConnected

Opens an internet connection

Source: com.amazonaws.http.UrlHttpClient;->execute:77	API Call: java.net.URL.openConnection (not executed)
Source: com.amazonaws.http.UrlHttpClient;->getUrlConnection:92	API Call: java.net.URL.openConnection (not executed)
Source: com.microsoft.appcenter.http.HttpUtils;->createHttpsConnection:17	API Call: java.net.URL.openConnection (not executed)
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase$DownloadImageTask;->doInBackground:4	API Call: java.net.URL.openConnection (not executed)
Source: com.amazonaws.mobile.client.internal.oauth2.HTTPUtil;->httpPost:6	API Call: java.net.URL.openConnection (not executed)
Source: okhttp3.internal.platform.AndroidPlatform;->connectSocket:61	API Call: java.net.Socket.connect (not executed)
Source: okhttp3.internal.platform.Platform;->connectSocket:33	API Call: java.net.Socket.connect (not executed)
Source: com.amazonaws.util.HttpUtils;->fetchFile:80	API Call: java.net.URL.openConnection (not executed)

Performs DNS lookups (Java API)

Source: com.google.gson.internal.bind.TypeAdapters$20;->read:7	API Call: java.net.InetAddress.getByName (not executed)
Source: okhttp3.Dns$Companion$DnsSystem;->lookup:4	API Call: java.net.InetAddress.getAllByName (not executed)

Urls found in memory or binary data

Source: $avd_hide_password__0.xml	String found in binary or memory: http://schemas.android.com/aapt
Source: standalone_badge_gravity_top_start.xml, mtrl_picker_header_title_text.xml, main_auth.xml, login.xml, android	String found in binary or memory: http://schemas.android.com/apk/res-auto
Source: abc_background_cache_hint_selector_material_dark.xml, $avd_hide_password__0.xml, abc_btn_radio_material_anim.xml, abc_slide_in_top.xml, mtrl_picker_header_title_text.xml, tooltip_frame_dark.xml, text_view_without_line_height.xml, mtrl_calendar_month.xml, abc_alert_dialog_button_bar_material.xml, design_layout_snackbar_include.xml, abc_activity_chooser_view.xml, abc_screen_content_include.xml, btn_checkbox_unchecked_to_checked_mtrl_animation.xml, abc_seekbar_track_material.xml, btn_checkbox_to_checked_box_outer_merged_animation.xml, abc_action_menu_item_layout.xml, test_toolbar_custom_background.xml, preference_widget_seekbar.xml, design_fab_show_motion_spec.xml, main_auth.xml, abc_alert_dialog_title_material.xml, android	String found in binary or memory: http://schemas.android.com/apk/res/android
Source: login.xml	String found in binary or memory: http://schemas.android.com/apk/res/android;;nz.govt.health.covidtracer.ui.components.ProgressButtonV
Source: baloo2_bold.ttf, baloo2_extrabold.ttf	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLBaloo
Source: opensans_light.ttf	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: opensans_light.ttf	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Digitized
Source: opensans_light.ttf	String found in binary or memory: http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed
Source: android	String found in binary or memory: http://xml.apache.org/xslt
Source: android	String found in binary or memory: https://api.tracing.covid19.govt.nz
Source: android	String found in binary or memory: https://in.appcenter.ms
Source: android	String found in binary or memory: https://plus.google.com/
Source: android	String found in binary or memory: https://tracing.covid19.govt.nz/
Source: android	String found in binary or memory: https://www.googleapis.com/auth/games
Source: android	String found in binary or memory: https://www.googleapis.com/auth/games_lite
Source: android	String found in binary or memory: https://www.health.govt.nz/NZ-COVID-Tracer/QAAs

Uses HTTP for connecting to the internet

Source: com.amazonaws.http.ApacheHttpClient;->execute:76

API Call: org.apache.http.client.HttpClient.execute

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Has permission to take photos

Source: submitted apk

Request permission: android.permission.CAMERA

E-Banking Fraud:

Has functionalty to add an overlay to other apps

Source: androidx.appcompat.app.AppCompatDelegateImpl;->openPanel:323	API Call: WindowManager.addView
Source: androidx.appcompat.widget.TooltipPopup;->show:92	API Call: WindowManager.addView

Operating System Destruction:

Lists and deletes files in the same context

Source: com.microsoft.appcenter.utils.storage.FileManager;->deleteDir:7	API Calls in same method context: File.listFiles,File.delete
Source: okhttp3.internal.io.FileSystem$Companion$SYSTEM$1;->deleteContents:25	API Calls in same method context: File.listFiles,File.delete
Source: com.microsoft.appcenter.persistence.DatabasePersistence;->deleteLogs:89	API Calls in same method context: File.listFiles,File.delete
Source: com.microsoft.appcenter.crashes.Crashes;->processMinidumpFiles:96	API Calls in same method context: File.listFiles,File.delete
Source: com.microsoft.appcenter.crashes.Crashes;->applyEnabledState:351	API Calls in same method context: File.listFiles,File.delete

Change of System Appearance:

May access the Android keyguard (lock screen)

Source: android

String found in binary or memory: keyguard

Acquires a wake lock

Source: androidx.core.app.JobIntentService$CompatWorkEnqueuer;->enqueueWork:27	API Call: android.os.PowerManager$WakeLock.acquire
Source: androidx.core.app.JobIntentService$CompatWorkEnqueuer;->serviceProcessingFinished:29	API Call: android.os.PowerManager$WakeLock.acquire
Source: androidx.core.app.JobIntentService$CompatWorkEnqueuer;->serviceProcessingStarted:33	API Call: android.os.PowerManager$WakeLock.acquire

System Summary:

Kills/terminates processes

Source: nz.govt.health.covidtracer.core.base.BaseActivity;->exit:20	API Call: android.os.Process.killProcess
Source: com.microsoft.appcenter.utils.ShutdownHelper;->shutdown:3	API Call: android.os.Process.killProcess

Requests potentially dangerous permissions

Source: submitted apk	Request permission: android.permission.CAMERA
Source: submitted apk	Request permission: android.permission.INTERNET

Classification label

Source: classification engine

Classification label: sus32.spyw.evad.andAPK@0/251@0/0

Creates SQLiteDatabase table

Source: com.microsoft.appcenter.utils.storage.SQLiteUtils;->createTable:29	API Call: android.database.sqlite.SQLiteDatabase.execSQL
Source: net.sqlcipher.database.SQLiteDatabase;->getQueryStats:520	API Call: net.sqlcipher.database.SQLiteDatabase.execSQL

Loads native libraries

Source: net.sqlcipher.database.SQLiteDatabase$1;->loadLibraries:2

API Call: java.lang.System.loadLibrary

Reads shares settings

Source: nz.govt.health.covidtracer.ui.views.auth.AuthActivity$mDestinationChangedListener$1;->onDestinationChanged:16	API Call: android.content.SharedPreferences.getBoolean
Source: nz.govt.health.covidtracer.ui.views.auth.dashboard.DashboardView$onViewCreated$6;->onClick:9	API Call: android.content.SharedPreferences.getBoolean
Source: nz.govt.health.covidtracer.ui.views.auth.dashboard.UserStatusViewModel;->getUserStatus:29	API Call: android.content.SharedPreferences.getString
Source: nz.govt.health.covidtracer.core.helpers.EncryptionHelper;->getInitializationVector:96	API Call: android.content.SharedPreferences.getString
Source: nz.govt.health.covidtracer.core.helpers.PreferencesHelper$Setting;->getStoredValue:36	API Call: android.content.SharedPreferences.getString
Source: nz.govt.health.covidtracer.core.helpers.PreferencesHelper$Setting;->getStoredValue:44	API Call: android.content.SharedPreferences.getString
Source: nz.govt.health.covidtracer.core.helpers.PreferencesHelper$Setting;->getStoredValue:54	API Call: android.content.SharedPreferences.getString
Source: nz.govt.health.covidtracer.core.helpers.EncryptionHelper;->get:183	API Call: android.content.SharedPreferences.getString
Source: nz.govt.health.covidtracer.core.helpers.PreferencesHelper$Setting;->getStoredValue:64	API Call: android.content.SharedPreferences.getString
Source: nz.govt.health.covidtracer.core.helpers.PreferencesHelper$Setting;->getStoredValue:74	API Call: android.content.SharedPreferences.getString
Source: nz.govt.health.covidtracer.core.helpers.PreferencesHelper$Setting;->getStoredValue:91	API Call: android.content.SharedPreferences.getString
Source: androidx.core.app.AppLaunchChecker;->hasStartedFromLauncher:5	API Call: android.content.SharedPreferences.getBoolean
Source: androidx.core.app.AppLaunchChecker;->onActivityCreate:9	API Call: android.content.SharedPreferences.getBoolean
Source: com.amazonaws.cognito.clientcontext.datacollection.DeviceDataCollector;->getCognitoDeviceAgent:53	API Call: android.content.SharedPreferences.getString
Source: com.hbb20.CountryCodePicker;->loadLastSelectedCountryInCCP:316	API Call: android.content.SharedPreferences.getString
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.idresolver.SharedPrefsUniqueIdService;->getLegacyId:13	API Call: android.content.SharedPreferences.getString
Source: com.google.android.gms.auth.api.signin.internal.Storage;->zaf:50	API Call: android.content.SharedPreferences.getString
Source: com.amazonaws.internal.keyvaluestore.AWSKeyValueStore;->getInitializationVector:74	API Call: android.content.SharedPreferences.getString
Source: com.amazonaws.internal.keyvaluestore.AWSKeyValueStore;->onMigrateFromNoEncryption:137	API Call: android.content.SharedPreferences.getString
Source: com.amazonaws.internal.keyvaluestore.AWSKeyValueStore;->onMigrateFromNoEncryption:147	API Call: android.content.SharedPreferences.getBoolean
Source: com.amazonaws.internal.keyvaluestore.AWSKeyValueStore;->get:222	API Call: android.content.SharedPreferences.getString
Source: com.amazonaws.internal.keyvaluestore.AWSKeyValueStore;->get:234	API Call: android.content.SharedPreferences.getString
Source: com.amazonaws.internal.keyvaluestore.KeyProvider10;->retrieveKey:64	API Call: android.content.SharedPreferences.getString
Source: com.amazonaws.internal.keyvaluestore.KeyProvider18;->retrieveKey:151	API Call: android.content.SharedPreferences.getString
Source: androidx.preference.Preference;->getPersistedBoolean:144	API Call: android.content.SharedPreferences.getBoolean
Source: androidx.preference.Preference;->getPersistedString:176	API Call: android.content.SharedPreferences.getString
Source: androidx.preference.PreferenceManager;->setDefaultValues:18	API Call: android.content.SharedPreferences.getBoolean
Source: com.microsoft.appcenter.utils.storage.SharedPreferencesManager;->getBoolean:8	API Call: android.content.SharedPreferences.getBoolean
Source: com.microsoft.appcenter.utils.storage.SharedPreferencesManager;->getString:20	API Call: android.content.SharedPreferences.getString
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.system.AndroidPreferences;->getBoolean:5	API Call: android.content.SharedPreferences.getBoolean
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.system.AndroidPreferences;->getString:13	API Call: android.content.SharedPreferences.getString
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.util.CognitoPinpointSharedContext;->getPinpointEndpoint:11	API Call: android.content.SharedPreferences.getString

Data Obfuscation:

Uses reflection

Source: nz.govt.health.covidtracer.core.helpers.SamsungSEMLeakFix;->swapActivityWithApplicationContext:13	API Call: java.lang.reflect.Field.get
Source: androidx.activity.ImmLeaksCleaner;->onStateChanged:17	API Call: java.lang.reflect.Field.get
Source: androidx.activity.ImmLeaksCleaner;->onStateChanged:19	API Call: java.lang.reflect.Field.get
Source: kotlinx.coroutines.android.AndroidExceptionPreHandler;->handleException:22	API Call: java.lang.reflect.Method.invoke
Source: kotlinx.coroutines.android.HandlerDispatcherKt;->asHandler:19	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.platform.android.AndroidSocketAdapter;->configureTlsExtensions:26	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.platform.android.AndroidSocketAdapter;->configureTlsExtensions:28	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.platform.android.AndroidSocketAdapter;->configureTlsExtensions:32	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.platform.android.AndroidSocketAdapter;->getSelectedProtocol:39	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.platform.android.CloseGuard;->createAndOpen:6	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.platform.android.CloseGuard;->createAndOpen:9	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.platform.android.CloseGuard;->warnIfOpen:12	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.app.ActivityRecreator$3;->run:8	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.app.ActivityRecreator$3;->run:13	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.app.ActivityRecreator;->queueOnStopIfNecessary:38	API Call: java.lang.reflect.Field.get
Source: androidx.core.app.ActivityRecreator;->queueOnStopIfNecessary:40	API Call: java.lang.reflect.Field.get
Source: androidx.core.app.ActivityRecreator;->recreate:53	API Call: java.lang.reflect.Field.get
Source: androidx.core.app.ActivityRecreator;->recreate:55	API Call: java.lang.reflect.Field.get
Source: androidx.core.app.ActivityRecreator;->recreate:68	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.app.BundleCompat$BundleCompatBaseImpl;->getBinder:9	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.app.BundleCompat$BundleCompatBaseImpl;->putBinder:19	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.app.NotificationCompatJellybean;->getAction:52	API Call: java.lang.reflect.Field.get
Source: androidx.core.app.NotificationCompatJellybean;->getAction:54	API Call: java.lang.reflect.Field.get
Source: androidx.core.app.NotificationCompatJellybean;->getActionObjectsLocked:86	API Call: java.lang.reflect.Field.get
Source: androidx.core.app.NotificationCompatJellybean;->getExtras:133	API Call: java.lang.reflect.Field.get
Source: androidx.core.app.NotificationManagerCompat;->areNotificationsEnabled:49	API Call: java.lang.reflect.Field.get
Source: androidx.core.app.NotificationManagerCompat;->areNotificationsEnabled:53	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.app.ActionBarDrawerToggleHoneycomb;->setActionBarDescription:11	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.app.ActionBarDrawerToggleHoneycomb;->setActionBarUpIndicator:22	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.app.ActionBarDrawerToggleHoneycomb;->setActionBarUpIndicator:25	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.app.AppCompatViewInflater$DeclaredOnClickListener;->onClick:41	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.app.ResourcesFlusher;->flushLollipops:12	API Call: java.lang.reflect.Field.get
Source: androidx.appcompat.app.ResourcesFlusher;->flushMarshmallows:23	API Call: java.lang.reflect.Field.get
Source: androidx.appcompat.app.ResourcesFlusher;->flushNougats:34	API Call: java.lang.reflect.Field.get
Source: androidx.appcompat.app.ResourcesFlusher;->flushNougats:44	API Call: java.lang.reflect.Field.get
Source: androidx.appcompat.app.ResourcesFlusher;->flushThemedResourcesCache:60	API Call: java.lang.reflect.Field.get
Source: com.microsoft.appcenter.AppCenter;->startServices:478	API Call: java.lang.reflect.Method.invoke
Source: com.google.gson.internal.bind.ReflectiveTypeAdapterFactory$1;->write:10	API Call: java.lang.reflect.Field.get
Source: com.google.android.material.chip.Chip;->handleAccessibilityExit:77	API Call: java.lang.reflect.Field.get
Source: com.google.android.material.chip.Chip;->handleAccessibilityExit:85	API Call: java.lang.reflect.Method.invoke
Source: org.threeten.bp.chrono.Chronology;->ofLocale:64	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.http.conn.ClientConnectionManagerFactory$Handler;->invoke:3	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.http.conn.ClientConnectionRequestFactory$Handler;->invoke:8	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.http.conn.ClientConnectionRequestFactory$Handler;->invoke:16	API Call: java.lang.reflect.Method.invoke
Source: kotlinx.coroutines.CommonPool;->createPool:28	API Call: java.lang.reflect.Method.invoke
Source: kotlinx.coroutines.CommonPool;->isGoodCommonPool$kotlinx_coroutines_core:73	API Call: java.lang.reflect.Method.invoke
Source: net.sqlcipher.database.SQLiteContentHelper;->getBlobColumnAsAssetFile:7	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.drawable.DrawableCompat;->getLayoutDirection:25	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.drawable.DrawableCompat;->setLayoutDirection:46	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.drawable.IconCompat;->getResId:113	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.drawable.IconCompat;->getResPackage:124	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.drawable.IconCompat;->getType:144	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.drawable.WrappedDrawableApi21;->isProjected:19	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.drawable.IconCompat;->getUri:167	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.dynamic.ObjectWrapper;->unwrap:9	API Call: java.lang.reflect.Field.get
Source: com.google.android.gms.dynamite.DynamiteModule;->getLocalVersion:28	API Call: java.lang.reflect.Field.get
Source: com.google.android.gms.dynamite.DynamiteModule;->getLocalVersion:30	API Call: java.lang.reflect.Field.get
Source: com.google.android.gms.dynamite.DynamiteModule;->zza:150	API Call: java.lang.reflect.Field.get
Source: androidx.core.graphics.TypefaceCompatApi21Impl;->addFontWeightStyle:6	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.TypefaceCompatApi21Impl;->createFromFamiliesWithDefault:14	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.TypefaceCompatApi24Impl;->addFontWeightStyle:22	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.TypefaceCompatApi24Impl;->createFromFamiliesWithDefault:28	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.TypefaceCompatApi26Impl;->abortCreation:19	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.TypefaceCompatApi28Impl;->createFromFamiliesWithDefault:9	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.TypefaceCompatApi26Impl;->addFontFromAssetManager:27	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.TypefaceCompatApi26Impl;->addFontFromBuffer:33	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.TypefaceCompatApi26Impl;->freeze:36	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.TypefaceCompatApi26Impl;->createFromFamiliesWithDefault:51	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.graphics.TypefaceCompatBaseImpl;->getUniqueKey:18	API Call: java.lang.reflect.Field.get
Source: com.google.gson.FieldAttributes;->get:4	API Call: java.lang.reflect.Field.get
Source: com.hbb20.CountryCodeDialog;->setCursorColor:179	API Call: java.lang.reflect.Field.get
Source: kotlinx.coroutines.internal.ConcurrentKt;->removeFutureOnCancel:12	API Call: java.lang.reflect.Method.invoke
Source: com.google.gson.internal.UnsafeAllocator$1;->newInstance:4	API Call: java.lang.reflect.Method.invoke
Source: com.google.gson.internal.UnsafeAllocator$2;->newInstance:3	API Call: java.lang.reflect.Method.invoke
Source: com.google.gson.internal.UnsafeAllocator$3;->newInstance:4	API Call: java.lang.reflect.Method.invoke
Source: com.google.gson.internal.UnsafeAllocator;->create:8	API Call: java.lang.reflect.Field.get
Source: com.google.gson.internal.UnsafeAllocator;->create:18	API Call: java.lang.reflect.Method.invoke
Source: kotlin.coroutines.jvm.internal.DebugMetadataKt;->getLabel:21	API Call: java.lang.reflect.Field.get
Source: kotlin.coroutines.jvm.internal.ModuleNameRetriever;->getModuleName:27	API Call: java.lang.reflect.Method.invoke
Source: kotlin.coroutines.jvm.internal.ModuleNameRetriever;->getModuleName:29	API Call: java.lang.reflect.Method.invoke
Source: kotlin.coroutines.jvm.internal.ModuleNameRetriever;->getModuleName:31	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.Util;->readFieldOrNull:314	API Call: java.lang.reflect.Field.get
Source: kotlin.internal.PlatformImplementations;->addSuppressed:7	API Call: java.lang.reflect.Method.invoke
Source: androidx.lifecycle.ClassesInfoCache$MethodReference;->invokeCallback:14	API Call: java.lang.reflect.Method.invoke
Source: androidx.lifecycle.ClassesInfoCache$MethodReference;->invokeCallback:16	API Call: java.lang.reflect.Method.invoke
Source: androidx.lifecycle.ClassesInfoCache$MethodReference;->invokeCallback:18	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.view.menu.MenuItemWrapperICS;->setExclusiveCheckable:98	API Call: java.lang.reflect.Method.invoke
Source: androidx.navigation.NavArgsLazy;->getValue:23	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->buildNotificationIcons:107	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->buildNotificationIcons:133	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->buildNotificationIcons:134	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->buildNotificationIcons:137	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->createNotification:216	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->createNotification:222	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->createNotification:224	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->createNotification:226	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->createNotification:229	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->createNotification:252	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->createNotification:254	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->createNotification:256	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->createNotification:258	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->createNotification:260	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->createNotification:262	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->registerDefaultNotificationChannel:448	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->retrieveNotificationChannel:492	API Call: java.lang.reflect.Method.invoke
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->areAppNotificationsEnabledOnPlatform:535	API Call: java.lang.reflect.Field.get
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.NotificationClientBase;->areAppNotificationsEnabledOnPlatform:567	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.os.TraceCompat;->beginAsyncSection:27	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.os.TraceCompat;->endAsyncSection:36	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.os.TraceCompat;->isEnabled:44	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.os.TraceCompat;->setCounter:53	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.platform.AndroidPlatform$CustomTrustRootIndex;->findByIssuerAndSignature:26	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.platform.Jdk8WithJettyBootPlatform$AlpnProvider;->invoke:44	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.platform.Jdk8WithJettyBootPlatform;->afterHandshake:17	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.platform.Jdk8WithJettyBootPlatform;->configureTlsExtensions:33	API Call: java.lang.reflect.Method.invoke
Source: okhttp3.internal.platform.Jdk8WithJettyBootPlatform;->getSelectedProtocol:40	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.content.pm.ShortcutManagerCompat;->getShortcutInfoSaverInstance:38	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.common.server.response.FastJsonResponse;->getFieldValue:75	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.security.ProviderInstaller;->installIfNeeded:18	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.text.ICUCompat;->addLikelySubtags:17	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.text.ICUCompat;->getScript:23	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.text.ICUCompat;->maximizeAndGetScript:31	API Call: java.lang.reflect.Method.invoke
Source: androidx.transition.CanvasUtils;->enableZ:12	API Call: java.lang.reflect.Method.invoke
Source: androidx.transition.CanvasUtils;->enableZ:15	API Call: java.lang.reflect.Method.invoke
Source: androidx.transition.GhostViewPlatform;->addGhost:5	API Call: java.lang.reflect.Method.invoke
Source: androidx.transition.GhostViewPlatform;->removeGhost:32	API Call: java.lang.reflect.Method.invoke
Source: androidx.transition.ImageViewUtils;->animateTransform:19	API Call: java.lang.reflect.Field.get
Source: androidx.transition.ViewGroupUtils;->getChildDrawingOrder:12	API Call: java.lang.reflect.Method.invoke
Source: androidx.transition.ViewGroupUtilsApi14;->cancelLayoutTransition:9	API Call: java.lang.reflect.Method.invoke
Source: androidx.transition.ViewOverlayApi14$OverlayViewGroup;->invalidateChildInParentFast:78	API Call: java.lang.reflect.Method.invoke
Source: androidx.transition.ViewUtilsBase;->setLeftTopRightBottom:50	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.common.util.WorkSourceUtil;->fromPackageAndModuleExperimentalPi:33	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.common.util.WorkSourceUtil;->fromPackageAndModuleExperimentalPi:36	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.common.util.WorkSourceUtil;->fromPackageAndModuleExperimentalPi:39	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.common.util.WorkSourceUtil;->zza:57	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.common.util.WorkSourceUtil;->zza:66	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.common.util.WorkSourceUtil;->zza:76	API Call: java.lang.reflect.Method.invoke
Source: com.google.android.gms.common.util.WorkSourceUtil;->zza:80	API Call: java.lang.reflect.Method.invoke
Source: com.microsoft.appcenter.utils.InstrumentationRegistryHelper;->getArguments:8	API Call: java.lang.reflect.Method.invoke
Source: androidx.versionedparcelable.VersionedParcel;->readFromParcel:194	API Call: java.lang.reflect.Method.invoke
Source: androidx.versionedparcelable.VersionedParcel;->writeToParcel:401	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.view.KeyEventDispatcher;->actionBarOnMenuKeyEventPre28:6	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.view.KeyEventDispatcher;->getDialogKeyListenerPre28:38	API Call: java.lang.reflect.Field.get
Source: androidx.core.view.ViewConfigurationCompat;->getLegacyScrollFactor:8	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.view.ViewCompat;->dispatchFinishTemporaryDetach:63	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.view.ViewCompat;->dispatchStartTemporaryDetach:85	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.view.ViewCompat;->getAccessibilityDelegateThroughReflection:110	API Call: java.lang.reflect.Field.get
Source: androidx.core.view.ViewCompat;->getMinimumHeight:160	API Call: java.lang.reflect.Field.get
Source: androidx.core.view.ViewCompat;->getMinimumWidth:167	API Call: java.lang.reflect.Field.get
Source: androidx.core.view.ViewCompat;->setChildrenDrawingOrderEnabled:397	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.view.SupportMenuInflater$InflatedOnMenuItemClickListener;->onMenuItemClick:21	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.view.SupportMenuInflater$InflatedOnMenuItemClickListener;->onMenuItemClick:25	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.widget.CompoundButtonCompat;->getButtonDrawable:10	API Call: java.lang.reflect.Field.get
Source: androidx.core.widget.PopupWindowCompat;->getOverlapAnchor:10	API Call: java.lang.reflect.Field.get
Source: androidx.core.widget.PopupWindowCompat;->getWindowLayoutType:19	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.widget.PopupWindowCompat;->setWindowLayoutType:40	API Call: java.lang.reflect.Method.invoke
Source: androidx.core.widget.TextViewCompat$OreoCallback;->recomputeProcessTextMenuItems:58	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.widget.AppCompatTextViewAutoSizeHelper;->accessAndReturnWithDefault:7	API Call: java.lang.reflect.Field.get
Source: androidx.appcompat.widget.DrawableUtils;->getOpticalBounds:32	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.widget.AppCompatTextViewAutoSizeHelper;->invokeAndReturnWithDefault:119	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.widget.AppCompatTextViewAutoSizeHelper;->setRawTextSize:142	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.widget.MenuPopupWindow;->setTouchModal:21	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.widget.ListPopupWindow;->getMaxAvailableHeight:123	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.widget.ListPopupWindow;->setPopupClipToScreenEnabled:139	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.widget.ListPopupWindow;->show:327	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.widget.SearchView$AutoCompleteTextViewReflector;->doAfterTextChanged:13	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.widget.SearchView$AutoCompleteTextViewReflector;->doBeforeTextChanged:15	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.widget.SearchView$AutoCompleteTextViewReflector;->ensureImeVisible:18	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.widget.ViewUtils;->computeFitSystemWindows:11	API Call: java.lang.reflect.Method.invoke
Source: androidx.appcompat.widget.ViewUtils;->makeOptionalFitsSystemWindows:23	API Call: java.lang.reflect.Method.invoke

Persistence and Installation Behavior:

Installs an application shortcut on the screen

Source: androidx.core.content.pm.ShortcutInfoCompat;->addToIntent:32

API Call: android.content.Intent.putExtra android.intent.extra.shortcut.INTENT

Creates files

Source: com.orhanobut.logger.DiskLogStrategy$WriteHandler;->handleMessage:25	API Call: java.io.FileWriter.<init>
Source: com.microsoft.appcenter.utils.storage.FileManager;->write:59	API Call: java.io.FileWriter.<init>

Boot Survival:

Installs a new wake lock (to get activate on phone screen on)

Source: androidx.core.app.JobIntentService$CompatWorkEnqueuer;-><init>:11	API Call: android.os.PowerManager.newWakeLock
Source: androidx.core.app.JobIntentService$CompatWorkEnqueuer;-><init>:19	API Call: android.os.PowerManager.newWakeLock

Hooking and other Techniques for Hiding and Protection:

Queries list of running processes/tasks

Source: com.amazonaws.mobileconnectors.pinpoint.targeting.notification.AppUtil;->isAppInForeground:5	API Call: android.app.ActivityManager.getRunningAppProcesses
Source: com.microsoft.appcenter.crashes.utils.ErrorLogHelper;->createErrorLog:21	API Call: android.app.ActivityManager.getRunningAppProcesses

Uses Crypto APIs

Source: nz.govt.health.covidtracer.core.helpers.EncryptionHelper;->decrypt:16	API Call: javax.crypto.Cipher.getInstance
Source: nz.govt.health.covidtracer.core.helpers.EncryptionHelper;->decrypt:17	API Call: javax.crypto.Cipher.init
Source: nz.govt.health.covidtracer.core.helpers.EncryptionHelper;->decrypt:18	API Call: javax.crypto.Cipher.doFinal
Source: nz.govt.health.covidtracer.core.helpers.EncryptionHelper;->encrypt:26	API Call: javax.crypto.Cipher.getInstance
Source: nz.govt.health.covidtracer.core.helpers.EncryptionHelper;->encrypt:27	API Call: javax.crypto.Cipher.init
Source: nz.govt.health.covidtracer.core.helpers.EncryptionHelper;->encrypt:34	API Call: javax.crypto.Cipher.doFinal
Source: nz.govt.health.covidtracer.core.helpers.EncryptionHelper;->generateKey:154	API Call: javax.crypto.KeyGenerator.generateKey
Source: com.amazonaws.auth.AbstractAWSSigner$1;->initialValue:4	API Call: java.security.MessageDigest.getInstance
Source: com.amazonaws.auth.AbstractAWSSigner;->doHash:9	API Call: java.security.MessageDigest.update
Source: com.amazonaws.auth.AbstractAWSSigner;->doHash:10	API Call: java.security.MessageDigest.digest
Source: com.amazonaws.auth.AbstractAWSSigner;->hash:120	API Call: java.security.MessageDigest.digest
Source: com.amazonaws.auth.AbstractAWSSigner;->hash:130	API Call: java.security.MessageDigest.getInstance
Source: com.amazonaws.auth.AbstractAWSSigner;->hash:131	API Call: java.security.MessageDigest.update
Source: com.amazonaws.auth.AbstractAWSSigner;->hash:132	API Call: java.security.MessageDigest.digest
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.CognitoUser$AuthenticationHelper$1;->initialValue:4	API Call: java.security.MessageDigest.getInstance
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.CognitoUser$AuthenticationHelper;-><clinit>:12	API Call: java.security.MessageDigest.update
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.CognitoUser$AuthenticationHelper;-><clinit>:15	API Call: java.security.MessageDigest.digest
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.CognitoUser$AuthenticationHelper;->getPasswordAuthenticationKey:41	API Call: java.security.MessageDigest.update
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.CognitoUser$AuthenticationHelper;->getPasswordAuthenticationKey:43	API Call: java.security.MessageDigest.digest
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.CognitoUser$AuthenticationHelper;->getPasswordAuthenticationKey:51	API Call: java.security.MessageDigest.update
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.CognitoUser$AuthenticationHelper;->getPasswordAuthenticationKey:54	API Call: java.security.MessageDigest.update
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.CognitoUser$AuthenticationHelper;->getPasswordAuthenticationKey:58	API Call: java.security.MessageDigest.update
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.CognitoUser$AuthenticationHelper;->getPasswordAuthenticationKey:61	API Call: java.security.MessageDigest.digest
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.CognitoUser$AuthenticationHelper;->getPasswordAuthenticationKey:64	API Call: java.security.MessageDigest.update
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.CognitoUser$AuthenticationHelper;->getPasswordAuthenticationKey:65	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.common.zzm;->zzc:11	API Call: java.security.MessageDigest.digest
Source: com.microsoft.appcenter.utils.crypto.CryptoUtils$1$1;->generateKey:3	API Call: javax.crypto.KeyGenerator.generateKey
Source: com.microsoft.appcenter.utils.crypto.CryptoUtils$1$2;->doFinal:3	API Call: javax.crypto.Cipher.doFinal
Source: com.microsoft.appcenter.utils.crypto.CryptoUtils$1$2;->doFinal:5	API Call: javax.crypto.Cipher.doFinal
Source: com.microsoft.appcenter.utils.crypto.CryptoUtils$1$2;->init:16	API Call: javax.crypto.Cipher.init
Source: com.microsoft.appcenter.utils.crypto.CryptoUtils$1$2;->init:18	API Call: javax.crypto.Cipher.init
Source: com.microsoft.appcenter.utils.crypto.CryptoUtils$1;->getCipher:2	API Call: javax.crypto.Cipher.getInstance
Source: com.amazonaws.internal.keyvaluestore.AWSKeyValueStore;->decrypt:9	API Call: javax.crypto.Cipher.getInstance
Source: com.amazonaws.internal.keyvaluestore.AWSKeyValueStore;->decrypt:10	API Call: javax.crypto.Cipher.init
Source: com.amazonaws.internal.keyvaluestore.AWSKeyValueStore;->decrypt:11	API Call: javax.crypto.Cipher.doFinal
Source: com.amazonaws.internal.keyvaluestore.AWSKeyValueStore;->encrypt:18	API Call: javax.crypto.Cipher.getInstance
Source: com.amazonaws.internal.keyvaluestore.AWSKeyValueStore;->encrypt:19	API Call: javax.crypto.Cipher.init
Source: com.amazonaws.internal.keyvaluestore.AWSKeyValueStore;->encrypt:22	API Call: javax.crypto.Cipher.doFinal
Source: com.amazonaws.internal.keyvaluestore.KeyProvider10;->generateKey:21	API Call: javax.crypto.KeyGenerator.generateKey
Source: com.amazonaws.internal.keyvaluestore.KeyProvider10;->generateKey:22	API Call: javax.crypto.KeyGenerator.generateKey
Source: com.amazonaws.internal.keyvaluestore.KeyProvider18;->rsaDecrypt:9	API Call: javax.crypto.Cipher.getInstance
Source: com.amazonaws.internal.keyvaluestore.KeyProvider18;->rsaDecrypt:11	API Call: javax.crypto.Cipher.init
Source: com.amazonaws.internal.keyvaluestore.KeyProvider18;->rsaDecrypt:12	API Call: javax.crypto.Cipher.doFinal
Source: com.amazonaws.internal.keyvaluestore.KeyProvider18;->rsaEncrypt:22	API Call: javax.crypto.Cipher.getInstance
Source: com.amazonaws.internal.keyvaluestore.KeyProvider18;->rsaEncrypt:25	API Call: javax.crypto.Cipher.init
Source: com.amazonaws.internal.keyvaluestore.KeyProvider18;->rsaEncrypt:26	API Call: javax.crypto.Cipher.doFinal
Source: com.amazonaws.internal.keyvaluestore.KeyProvider18;->generateKey:91	API Call: javax.crypto.KeyGenerator.generateKey
Source: com.amazonaws.internal.keyvaluestore.KeyProvider23;->generateKey:32	API Call: javax.crypto.KeyGenerator.generateKey
Source: okio.Buffer;->digest:5	API Call: java.security.MessageDigest.getInstance
Source: okio.Buffer;->digest:8	API Call: java.security.MessageDigest.update
Source: okio.Buffer;->digest:12	API Call: java.security.MessageDigest.update
Source: okio.Buffer;->digest:15	API Call: java.security.MessageDigest.digest
Source: okio.ByteString;->digest$okio:76	API Call: java.security.MessageDigest.getInstance
Source: okio.ByteString;->digest$okio:78	API Call: java.security.MessageDigest.digest
Source: okio.HashingSink;-><init>:7	API Call: java.security.MessageDigest.getInstance
Source: okio.HashingSink;->hash:36	API Call: java.security.MessageDigest.digest
Source: okio.HashingSource;-><init>:7	API Call: java.security.MessageDigest.getInstance
Source: okio.HashingSink;->write:52	API Call: java.security.MessageDigest.update
Source: okio.HashingSource;->hash:36	API Call: java.security.MessageDigest.digest
Source: okio.HashingSource;->read:55	API Call: java.security.MessageDigest.update
Source: okio.SegmentedByteString;->digest$okio:24	API Call: java.security.MessageDigest.getInstance
Source: okio.SegmentedByteString;->digest$okio:29	API Call: java.security.MessageDigest.update
Source: okio.SegmentedByteString;->digest$okio:30	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.common.util.AndroidUtilsLight;->getPackageCertificateHashBytes:12	API Call: java.security.MessageDigest.digest
Source: com.google.android.gms.common.util.AndroidUtilsLight;->zzj:13	API Call: java.security.MessageDigest.getInstance
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.util.CognitoDeviceHelper$deviceSRP$1;->initialValue:4	API Call: java.security.MessageDigest.getInstance
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.util.CognitoDeviceHelper$deviceSRP;->end:26	API Call: java.security.MessageDigest.digest
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.util.CognitoDeviceHelper$deviceSRP;->update:35	API Call: java.security.MessageDigest.update
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.util.CognitoDeviceHelper$deviceSRP;->update:39	API Call: java.security.MessageDigest.update
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.util.CognitoDeviceHelper$deviceSRP;->update:43	API Call: java.security.MessageDigest.update
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.util.CognitoDeviceHelper$deviceSRP;->update:46	API Call: java.security.MessageDigest.update
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.util.CognitoDeviceHelper$deviceSRP;->update:51	API Call: java.security.MessageDigest.update
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.util.CognitoDeviceHelper$deviceSRP;->update:55	API Call: java.security.MessageDigest.update
Source: com.amazonaws.util.Md5Utils;->computeMD5Hash:7	API Call: java.security.MessageDigest.getInstance
Source: com.amazonaws.util.Md5Utils;->computeMD5Hash:9	API Call: java.security.MessageDigest.update
Source: com.amazonaws.util.Md5Utils;->computeMD5Hash:10	API Call: java.security.MessageDigest.digest
Source: com.amazonaws.util.Md5Utils;->computeMD5Hash:27	API Call: java.security.MessageDigest.getInstance
Source: com.amazonaws.util.Md5Utils;->computeMD5Hash:28	API Call: java.security.MessageDigest.digest
Source: com.microsoft.appcenter.utils.HashUtils;->sha256:9	API Call: java.security.MessageDigest.getInstance
Source: com.microsoft.appcenter.utils.HashUtils;->sha256:11	API Call: java.security.MessageDigest.update
Source: com.microsoft.appcenter.utils.HashUtils;->sha256:12	API Call: java.security.MessageDigest.digest

Malware Analysis System Evasion:

Accesses android OS build fields

Source: nz.govt.health.covidtracer.core.helpers.SamsungSEMLeakFix;->applyFix:22	Field Access: android.os.Build.MANUFACTURER
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:12	Field Access: android.os.Build.BOARD
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:17	Field Access: android.os.Build.BRAND
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:22	Field Access: android.os.Build.CPU_ABI
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:27	Field Access: android.os.Build.DEVICE
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:32	Field Access: android.os.Build.DISPLAY
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:37	Field Access: android.os.Build.FINGERPRINT
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:42	Field Access: android.os.Build.HOST
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:47	Field Access: android.os.Build.ID
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:52	Field Access: android.os.Build.MANUFACTURER
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:57	Field Access: android.os.Build.MODEL
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:62	Field Access: android.os.Build.PRODUCT
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:67	Field Access: android.os.Build.TAGS
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:76	Field Access: android.os.Build.TYPE
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:81	Field Access: android.os.Build.USER
Source: com.google.zxing.client.android.camera.CameraConfigurationUtils;->collectStats:96	Field Access: android.os.Build$VERSION.RELEASE
Source: com.amazonaws.cognito.clientcontext.datacollection.BuildDataCollector;->collect:3	Field Access: android.os.Build.BRAND
Source: com.amazonaws.cognito.clientcontext.datacollection.BuildDataCollector;->collect:6	Field Access: android.os.Build.FINGERPRINT
Source: com.amazonaws.cognito.clientcontext.datacollection.BuildDataCollector;->collect:12	Field Access: android.os.Build.MODEL
Source: com.amazonaws.cognito.clientcontext.datacollection.BuildDataCollector;->collect:15	Field Access: android.os.Build.PRODUCT
Source: com.amazonaws.cognito.clientcontext.datacollection.BuildDataCollector;->collect:18	Field Access: android.os.Build.TYPE
Source: com.amazonaws.cognito.clientcontext.datacollection.BuildDataCollector;->collect:21	Field Access: android.os.Build$VERSION.RELEASE
Source: com.amazonaws.cognito.clientcontext.datacollection.BuildDataCollector;->collect:24	Field Access: android.os.Build$VERSION.SDK
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.endpointProfile.EndpointProfileDemographic;-><init>:3	Field Access: android.os.Build.MODEL
Source: com.amazonaws.mobileconnectors.pinpoint.targeting.endpointProfile.EndpointProfileDemographic;-><init>:7	Field Access: android.os.Build$VERSION.RELEASE
Source: com.google.android.material.internal.ManufacturerUtils;->isSamsungDevice:2	Field Access: android.os.Build.MANUFACTURER
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.system.AndroidDeviceDetails;->manufacturer:5	Field Access: android.os.Build.MANUFACTURER
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.system.AndroidDeviceDetails;->model:6	Field Access: android.os.Build.MODEL
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.system.AndroidDeviceDetails;->platformVersion:8	Field Access: android.os.Build$VERSION.RELEASE
Source: com.google.android.material.textfield.TextInputEditText;->onAttachedToWindow:16	Field Access: android.os.Build.MANUFACTURER
Source: com.google.android.gms.common.util.DeviceProperties;->isUserBuild:48	Field Access: android.os.Build.TYPE
Source: com.amazonaws.mobileconnectors.cognitoidentityprovider.util.CognitoDeviceHelper;->getDeviceName:82	Field Access: android.os.Build.MODEL
Source: com.microsoft.appcenter.crashes.utils.ErrorLogHelper;->getArchitecture:64	Field Access: android.os.Build.CPU_ABI
Source: com.microsoft.appcenter.utils.DeviceInfoHelper;->getDeviceInfo:27	Field Access: android.os.Build.MODEL
Source: com.microsoft.appcenter.utils.DeviceInfoHelper;->getDeviceInfo:29	Field Access: android.os.Build.MANUFACTURER
Source: com.microsoft.appcenter.utils.DeviceInfoHelper;->getDeviceInfo:35	Field Access: android.os.Build$VERSION.RELEASE
Source: com.microsoft.appcenter.utils.DeviceInfoHelper;->getDeviceInfo:37	Field Access: android.os.Build.ID

Potential date aware sample found

Source: com.microsoft.appcenter.utils.crypto.CryptoUtils;->registerHandler:63

API Call: java.util.Date.after

Queries several sensitive phone informations

Source: Lcom/microsoft/appcenter/ingestion/models/one/Extensions;->read(Lorg/json/JSONObject;)V	Method string: "os"
Source: Landroidx/core/view/ViewConfigurationCompat;->shouldShowMenuShortcutsWhenKeyboardPresent(Landroid/view/ViewConfiguration;Landroid/content/Context;)Z	Method string: "android"
Source: Lkotlin/reflect/KTypeProjection$Companion;->invariant(Lkotlin/reflect/KType;)Lkotlin/reflect/KTypeProjection;	Method string: "type"
Source: Lcom/microsoft/appcenter/ingestion/models/AbstractLog;->write(Lorg/json/JSONStringer;)V	Method string: "sid"
Source: Lnz/govt/health/covidtracer/core/modules/api/ApiModule;->sendUpdatePersonalDetails(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Lkotlin/jvm/functions/Function1;)V	Method string: "phone"
Source: Lnz/govt/health/covidtracer/models/aws/PinpointConfig;->copy(Ljava/lang/String;Ljava/lang/String;)Lnz/govt/health/covidtracer/models/aws/PinpointConfig;	Method string: "appid"
Source: Lcom/microsoft/appcenter/ingestion/models/Device;->read(Lorg/json/JSONObject;)V	Method string: "model"
Source: Lorg/threeten/bp/LocalDateTime;->of(Lorg/threeten/bp/LocalDate;Lorg/threeten/bp/LocalTime;)Lorg/threeten/bp/LocalDateTime;	Method string: "time"
Source: Lcom/microsoft/appcenter/ingestion/models/one/Extensions;->read(Lorg/json/JSONObject;)V	Method string: "sdk"

Language, Device and Operating System Detection:

Queries the SIM provider ISO country code

Source: com.amazonaws.cognito.clientcontext.datacollection.TelephonyDataCollector;->collect:25	API Call: android.telephony.TelephonyManager.getSimCountryIso
Source: com.hbb20.CountryCodePicker;->detectSIMCountry:474	API Call: android.telephony.TelephonyManager.getSimCountryIso

Queries the SIM provider name (SPN - Service Provider Name)

Source: com.amazonaws.cognito.clientcontext.datacollection.TelephonyDataCollector;->collect:29

API Call: android.telephony.TelephonyManager.getSimOperatorName

Queries the network operator ISO country code

Source: com.hbb20.CountryCodePicker;->detectNetworkCountry:462	API Call: android.telephony.TelephonyManager.getNetworkCountryIso
Source: com.microsoft.appcenter.utils.DeviceInfoHelper;->getDeviceInfo:15	API Call: android.telephony.TelephonyManager.getNetworkCountryIso

Queries the network operator name

Source: com.amazonaws.cognito.clientcontext.datacollection.TelephonyDataCollector;->collect:13	API Call: android.telephony.TelephonyManager.getNetworkOperatorName
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.system.AndroidSystem;->getCarrier:16	API Call: android.telephony.TelephonyManager.getNetworkOperatorName
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.system.AndroidSystem;->getCarrier:17	API Call: android.telephony.TelephonyManager.getNetworkOperatorName
Source: com.amazonaws.mobileconnectors.pinpoint.internal.core.system.AndroidSystem;->getCarrier:20	API Call: android.telephony.TelephonyManager.getNetworkOperatorName
Source: com.microsoft.appcenter.utils.DeviceInfoHelper;->getDeviceInfo:18	API Call: android.telephony.TelephonyManager.getNetworkOperatorName

Stealing of Sensitive Information:

Uses accessibility services (likely to control other applications)

Source: androidx.core.view.accessibility.AccessibilityNodeInfoCompat;->findAccessibilityNodeInfosByText:162

API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText

Checks if a SIM card is installed

Source: com.amazonaws.cognito.clientcontext.datacollection.TelephonyDataCollector;->collect:24

API Call: android.telephony.TelephonyManager.getSimState

Queries camera information

Source: nz.govt.health.covidtracer.ui.components.camera.CameraFeedLegacy;->getCameraDisplayOrientation:14	API Call: android.hardware.Camera.getCameraInfo
Source: nz.govt.health.covidtracer.ui.components.camera.CameraFeedLegacy;->getCameraId:27	API Call: android.hardware.Camera.getNumberOfCameras
Source: nz.govt.health.covidtracer.ui.components.camera.CameraFeedLegacy;->getCameraId:28	API Call: android.hardware.Camera.getCameraInfo
Source: nz.govt.health.covidtracer.ui.components.camera.CameraFeedLegacy;->setUpSurfaceTexture:31	API Call: android.hardware.Camera.open

Queries stored mail and application accounts (e.g. Gmail or Whatsup)

Source: com.google.android.gms.common.internal.ClientSettings;->getAccountName:20	API Call: android.accounts.Account.name
Source: com.google.android.gms.signin.internal.SignInClientImpl;->zaa:74	API Call: android.accounts.Account.name
Source: com.google.android.gms.auth.api.signin.GoogleSignInAccount;->createDefault:9	API Call: android.accounts.Account.name
Source: com.google.android.gms.auth.api.signin.GoogleSignInAccount;->createDefault:11	API Call: android.accounts.Account.name
Source: com.google.android.gms.auth.api.signin.GoogleSignInOptions;->zad:78	API Call: android.accounts.Account.name

Remote Access Functionality:

Found suspicious command strings (may be related to BOT commands)

Source: Landroidx/recyclerview/widget/RecyclerView$Recycler;->recycleViewHolderInternal(Landroidx/recyclerview/widget/RecyclerView$ViewHolder;)V	Method string: "trying to recycle an ignored view holder. you should first call stopignoringview(view) before calling recycle."
Source: Lkotlin/ranges/RangesKt___RangesKt;->reversed(Lkotlin/ranges/LongProgression;)Lkotlin/ranges/LongProgression;	Method string: "$this$reversed"
Source: Landroidx/recyclerview/widget/RecyclerView$Recycler;->recycleViewHolderInternal(Landroidx/recyclerview/widget/RecyclerView$ViewHolder;)V	Instruction: "const-string v1, "trying to recycle an ignored view holder. you should first call stopignoringview(view) before calling recycle.""
Source: Lkotlin/collections/ArraysKt___ArraysKt;->sortDescending([S)V	Instruction: "lkotlin/collections/arrayskt;->reverse([s)v"
Source: Lnz/govt/health/covidtracer/core/modules/auth/AuthenticationModule;->initialiseAnalytics()Lcom/amazonaws/mobileconnectors/pinpoint/PinpointManager;	Instruction: "iget-object v0, p0, lnz/govt/health/covidtracer/core/modules/auth/authenticationmodule;->_pinpointmanager:lcom/amazonaws/mobileconnectors/pinpoint/pinpointmanager;"