MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 718efee62a3e13cfe598008f7df9cbab9c738dafb2457f93e1ed00bd1a407c97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Joker


Vendor detections: 4


Intelligence 4 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 718efee62a3e13cfe598008f7df9cbab9c738dafb2457f93e1ed00bd1a407c97
SHA3-384 hash: b28c83c394153e1331322ceea4011797c79b6450701b0459cbe417ed2c665f949ecd83beb9b2e73a38f838a94c5c55d8
SHA1 hash: c3b49b2e51deff34945e85c844d1bf9dc0eb78f1
MD5 hash: c64b6998cc1b9d810f06b3f75651a866
humanhash: dakota-black-summer-ack
File name:Plus+PDF+Scanner_1.0.1.xapk
Download: download sample
Signature Joker
Create hunting rule
File size:40'456'654 bytes
First seen:2026-07-11 02:19:37 UTC
Last seen:Never
File type: xapk
MIME type:application/zip
ssdeep 393216:Z9PW3SLIuTZlSxlES3C+E1vDWFVVhu/Jf3XP06eT0xOQjw7OXgL2Pn7X0Y3SKCT:fPZ/TZIXJCLZOkfX+0fjpK2Pz0Y31CT
TLSH T17797CF5EB74CA82BDDC670BD8C1A0691B17A7C042611D09B2C17B30EEDB77E60F697A1
TrID 38.4% (.SPE) SPSS Extension (30000/1/7)
25.6% (.DAZIP) Dragon Age: Origins game data (20000/1/6)
17.3% (.JAR) Java Archive (13500/1/2)
13.4% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
5.1% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter Anonymous
Tags:joker malware xapk

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a51a88d13f68731ed6b85cb
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug base64 crypto downloader evasive expand fingerprint lolbin obfuscated persistence signed
Link:
https://www.filescan.io/uploads/6a51a88019f5671cfa7b7a73/reports/ee42a1cc-fa92-4238-95cf-a59381f174ed/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/718efee62a3e13cfe598008f7df9cbab9c738dafb2457f93e1ed00bd1a407c97
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/718efee62a3e13cfe598008f7df9cbab9c738dafb2457f93e1ed00bd1a407c97/results?tab=lookup
Score:
72%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/718efee62a3e13cfe598008f7df9cbab9c738dafb2457f93e1ed00bd1a407c97
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oghp5zrkhyj47zmyachx36olvoohhdnpwjcx7e7b5ual2gsapslq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
android
Link:
https://tria.ge/reports/260711-cswmcacx9w/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/718efee62a3e13cfe598008f7df9cbab9c738dafb2457f93e1ed00bd1a407c97

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://play.google.com/store/apps/details?id=com.jpgscan.pdfjpg.pdfconvert

Comments