1

I am reverse engineering an APK file. From the AndroidManifest.xml file, I found the class name (com.dfmlhsd.xecpwdugfsln.hnzpsm.KeQXGRNGu) corresponding to Main Action as shown below:

<application android:allowBackup="true" android:icon="@mipmap/ic_launcher" android:label="System Message" android:name="com.diaisde.miatsnmd.rgEnPhtA" android:supportsRtl="true" android:theme="@android:style/Theme.Translucent.NoTitleBar">
    <activity android:exported="false" android:name="com.google.android.gms.common.api.GoogleApiActivity" android:theme="@android:style/Theme.Translucent.NoTitleBar"/>
    <meta-data android:name="com.google.android.gms.version" android:value="12211000"/>
    <meta-data android:name="android.support.VERSION" android:value="26.1.0"/>
    <meta-data android:name="android.arch.lifecycle.VERSION" android:value="27.0.0-SNAPSHOT"/>
    <activity android:name="com.dfmlhsd.xecpwdugfsln.hnzpsm.KeQXGRNGu">
        <intent-filter>
            <action android:name="android.intent.action.MAIN"/>
            <category android:name="android.intent.category.LAUNCHER"/>
        </intent-filter>
    </activity>

However, when I used dex2jar to convert the APK to a JAR file and decompiled the JAR file, I don't see the above class file.

In the com folder, I can only see the packages, com.diaisde.miatsnmd and com.zeqizplcin.zeqizplcin but I can't find com.dfmlhsd.xecpwdugfsln

How do I find the relevant class files for reversing this APK?

I have uploaded the APK file here: http://www.mediafire.com/file/0c9lrbz8o4lotq7/1.zip/file

Password: infected

Please note that this is a malicious APK file, so please analyze accordingly.

Thanks.

  • 1
    are there any native libraries in the APK? btw what is supposed to be "shown below"? – Igor Skochinsky Sep 18 '18 at 14:00
  • @IgorSkochinsky: I updated the post now. It was supposed to show the AndroidManifest.xml contents. No, I don't see any ".so" files inside the APK. I think, you mean, the shared library might be loaded by the APK upon initialization and this shared library has the classes defined inside it? I only see, "classes.dex", AndroidManifest.xml, resources.arsc, images and Meta-INF inside the APK. – Neon Flash Sep 18 '18 at 15:00
  • Does dex2jar support multidex apks? My guess is no. If the apks has multiple dex files, you'll need to figure out how to run dex2jar on the secondary dex files as well. – JesusFreke Sep 18 '18 at 16:47
  • @JesusFreke As I mentioned, the APK file in this case consists only one dex file called classes.dex. If required, I can put a screenshot of the folder structure of APK as well. – Neon Flash Sep 19 '18 at 9:07
2

There are two files have "onCreate" method so I guess one of them are the one you need.

sources\android\support\zeqizplcin\zeqizplcin\WhqDcenJ.java

sources\android\support\zeqizplcin\zeqizplcin\KoBGeJtaH.java

Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.