1

I am analyzing a mobile malware sample and got a trouble. When i put sample in JADX, i see some dollar sign. I mean like this;

What does these dollar signs means?

1
  • Can be the name of an obfuscated method. In Jadx switch to smali code and check it out. Make sure you are using the latest unstable version of Jadx, often problems are already fixed in the latest unstable version.
    – Robert
    Sep 16, 2021 at 8:25

1 Answer 1

1

I'm pretty sure you're analyzing the SOVA malware.

The $ is used for the encrypted string character buffer as a name, as well as for the function name to decrypt strings from it.

It's basically just a very short function and variable name and because they have distinct namespaces, they can be the same but be two different things.

Jadx allows you to rename the function if you wish, or as the comment suggests, enable deobfuscation and you'll get something like m123$() and f123$ instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.