## File Hashes

```
SHA256 (XAPK):
0fbe534a0d41e49612d89c767b7a818c2ece1d62320aca03e612e5753a659928

File Timestamps:
All files: Dec 31, 1979 (Unix timestamp manipulation)
```

---

## Package Information

```
Package Name: app.astrodummy.android
Application ID: 264
User ID: 13
Client ID: 10003628
Internal Name: SamplecustomApp2
Platform: AppMySite (WordPress-to-mobile converter)
Created: 2023-05-16T13:05:23.791Z
Updated: 2023-05-23T06:07:34.616Z
```

---

## Exposed API Keys & Credentials

### 1. Sentry DSN (Crash Reporting)
**Location:** `AndroidManifest.xml:65`
```xml
<meta-data
    android:name="io.sentry.dsn"
    android:value="https://8d1fa268d0b140549112307aae2f5b0b@o4504772588535808.ingest.sentry.io/4504841286057984"/>
```

**Sentry Configuration:**
```xml
<meta-data android:name="io.sentry.attach-screenshot" android:value="true"/>
<meta-data android:name="io.sentry.attach-view-hierarchy" android:value="true"/>
<meta-data android:name="io.sentry.traces.sample-rate" android:value="1.0"/>
<meta-data android:name="io.sentry.traces.profiling.sample-rate" android:value="1.0"/>
```

### 2. Google Ads Application ID
**Location:** `AndroidManifest.xml:71`
```xml
<meta-data
    android:name="com.google.android.gms.ads.APPLICATION_ID"
    android:value="ca-app-pub-3160617209434024~6057708477"/>
```

### 3. Google Maps API Key
**Location:** `AndroidManifest.xml:73`
```xml
<meta-data
    android:name="com.google.android.geo.API_KEY"
    android:value="AIzaSyC6nwdv0CAV9mWS0NU2cI7pv5ooeXQgwrg"/>
```

### 4. Facebook App ID
**Location:** `res/values/strings.xml`
```xml
<string name="facebook_app_id">454532105165574</string>
```
**Manifest Reference:** `AndroidManifest.xml:74-75`

### 5. Pusher WebSocket API Keys
**Location:** `app/astrodummy/android/services/LoginService.java:57`
```java
final b bVar = new b(
    !l.a(e.f3269u, "live") ?
        "422f30e59bee74b8578d" :  // Non-live key
        "2ef6a31c84b594470a20",   // Live key
    cVar
);
```

**Pusher Host:** `ws-mt1.pusher.com`
**Port:** 443 (WSS), 80 (WS fallback)

### 6. Hardcoded Client Credentials
**Location:** `bd/e.java:51-80`
```java
public static String A = "g53E32QhURdGMzfnUK4LduW0bqQ58h0a6FvivHc5";
public static String f3272x = "10628900";
public static String f3273y = "rPK8ko8TDgh7zVio8jeScKxaVpqLf4dkCFHKeqok";
public static String f3274z = "10322485";
```

---

## Network Endpoints

### Primary Backend APIs
**Location:** `a6/c.java:145-175`

**Environment Routing:**
```java
switch (str.hashCode()) {
    case 99349: // "dev"
        bd.e.r = "https://custom.api.appmysite.com/api/";
        bd.e.f3268s = "https://admin.appmysite.com/api/";
        bd.e.t = "https://dev.app.appmysite.com/";
        break;
    case 3322092: // "live"
        bd.e.r = "https://custom.api.appmysite.com/api/";
        bd.e.f3268s = "https://admin.appmysite.com/api/";
        bd.e.t = "https://app.appmysite.com/";
        break;
    case 3556498: // "test"
        bd.e.r = "https://custom.api.appmysite.com/api/";
        bd.e.f3268s = "https://admin.appmysite.com/api/";
        bd.e.t = "https://test.app.appmysite.com/";
        break;
    case 109757182: // "stage"
        bd.e.r = "https://custom.api.appmysite.com/api/";
        bd.e.f3268s = "https://admin.appmysite.com/api/";
        bd.e.t = "https://stage.app.appmysite.com/";
        break;
}
```

**Active Environment:** `live` (default)

### CDN Endpoint
**Location:** `assets/default.json:458`
```json
"aws_url": "https://d33cfg8bjlyn3i.cloudfront.net"
```

### Pusher WebSocket
```
Host: ws-mt1.pusher.com
Protocol: WebSocket (WSS on 443, WS on 80)
Channel Pattern: "AppMySite" + ANDROID_ID
Event: "App/Events/Senddatatoapp"
```

---

## Critical Code Snippets

### 1. Remote Credential Delivery (LoginService)
**File:** `app/astrodummy/android/services/LoginService.java`
**Lines:** 48-136

**WebSocket Connection Setup:**
```java
@Override
public final int onStartCommand(Intent intent, int i5, int i10) {
    c.g("Inside the Login Service----------");

    // Get device ANDROID_ID
    l.e(Settings.Secure.getString(
        getApplicationContext().getContentResolver(),
        "android_id"), "UDID");

    // Configure WebSocket
    ef.c cVar = new ef.c();
    cVar.b();
    cVar.f6819c = 443;
    cVar.f6818b = 80;
    cVar.f6820d = true;
    cVar.f6817a = "ws-mt1.pusher.com";

    // Create Pusher client with API key
    final b bVar = new b(
        !l.a(e.f3269u, "live") ?
            "422f30e59bee74b8578d" :
            "2ef6a31c84b594470a20",
        cVar
    );

    bVar.b(new g6.c(bVar), hf.b.ALL);
    bVar.a();

    // Subscribe to device-specific channel
    String b10 = com.google.android.gms.ads.internal.client.a.b(
        "AppMySite",
        Settings.Secure.getString(
            getApplicationContext().getContentResolver(),
            "android_id")
    );

    // ... channel subscription code ...
}
```

**Credential Reception Handler:**
```java
ff.e eVar = new ff.e() {
    @Override
    public final void c(ff.d dVar) {
        try {
            // Parse received JSON
            PusherResponse pusherResponse = (PusherResponse) new Gson()
                .fromJson(dVar.a().toString(), PusherResponse.class);

            // Extract access token
            String str2 = RequestConfiguration.MAX_AD_CONTENT_RATING_UNSPECIFIED;
            if (pusherResponse != null &&
                (token = pusherResponse.getToken()) != null &&
                (accessToken = token.getAccessToken()) != null) {
                str2 = accessToken;
            }

            // Store in static variable
            bd.e.C = str2;

            // Store in SharedPreferences (PLAINTEXT)
            SharedPreferences.Editor edit = loginService
                .getSharedPreferences("CMS_SHARED_PREFERENCES", 0)
                .edit();
            edit.putString("admin_token", str2);
            edit.apply();

            // Launch AuthActivity with token
            intent2.setFlags(335544320);
            loginService.startActivity(intent2);
            loginService.stopForeground(true);
        } catch (Exception e10) {
            e10.printStackTrace();
        }
    }
};
```

### 2. Duplicate Background Worker
**File:** `app/astrodummy/android/services/WorkerClass.java`
**Lines:** 37-118

**Identical WebSocket Logic:**
```java
@Override
public final o.a doWork() {
    // Get ANDROID_ID
    l.e(Settings.Secure.getString(
        getApplicationContext().getContentResolver(),
        "android_id"), "UDID");

    // Same Pusher configuration as LoginService
    c cVar = new c();
    cVar.b();
    cVar.f6819c = 443;
    cVar.f6818b = 80;
    cVar.f6820d = true;
    cVar.f6817a = "ws-mt1.pusher.com";

    final b bVar = new b(
        !l.a(e.f3269u, "live") ?
            "422f30e59bee74b8578d" :
            "2ef6a31c84b594470a20",
        cVar
    );

    // ... identical credential reception and storage ...

    // Store both token and token type
    SharedPreferences.Editor edit = context
        .getSharedPreferences("CMS_SHARED_PREFERENCES", 0)
        .edit();
    edit.putString("admin_token", str4);
    edit.apply();

    SharedPreferences.Editor edit2 = context
        .getSharedPreferences("CMS_SHARED_PREFERENCES", 0)
        .edit();
    edit2.putString("admin_token_type", str5);
    edit2.apply();

    return new o.a.c();
}
```

### 3. Device Identifier Collection
**File:** `app/astrodummy/android/MainActivity.java`
**Lines:** 102-104

```java
String string = Settings.Secure.getString(
    getContentResolver(),
    "android_id"
);
l.e(string, "getString(contentResolve…ttings.Secure.ANDROID_ID)");
e.f3271w = string;
```

### 4. Network Security Configuration
**File:** `res/xml/network_security_config.xml`
**Lines:** 1-10

```xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
            <certificates src="user" />
            <certificates src="@raw/cloudflare" />
        </trust-anchors>
    </base-config>
</network-security-config>
```

**Manifest Declaration:**
```xml
<application
    android:networkSecurityConfig="@xml/network_security_config"
    android:usesCleartextTraffic="true">
```

### 5. Firebase Notification Processing
**File:** `app/astrodummy/android/services/CustomFirebaseService.java`
**Lines:** 79-131

```java
public final void g(w wVar) {
    try {
        NotificationHandler notificationHandler = new NotificationHandler(
            null, null, null, null, null, null, null, 127, null
        );

        // Extract notification data
        notificationHandler.setItem_title(
            String.valueOf(((v.a) wVar.getData()).get("item_title"))
        );
        notificationHandler.setItem_id(
            String.valueOf(((v.a) wVar.getData()).get("item_id"))
        );
        notificationHandler.setSlug(
            String.valueOf(((v.a) wVar.getData()).get("slug"))
        );
        notificationHandler.setItem_type(
            String.valueOf(((v.a) wVar.getData()).get("item_type"))
        );
        notificationHandler.setWeb_view_url(
            String.valueOf(((v.a) wVar.getData()).get("web_view_url"))
        );
        notificationHandler.setPost_type(
            String.valueOf(((v.a) wVar.getData()).get("post_type"))
        );
        notificationHandler.setRest_base(
            String.valueOf(((v.a) wVar.getData()).get("image"))
        );

        Intent intent = new Intent(this, (Class<?>) HomeActivity.class);

        // Store notification data globally
        if (/* notification has data */) {
            c.f290f = true;
            c.f291g = notificationHandler;
        }

        // Create and display notification
        PendingIntent activity = PendingIntent.getActivity(
            this, 0, intent, 201326592
        );

        // ... notification creation code ...
    } catch (Exception e11) {
        a.v("Error", String.valueOf(e11.getMessage()));
    }
}
```

---

## Permissions Analysis

### High-Risk Permissions
**Location:** `AndroidManifest.xml:2-46`

```xml
<!-- Device Identification -->
<uses-permission android:name="android.permission.READ_PHONE_STATE"/>

<!-- Network -->
<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>

<!-- Background Execution -->
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
<uses-permission android:name="android.permission.WAKE_LOCK"/>

<!-- Notifications -->
<uses-permission android:name="android.permission.ACCESS_NOTIFICATION_POLICY"/>
<uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>

<!-- Advertising -->
<uses-permission android:name="com.google.android.gms.permission.AD_ID"/>

<!-- Push Notifications -->
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE"/>

<!-- Badge Permissions (Multiple Manufacturers) -->
<uses-permission android:name="com.sec.android.provider.badge.permission.READ"/>
<uses-permission android:name="com.sec.android.provider.badge.permission.WRITE"/>
<uses-permission android:name="com.htc.launcher.permission.READ_SETTINGS"/>
<uses-permission android:name="com.htc.launcher.permission.UPDATE_SHORTCUT"/>
<uses-permission android:name="com.sonyericsson.home.permission.BROADCAST_BADGE"/>
<uses-permission android:name="com.sonymobile.home.permission.PROVIDER_INSERT_BADGE"/>
<uses-permission android:name="com.anddoes.launcher.permission.UPDATE_COUNT"/>
<uses-permission android:name="com.majeur.launcher.permission.UPDATE_BADGE"/>
<uses-permission android:name="com.huawei.android.launcher.permission.CHANGE_BADGE"/>
<uses-permission android:name="com.huawei.android.launcher.permission.READ_SETTINGS"/>
<uses-permission android:name="com.huawei.android.launcher.permission.WRITE_SETTINGS"/>
<uses-permission android:name="android.permission.READ_APP_BADGE"/>
<uses-permission android:name="com.oppo.launcher.permission.READ_SETTINGS"/>
<uses-permission android:name="com.oppo.launcher.permission.WRITE_SETTINGS"/>
<uses-permission android:name="me.everything.badger.permission.BADGE_COUNT_READ"/>
<uses-permission android:name="me.everything.badger.permission.BADGE_COUNT_WRITE"/>
```

---

## Exported Components (Attack Surface)

### Boot Receivers
**Lines:** `AndroidManifest.xml:96-101`
```xml
<receiver
    android:exported="true"
    android:name="com.onesignal.notifications.receivers.BootUpReceiver">
    <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED"/>
        <action android:name="android.intent.action.QUICKBOOT_POWERON"/>
    </intent-filter>
</receiver>
```

**Lines:** `AndroidManifest.xml:146-152`
```xml
<receiver
    android:directBootAware="false"
    android:enabled="false"
    android:exported="false"
    android:name="androidx.work.impl.background.systemalarm.RescheduleReceiver">
    <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED"/>
        <action android:name="android.intent.action.TIME_SET"/>
        <action android:name="android.intent.action.TIMEZONE_CHANGED"/>
    </intent-filter>
</receiver>
```

### Package Monitoring
**Lines:** `AndroidManifest.xml:102-106`
```xml
<receiver
    android:exported="true"
    android:name="com.onesignal.notifications.receivers.UpgradeReceiver">
    <intent-filter>
        <action android:name="android.intent.action.MY_PACKAGE_REPLACED"/>
    </intent-filter>
</receiver>
```

### Foreground Service Declaration
**Lines:** `AndroidManifest.xml:58`
```xml
<service
    android:exported="false"
    android:foregroundServiceType="dataSync"
    android:name="app.astrodummy.android.services.LoginService"/>
```

### Firebase Messaging Service
**Lines:** `AndroidManifest.xml:59-63`
```xml
<service
    android:exported="false"
    android:name="app.astrodummy.android.services.CustomFirebaseService">
    <intent-filter>
        <action android:name="com.google.firebase.MESSAGING_EVENT"/>
    </intent-filter>
</service>
```

### FCM Broadcast Receiver
**Lines:** `AndroidManifest.xml:79-84`
```xml
<receiver
    android:exported="true"
    android:name="com.onesignal.notifications.receivers.FCMBroadcastReceiver"
    android:permission="com.google.android.c2dm.permission.SEND">
    <intent-filter android:priority="999">
        <action android:name="com.google.android.c2dm.intent.RECEIVE"/>
        <category android:name="app.astrodummy.android"/>
    </intent-filter>
</receiver>
```

---

## Data Storage Locations

### SharedPreferences Keys
**Preference File:** `CMS_SHARED_PREFERENCES`

**Stored Values:**
```
admin_token          - Authentication token (plaintext)
admin_token_type     - Token type (e.g., "Bearer")
langLocal            - Language locale setting
defaultLang          - Default language code
```

**Preference File:** `MY_NEW_PREFERENCES`
```
AMS_CLIENT_ID        - Client identifier
AMS_CLIENT_SECRET    - Client secret key
```

### Storage Implementation
**Location:** `app/astrodummy/android/MainApplication.java:20-32`
```java
SharedPreferences sharedPreferences = getApplicationContext()
    .getSharedPreferences("MY_NEW_PREFERENCES", 0);
l.e(sharedPreferences, "applicationContext.getSh…S\", Context.MODE_PRIVATE)");
this.r = sharedPreferences;

sharedPreferences.getString("AMS_CLIENT_ID",
    RequestConfiguration.MAX_AD_CONTENT_RATING_UNSPECIFIED);

SharedPreferences sharedPreferences2 = this.r;
sharedPreferences2.getString("AMS_CLIENT_SECRET",
    RequestConfiguration.MAX_AD_CONTENT_RATING_UNSPECIFIED);
```

**Mode:** `Context.MODE_PRIVATE` (0) - No encryption

---

## Network Traffic Indicators

### WebSocket Connection Pattern
```
1. DNS query: ws-mt1.pusher.com
2. TCP handshake to port 443 or 80
3. WebSocket upgrade request
4. Connection header: Upgrade: websocket
5. Pusher-specific handshake with API key
6. Channel subscription: "AppMySite<ANDROID_ID>"
7. Event binding: "App/Events/Senddatatoapp"
8. Persistent connection maintained
```

### HTTP/HTTPS Endpoints
```
Primary:
- custom.api.appmysite.com/api/*
- admin.appmysite.com/api/*
- app.appmysite.com/*

CDN:
- d33cfg8bjlyn3i.cloudfront.net/*

Telemetry:
- o4504772588535808.ingest.sentry.io/*

Advertising:
- Various Google Ads endpoints (dynamic)

Push Notifications:
- Firebase Cloud Messaging endpoints
- OneSignal endpoints
```

### Expected User-Agent Pattern
```
Standard Android WebView user agent with:
- Android version
- Device model
- WebKit version
- Chrome version
```

---

## Decompilation Artifacts

### Java Package Structure
```
app/astrodummy/android/
├── MainActivity.java (9.1 KB)
├── MainApplication.java (1.6 KB)
├── base/
├── network/
│   ├── models/
│   │   └── NotificationHandler.java
│   └── response/
│       ├── PusherResponse.java
│       ├── Token.java
│       └── (various response models)
├── services/
│   ├── LoginService.java (6.3 KB)
│   ├── CustomFirebaseService.java (6.3 KB)
│   └── WorkerClass.java (6.0 KB)
└── ui/
    └── activities/
        ├── AuthActivity.java
        ├── HomeActivity.java
        ├── GalleryActivity.java
        └── EmptyActivity.java

Obfuscated packages:
a/, a0/, a1/, a2/, a3/, a4/, a5/, a6/, a7/, a8/
(+/-100 obfuscated package directories)
```

### Veri inmorntant Obfuscated Classes
```
a6/c.java  - Utility class with API endpoint configuration
a6/a.java  - Large utility class (53 KB)
a6/h.java  - Large utility class (53 KB)
bd/e.java  - Static configuration holder (credentials, endpoints)
```

### Native Libraries (ARM64)
```
lib/arm64-v8a/
├── liblanguage_id_l2c_jni.so (1.0 MB) - Google ML Kit
├── libsentry-android.so (15 KB)        - Sentry SDK
├── libsentry.so (1.2 MB)               - Sentry Native
└── libtranslate_jni.so (16 MB)         - Google ML Kit Translation
```

---

## Asset Files

### Configuration Files
```
assets/
├── default.json (1.9 KB) - Main app configuration
├── sentry-debug-meta.properties
├── sentry-external-modules.txt
└── dexopt/
    ├── baseline.prof
    └── baseline.profm
```

### Key Configuration (default.json)
**Lines:** 2-66
```json
{
  "_id": "64637f93121795db5703240c",
  "app_id": 264,
  "user_id": 13,
  "client_id": 10003628,
  "service": 3,
  "general": {
    "title": "SamplecustomApp2"
  },
  "aws_directory": {
    "CountriesFlagUrl": {
      "flag_url": "https://d33cfg8bjlyn3i.cloudfront.net/assets/images/flags/100x100/"
    },
    "Icons": {
      "light": "icons/96w/light",
      "regular": "icons/96w/regular",
      "bold": "icons/96w/bold"
    },
    "CustomCms": {
      "CustomCms": "custom-cms-media"
    }
  },
  "aws_url": "https://d33cfg8bjlyn3i.cloudfront.net"
}
```

---

## DEX String Indicators

### From classes.dex (strings utility output)

**Pusher-related:**
```
$pusher
pusher:connection_established
pusher:error
ws-mt1.pusher.com
{"event": "pusher:ping"}
An exception was thrown by the websocket
acceptHandshakeAsServer - Wrong websocket version.
```

**Authentication-related:**
```
$accessToken
$accessTokenAppId
admin_token
access_token
client_secret
refresh_token
refreshToken
authenticationToken
token_type
```

**Service identifiers:**
```
LoginService
CustomFirebaseService
WorkerClass
Inside the Login Service----------
Inside Notification
Pusher Response -----
```

---

## Build Information

### APKTool Output (apktool.yml)
```yaml
version: "1.0.0"
apkFileName: app.astrodummy.android.apk
isFrameworkApk: false
usesFramework:
  ids:
  - 1
sdkInfo:
  minSdkVersion: '24'
  targetSdkVersion: '34'
packageInfo:
  forcedPackageId: '127'
versionInfo:
  versionCode: '1'
  versionName: 1.0.0
```

### Gradle Build Properties (inferred from unknown/)
```
buildType: release
obfuscation: enabled (ProGuard/R8)
minification: enabled
optimization: enabled
```

---

## Detection Signatures

### YARA-style Pattern Indicators

```
rule AstroDummy_Pusher_Keys {
    strings:
        $pusher_live = "2ef6a31c84b594470a20"
        $pusher_dev = "422f30e59bee74b8578d"
        $pusher_host = "ws-mt1.pusher.com"
    condition:
        any of them
}

rule AstroDummy_Package {
    strings:
        $pkg = "app.astrodummy.android"
        $service = "LoginService"
        $channel = "AppMySite"
    condition:
        all of them
}

rule AstroDummy_Endpoints {
    strings:
        $api1 = "custom.api.appmysite.com"
        $api2 = "admin.appmysite.com"
        $cdn = "d33cfg8bjlyn3i.cloudfront.net"
    condition:
        any of them
}
```

### File Path Indicators
```
/data/data/app.astrodummy.android/
/data/data/app.astrodummy.android/shared_prefs/CMS_SHARED_PREFERENCES.xml
/data/data/app.astrodummy.android/shared_prefs/MY_NEW_PREFERENCES.xml
/data/data/app.astrodummy.android/files/
/data/data/app.astrodummy.android/cache/
```

---

## Intent Filter Patterns

### Deep Link Handling
**Location:** `AndroidManifest.xml:169-176`
```xml
<activity
    android:exported="true"
    android:name="com.facebook.CustomTabActivity">
    <intent-filter>
        <action android:name="android.intent.action.VIEW"/>
        <category android:name="android.intent.category.DEFAULT"/>
        <category android:name="android.intent.category.BROWSABLE"/>
        <data
            android:host="cct.app.astrodummy.android"
            android:scheme="fbconnect"/>
    </intent-filter>
</activity>
```

**URL Pattern:** `fbconnect://cct.app.astrodummy.android`

---

## Certificate Information

### Network Security - Trusted Certificates
```xml
<certificates src="system" />   <!-- System CA store -->
<certificates src="user" />     <!-- User-installed certs -->
<certificates src="@raw/cloudflare" />  <!-- Custom cert -->
```

**Custom Certificate Location:** `res/raw/cloudflare` (referenced but not extracted)

---

## Gradle Dependencies (Inferred from Code)

```gradle
dependencies {
    // Firebase
    implementation 'com.google.firebase:firebase-messaging'
    implementation 'com.google.firebase:firebase-analytics'
    implementation 'com.google.firebase:firebase-crashlytics'

    // Pusher
    implementation 'com.pusher:pusher-websocket-java'

    // OneSignal
    implementation 'com.onesignal:OneSignal'

    // Sentry
    implementation 'io.sentry:sentry-android'

    // Google Ads
    implementation 'com.google.android.gms:play-services-ads'

    // Google ML Kit
    implementation 'com.google.mlkit:translate'
    implementation 'com.google.mlkit:language-id'

    // Facebook
    implementation 'com.facebook.android:facebook-android-sdk'

    // Image Loading
    implementation 'com.github.bumptech.glide:glide'

    // Networking
    implementation 'com.squareup.okhttp3:okhttp' (inferred)
    implementation 'com.squareup.retrofit2:retrofit' (inferred)

    // JSON
    implementation 'com.google.code.gson:gson'

    // AndroidX
    implementation 'androidx.work:work-runtime-ktx'
    implementation 'androidx.core:core-ktx'
    // ... (numerous AndroidX dependencies)
}
```



**Note:** All values, keys, endpoints, and code snippets extracted directly from static analysis. No dynamic execution performed.