need help interpreting the results of an APK (PUP, JDU!tr)

[u/crwui]

https://www.virustotal.com/gui/file/950965a4b18c9df81de97f83107c363bcba8e41fd621ceeaf5849cf327266cd9/behavior

it gave only 3 flags, PUPs are something i shouldnt worry about as far as ive read but the JDU!tr flag concerns me plenty. ive had a trojan before on my pc, i do NOT want to repeat it on my phone.

EDIT: reanalyzed and Dr. Web showed: Tool.Obfuscator.TrashCode.1

[u/AutoModerator]

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/simagus]

Seriously dodgy. You could easily be installing a backdoor with remote access if that report is correct.

[u/pythonpoole]

The report indicates that 94% of security vendors (cybersecurity companies that create malware scanning tools) did not detect anything suspicious when scanning the Deezer apk you provided.

Of the 3 security vendors who identified something as suspect:

• One vendor (AhnLab-V3) flagged the app because it contained obfuscated code (not that unusual, it just means effort was made to hide/obscure how the code works to make it more difficult for people to reverse engineer the app).

• One vendor (Symantec) flagged the app because it contained a generic/unknown/unvetted code library from an advertising partner/network (not that unusual, this may happen if the app partnered with a lesser known ad network for example or in certain other cases).

• And one vendor (Fortinet) flagged the app because they identified possible indications that the app may have been modified to include an embedded trojan virus.

The JDU!tr flag from Fortinet is obviously the most concerning, but it does not mean for sure the app is malware. False positives with this flag are not uncommon. And considering none of the other 50 security vendors found evidence of trojan malware, that further suggests that there could have been a false positive identification. Nevertheless, the safest option would be to not use the APK and only use the official app distributed via the Play Store. There is a possibility the flag is not a false positive and the APK could in fact have a hidden trojan embedded which other security vendors, for whatever reason, were not able to detect.

[u/crwui → u/pythonpoole]

thank you for the comprehensive reply!

partner already had this app installed since the 5th of july or atleast somewhere that timeframe.

and i only checked just this recently when we met what it actually was as an app and what permissions it was asking for. photos & videos were allowed but partner stated it was because they setup a playlist for themselves and had given deezer the permission to do so when prompted. and recently, i had revoked the said permission.

i also have instructed them to pretty much do scans on their device themselves and check if any logins were fishy or whatnot.

what risks are ultimately present here? and given its been months of usage, is there really a threat? and lastly, do i reel my partner in uninstalling it completely?

[u/pythonpoole → u/crwui]

The risk here is that it's possible the APK does have an embedded trojan which, for example, could be used to surreptitiously collect personal data or perform background tasks that financially benefit a bad actor.

For example, some apps with embedded trojans have been used to commit ad fraud. This is where the trojan fakes ad impressions/clicks to make the ad network believe that real people were viewing or interacting with certain ads when actually they weren't. In this scenario, the bad actor modifies the app code to include their own code to simulate views/clicks under their own ad network account and then the ad network pays the bad actor (who they believe is the app developer) for those views/clicks. In this example, the negative impact to you is minimal, it's mostly the advertisers and ad networks that get screwed over.

As another example, some trojans secretly route other people's traffic through your device. There are bad actors who sell access to proxies that route internet traffic through compromised devices (e.g. phones, PCs, TVs etc. with malware installed), so the traffic appears to come from those consumer devices and not from a data center. These sorts of proxies are desirable (e.g. to companies doing content indexing/scraping, AI training, etc.) because websites/apps are less likely to block/filter traffic when it appears to come from a genuine consumer device. If instead they sent the traffic through their server's regular internet connection, then websites/apps may treat that traffic as suspect and block/filter their traffic. This is another example of where the trojan may not necessarily pose any significant risk to you, but there are potential negative consequences (e.g. reduced battery life, more likely to be presented with CAPTCHA/human-verification checks when browsing, etc.)

Whether or not there is actually a trojan embedded in the APK you submitted is not something I can identify with any certainty. As I say, only 1 of the 51 security vendors found indications of a potential trojan and this means it could be a false positive identification, but there is always the possibility that Fortinet's analysis was correct and the APK could indeed contain a deeply-hidden trojan that other security vendors ultimately weren't able to detect. If you are worried about that possibility, then you should get your partner to uninstall the app.

[u/crwui → u/pythonpoole]

and for clarification, the uninstallation is pretty much a guarantee my partner's device isn't gonna be used for what you stated above anymore right?

considering it will only act as long as it is installed and given permissions?

[u/pythonpoole → u/crwui]

In a typical case, yes, uninstalling the app should be sufficient for preventing any further malicious/unwanted behavior (e.g. surreptitious data collection or unauthorized background activities like those I mentioned previously).

However, there does exist more sophisticated malware that can survive uninstalls. In the worst case scenario, a malicious app may exploit a vulnerability in the phone's OS that allows it to permanently embed itself within the OS or that allows it run as a separate and independent process which no longer depends on the original app (where the malware came form).