{
  "docId": "019dd923-622c-750b-8b96-2fbe642fbf78",
  "docSlug": "69cc18cfe079",
  "documentTitle": "NQ Mobile (NQ)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson C. Block",
  "documentKindSlug": "research-note",
  "documentKindLabel": "Research note",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2013-10-24 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 79,
  "pageCount": 81,
  "prevPage": 78,
  "nextPage": 80,
  "slideType": "other",
  "function": "plan_implementation",
  "density": "sparse",
  "nDataPoints": 0,
  "notes": "This appears to be a technical research note detailing a malware delivery or software deployment mechanism.",
  "elementsJson": [
    "paragraph"
  ],
  "metadataConfidence": 0.9,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/79",
  "deckHref": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-79",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "Basically the file the protocol describes is supposed to be an .APK file. This file is later chmod'ed to become r+x so it could be executed later.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd953-0936-7173-ab11-bf1cea17b90f",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.153,
        "w": 0.764,
        "x": 0.118,
        "y": 0.093
      },
      "kind": "paragraph",
      "text": "On our HTTP server we set up a response according to what we saw that the application expects. The response contains a different command value, which indicates to the client that it should download a file, and the URL of the file to download. Basically the file the protocol describes is supposed to be an .APK file. This file is later chmod'ed to become r+x so it could be executed later.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "08d3288d-504f-4e3a-950b-e62a9dd40159",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.019,
        "w": 0.703,
        "x": 0.118,
        "y": 0.174
      },
      "kind": "paragraph",
      "text": "The application was properly installed but requires approval by user intervention.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "1eddf05e-b81f-4e02-be9d-4fa270032899",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 80,
      "from": 61,
      "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878",
      "arcName": "Overcoming the Monster",
      "arcSlug": "overcoming-monster",
      "beatName": "Appendix Data",
      "beatSlug": null,
      "evidence": "The document provides extensive data and evidence to support its claims.",
      "position": 2,
      "confidence": 0.8,
      "parentBeatName": null,
      "parentBeatSlug": null
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}