<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-android-static-analysis
description: >-
  Decompile, disassemble, and review Android APK/AAB packages for security
  vulnerabilities without executing the application. Covers apktool, jadx,
  androguard, MobSF automation, manifest auditing, and secrets detection.
domain: cybersecurity
subdomain: mobile-security
tags:
  - android
  - static-analysis
  - apk
  - jadx
  - apktool
  - mobsf
  - androguard
  - reverse-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1407.001", "T1409"]
  owasp-mobile: ["M1", "M2", "M7", "M9"]
  tools: ["apktool", "jadx", "androguard", "mobsf", "dex2jar"]
---

# Performing Android Static Analysis

## Overview

Android static analysis examines APK/AAB contents—manifest, smali, Java source,
native libraries, and resources—without running the app. Identifies hardcoded
secrets, insecure configurations, exported components, and vulnerable dependencies.

## Prerequisites

```bash
# Core tooling
pip install androguard
apt install apktool  # or brew install apktool
# jadx: https://github.com/skylot/jadx/releases
# MobSF: docker run -it -p 8000:8000 opensecurity/mobile-security-framework-mobsf
```

## Workflow

### Step 1: Decompile and Disassemble

```bash
# Decode APK resources and smali
apktool d target.apk -o apktool_out/

# Decompile to Java source
jadx -d jadx_out/ target.apk --deobf

# Convert DEX to JAR for JD-GUI
d2j-dex2jar target.apk -o target.jar

# Androguard quick info
androguard analyze target.apk
```

### Step 2: Manifest Auditing

```bash
# Extract and review AndroidManifest.xml
cat apktool_out/AndroidManifest.xml

# Critical checks
grep -E 'android:exported="true"' apktool_out/AndroidManifest.xml
grep -E 'android:debuggable="true"' apktool_out/AndroidManifest.xml
grep -E 'android:allowBackup="true"' apktool_out/AndroidManifest.xml
grep -E 'usesCleartextTraffic="true"' apktool_out/AndroidManifest.xml
grep -E 'android:permission=' apktool_out/AndroidManifest.xml

# List exported activities, services, receivers, providers
grep -B2 'exported="true"' apktool_out/AndroidManifest.xml
```

### Step 3: Secrets and Hardcoded Credentials

```bash
# Search decompiled source for secrets
grep -rn 'api[_-]key\|apikey\|secret\|password\|token\|firebase' jadx_out/
grep -rn 'AIza[0-9A-Za-z_-]\{35\}' jadx_out/      # Google API key
grep -rn 'AKIA[0-9A-Z]\{16\}' jadx_out/             # AWS access key
grep -rn 'ghp_[A-Za-z0-9]\{36\}' jadx_out/          # GitHub PAT
grep -rn 'https\?://[^"]*\.firebaseio\.com' jadx_out/

# Check resources for embedded keys
grep -rn 'api_key\|google_maps_key' apktool_out/res/values/strings.xml
```

### Step 4: Code Quality and Vulnerability Patterns

```bash
# Insecure crypto
grep -rn 'DES\|RC4\|MD5\|ECB' jadx_out/
grep -rn 'SecretKeySpec\|PBEKeySpec' jadx_out/

# SQL injection in ContentProviders
grep -rn 'rawQuery\|execSQL' jadx_out/

# WebView vulnerabilities
grep -rn 'setJavaScriptEnabled(true)\|addJavascriptInterface' jadx_out/
grep -rn 'setAllowFileAccess(true)' jadx_out/

# Insecure data storage
grep -rn 'MODE_WORLD_READABLE\|MODE_WORLD_WRITEABLE' jadx_out/
grep -rn 'getSharedPreferences\|openFileOutput' jadx_out/

# Insecure network
grep -rn 'http://' jadx_out/ | grep -v 'schemas.android.com'
grep -rn 'TrustAllCerts\|AllowAllHostnameVerifier\|ALLOW_ALL' jadx_out/
```

### Step 5: MobSF Automated Scan

```bash
# Start MobSF
docker run -it -p 8000:8000 opensecurity/mobile-security-framework-mobsf

# Upload via API
curl -F 'file=@target.apk' http://localhost:8000/api/v1/upload \
  -H "Authorization: $(cat ~/.mobsf_api_key)"

# Get scan results
curl "http://localhost:8000/api/v1/scan" \
  -X POST -d "scan_type=apk&file_name=target.apk&hash=HASH" \
  -H "Authorization: $(cat ~/.mobsf_api_key)"
```

### Step 6: Native Library Analysis

```bash
# List native libraries
find apktool_out/lib/ -name '*.so' -exec file {} \;

# Check for debug symbols
readelf -s apktool_out/lib/arm64-v8a/libnative.so | grep FUNC

# Strings extraction from native code
strings apktool_out/lib/arm64-v8a/libnative.so | grep -i 'key\|secret\|password'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Hardcoded secrets | Source review | API keys, passwords in code |
| Exported components | Manifest | Unprotected activities/providers |
| Cleartext traffic | Manifest | usesCleartextTraffic enabled |
| Weak crypto | Source review | DES, MD5, ECB mode usage |

```yaml
title: Android Static Analysis Detection
id: fbeb93ea-3d3c-4218-b905-75bdf9c79fb7
status: experimental
description: Detects suspicious activity related to performing android static analysis techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1407.001
  - attack.t1409
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] APK decompiled with apktool and jadx
- [ ] AndroidManifest.xml audited for insecure flags
- [ ] Secrets scan completed across all source and resources
- [ ] Vulnerable code patterns identified and cataloged
- [ ] Native libraries inspected for sensitive strings
- [ ] MobSF scan report generated

## References

- [OWASP MASTG — Android Static Analysis](https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0007/)
- [jadx](https://github.com/skylot/jadx)
- [apktool](https://apktool.org/)
- [MITRE T1407.001](https://attack.mitre.org/techniques/T1407/001/)
