1.1 KiB
1.1 KiB
API Reference: Analyzing Android DEX Malware
Overview
scripts/analyst.py treats an APK as a ZIP and inventories its DEX files, native libraries,
assets, and manifest presence, flagging multidex and likely encrypted payload assets. It does
not decompile or execute — use jadx/apktool for decompilation.
Dependencies
| Package | Version | Purpose |
|---|---|---|
| (stdlib) | — | zipfile, file IO |
External tools
| Tool | Purpose |
|---|---|
| jadx | Decompile DEX bytecode to Java |
| apktool | Decode resources and binary AndroidManifest.xml |
| Android emulator | Dynamic analysis of dynamic/native payloads |
Core functions
inspect(path)
Returns the DEX list, native libraries, assets, manifest presence, multidex flag, and triage notes.
Usage
python scripts/analyst.py inspect sample.apk
Sources
- Android DEX bytecode format — https://source.android.com/docs/core/runtime/dex-format
- APK packaging (ZIP container, AndroidManifest.xml) — Android documentation
- jadx DEX-to-Java decompiler — https://github.com/skylot/jadx