There is no single best tool for analysing an APK, because the tools on the market answer different questions. A multi-engine scanner says whether a file is already known. A static analysis service explains what an application is capable of. A sandbox shows what it did during one run. A decompiler shows the code. Choosing well starts with knowing which of those questions the decision in front of the analyst depends on.
This comparison covers the tools most often used on Android applications, grouped by the question they answer: VirusTotal, Droidwatch, MobSF, ANY.RUN, and the manual toolkit of jadx, apktool and Frida. For each one it sets out what the tool does, where the sample goes, and the situation it fits. Droidwatch, the publisher of this comparison, is one of the tools covered.
Five questions, five kinds of tool
| Question | Kind of tool | Examples |
|---|---|---|
| Has anyone seen this file before? | Multi-engine reputation service | VirusTotal |
| What can this application do, and why does that matter? | Static analysis, hosted or on own servers | Droidwatch, MobSF |
| Can static and dynamic analysis run on our own infrastructure? | Open-source framework on own infrastructure | MobSF |
| What does the application do when it runs? | Interactive sandbox | ANY.RUN |
| What exactly does this code do? | Decompilers and instrumentation | jadx, apktool, Frida |
These tools are usually combined. The order matters: a hash lookup costs seconds, while a sandbox run or a manual review costs analyst time.
Multi-engine reputation: VirusTotal
VirusTotal inspects items with more than 70 antivirus scanners and URL and domain blocklisting services; for a file, it returns how each antivirus engine classified it. For an APK, the useful outcome is fast: if the hash has been seen and several engines agree on a family name, the analyst has a lead within seconds.
Two properties shape how it should be used.
Its core answer is "known or unknown". A clean result on a freshly built sample means that no engine recognised it yet, not that it is benign. VirusTotal's Android sandboxes add behaviour reports for some samples, but the multi-engine verdict remains a set of labels, and labels from different engines often disagree.
Submissions are shared. VirusTotal's own documentation states that scanning reports are shared with the public VirusTotal community and that the contents of submitted files may be shared with premium customers. For public malware that is the point of the service. For an unreleased build of a bank's own application, or an APK a customer sent to a fraud team, it is a reason to search by hash rather than upload.
Best fit: the first lookup on any suspicious sample, by hash.
Hosted static analysis: Droidwatch
Droidwatch takes an APK, AAB, XAPK, DEX or IPA file and returns a report without executing the sample. A single upload runs a 28-stage pipeline that produces more than 25 independent analyses: manifest and permissions, signing certificate compared against Google Play, DEX bytecode and obfuscation, native libraries and packers, YARA-based family detection, 87 third-party SDKs identified by signature with a live OSV.dev lookup (OSV covers 12 of those 87), and extraction of command-and-control indicators, including encrypted configuration when the sample allows it.
The output is a scored report rather than a list of detections. Risk is scored from 0 to 100, where higher is worse: 65 or more is Malicious, 40-64 High Risk, 20-39 Suspicious and below 20 Benign. Each finding carries its reasoning, findings are mapped to MITRE ATT&CK Mobile techniques and OWASP MASVS categories, and the report exports to STIX 2.1, PDF, DOCX, JSON and CSV. The prose summary comes from a rule engine, so it cannot describe an attack phase that the findings do not support. A 50 MB APK takes two to five minutes.
Submissions are private by default. Without an account, three analyses a day are available, up to 150 MB; a free account allows five a day, up to 200 MB.
Limits. Static analysis establishes capability, not behaviour: code that is downloaded or decrypted at runtime is not visible to it, and analysis time grows with size, to an average of eight to ten minutes above 100 MB. Dynamic analysis exists only for Android, from the Pro plan, and runs on the customer's own device or emulator through the Droidwatch agent; there is no hosted sandbox. iOS analysis is static only, in seven modules. Droidwatch is not a decompiler: it reports on the code, it does not replace reading it.
Best fit: triage that has to end in a defensible decision, supply-chain review of a team's own builds, and gating releases in CI/CD. The full structure of a report is covered in Analyze an APK online: inside a Droidwatch report.
Open-source framework on own infrastructure: MobSF
The Mobile Security Framework is an open-source, GPL-3.0 project for automated testing of Android, iOS and Windows applications. It runs static analysis on APK, IPA and APPX packages and on source code, and dynamic analysis on Android and iOS with instrumented testing and network traffic capture. It ships as a Docker image and offers REST APIs and CLI tools for pipelines.
Its main advantage is control: everything runs on infrastructure the team operates, which matters to organisations that cannot send binaries to any third party. The cost is operational. Someone has to run the container, keep dependencies and rules current, scale workers when volume grows, and set up the emulators or devices that dynamic analysis needs.
Best fit: teams with strict data-residency requirements and the engineering time to operate the stack. A detailed comparison with Droidwatch is on the MobSF alternative page.
Interactive sandbox: ANY.RUN
ANY.RUN added Android to its interactive sandbox in March 2025. The environment is ARM-based, and the analyst can interact with the session while it runs. Android analysis is available on the free plan as well as on paid plans.
A sandbox answers a question static analysis cannot: what the application actually did during that session, including the network traffic it produced and the screens it displayed. Its limits are the usual ones for dynamic analysis. A sample that detects the emulator, waits for a trigger, or depends on a command-and-control server that is no longer answering may do nothing visible. As with any third-party service, the visibility of submissions under the plan in use should be checked before uploading a confidential sample.
Best fit: confirming behaviour of a sample that static analysis has already flagged, especially when the targets or injects are delivered by the server. The trade-offs are set out in static vs dynamic analysis of Android malware.
Decompilers and instrumentation: jadx, apktool and Frida
The manual toolkit is free, local and the most precise option available, at the price of analyst time.
- jadx decompiles DEX bytecode into readable Java, with a graphical interface for navigating classes. It is the fastest way to read what a method does.
- apktool decodes resources and the manifest, disassembles bytecode to smali and can rebuild the package. It is the tool for inspecting resources, layouts and assets, or for patching an application in a lab.
- Frida injects scripts into a running process to hook methods, inspect arguments and bypass checks such as certificate pinning or root detection. Droidwatch's dynamic analysis is built on Frida; the device setup guide covers the connection.
These tools answer the question the others leave open: what exactly a specific piece of code does. They do not produce a verdict, a score or a report that a review board can read.
Best fit: reverse engineering an unknown family, confirming a finding before it goes into an incident record, and research.
Side-by-side comparison
| VirusTotal | Droidwatch | MobSF | ANY.RUN | jadx / apktool / Frida | |
|---|---|---|---|---|---|
| Main question | Is it known? | What can it do? | Same, on own servers | What did it do? | What does this code do? |
| Where it runs | Hosted | Hosted | Team's own infrastructure | Hosted | Analyst's machine |
| Executes the sample | Depends on the sandboxes involved | No (dynamic: Android only, from Pro, on the customer's own device or emulator) | Yes, in dynamic mode | Yes | Frida only |
| Typical output | Detections per engine | Scored report, ATT&CK and MASVS mapping, five export formats | Static and dynamic report | Session record, network traffic | Code and hooks |
| Submissions | Shared with the community and premium customers | Private by default | Never leave the team | Check the plan's terms | Never leave the machine |
| Operating effort | None | None for static; own device and agent for dynamic | High | None | Analyst time |
Choosing by situation
A SOC analyst with a suspicious APK from a ticket. Hash lookup on VirusTotal first. If the sample is unknown or the labels disagree, a static report to reach a classification with reasons, then a sandbox run only if the decision depends on behaviour. The sequence is described in how to triage a suspicious APK.
An application security team at a bank. Its own builds should never go to a service that shares submissions. Static analysis in the release pipeline catches supply-chain and configuration findings before release; scanning APKs in CI/CD covers the setup. MobSF is the alternative when no binary may leave the organisation.
A fraud team receiving APKs from customers. The samples may contain personal data, which rules out services that share uploads. A private static report gives the indicators to block and the explanation for the business; dynamic analysis on the team's own device confirms behaviour when needed.
A reverse engineer on a new family. jadx and apktool for the code, Frida for runtime behaviour, a sandbox for the network picture. A static report is useful as a map before starting, not as a substitute for the work.
Frequently asked questions
What is the best tool to analyse an APK? It depends on the question. VirusTotal tells whether a file is already known; a static analysis service such as Droidwatch explains what it can do; a sandbox such as ANY.RUN shows what it did in one run; jadx, apktool and Frida show the code. A reputation lookup followed by a static report is a common starting combination.
Is it safe to upload an APK to VirusTotal? For public malware, yes. VirusTotal states that scanning reports are shared with its community and that file contents may be shared with premium customers, so unreleased builds or customer-submitted files should be looked up by hash instead.
Is MobSF free? MobSF is open source under GPL-3.0. Running it is free of licence cost; operating it — hosting, updates, emulators for dynamic analysis — is the cost.
Can an APK be analysed online without running it? Yes. Static analysis examines the package, code and certificate without executing anything. Droidwatch works this way and offers three analyses a day without an account.
Does Droidwatch replace a sandbox? No. Static analysis establishes capability; a sandbox records behaviour. Droidwatch's dynamic analysis is Android only, from the Pro plan, and runs on the customer's own device or emulator; there is no hosted sandbox.
Analyze an APK or compare Droidwatch and VirusTotal.