Published 2026-06-07 by the Droidwatch Security Research team
Despite the innocuous name Installer and a Google-mimicking package id (google.Jk7H.PwcD), Droidwatch scored this APK Malicious at 65/100 — only 1 critical and 4 high findings, but enough to matter. The headline issue is an exported activity with no permission guard, an entry point any other app on the device can launch. Everything here comes from static analysis alone — unzipped and decompiled, never executed — and this walkthrough is part of our 10-sample roundup.
Sample at a glance
| Field | Value |
|---|---|
| App label | Installer |
| Package | google.Jk7H.PwcD |
| Version | 1.0 (code 1) |
| Min / target SDK | 4 / 0 |
| Size | 0.04 MB |
| SHA-256 | 062050ed871528d497e49ca2a0babb3cf199299dc6dce7bf4b76a59b82266981 |
| MD5 | 4476b11201b681859802d47c6a63bb79 |
| Verdict | Malicious |
| Risk score | 65 / 100 |
| ML classifier | malicious (P(mal)=1.00), model lgbm_binary |
| Findings raised | 19 (1 critical · 4 high · 6 medium) |
The verdict, in the platform's words
'Installer' (package: google.Jk7H.PwcD, v1.0, SDK 4–0) was analyzed and received a risk score of 65/100 (Malicious).
What analysis ran
This was a static pass through Droidwatch's pipeline. The stages below produced findings on this sample (stages that found nothing are omitted):
| Stage | What it inspects | Findings |
|---|---|---|
manifest |
AndroidManifest: permissions, components, exported surface, deep links | 4 |
attribution |
Build-path / developer / language attribution | 3 |
rules |
Weighted rule engine (final scoring) | 3 |
ipc |
IPC / component-security (exported components, PendingIntents, deep links) | 2 |
storage |
Insecure data storage (world-readable prefs, external storage, SQLite) | 2 |
framework |
Cross-platform framework fingerprinting (Flutter/RN/Unity/native) | 1 |
nsc |
Network Security Config (cleartext, trust anchors) | 1 |
network |
URLs / domains / IPs and high-risk network IOCs | 1 |
certificates |
Code-signing certificate posture | 1 |
callgraph |
Call Graph & Dead Code Analysis | 1 |
ml_intelligence |
Independent ML classifier (Androguard features, CICMalDroid-trained) | 1 |
Top findings
| Finding | Severity | Category | MASVS / ATT&CK |
|---|---|---|---|
| VirusTotal: Confirmed Malicious | 🟥 Critical | reputation | — |
| ML Engine: classified as 'Malicious' — family 'banking' | 🟧 High | ml-intelligence | — |
| Exported Activity Without Permission: SLYfoMdG | 🟧 High | ipc | MASVS-PLATFORM-1 · T1416 |
| VirusTotal: Suspicious / Low Detection | 🟧 High | reputation | — |
| No Signing Certificate Found | 🟧 High | signing | MASVS-CODE-1 |
| android:allowBackup=true with Sensitive Storage (No Exclusion Rules) | 🟧 High | data-storage | MASVS-STORAGE-2 · T1533 |
| 2 Dangerous Permission(s) Declared | 🟨 Medium | permissions | MASVS-PLATFORM-1 · T1626 |
| Very Low minSdkVersion (4) — Android 4+ | 🟨 Medium | permissions | MASVS-PLATFORM-1 · T1626 |
| Backup Enabled (android:allowBackup=true) | 🟨 Medium | data-storage | MASVS-STORAGE-1 · T1533 |
| Developer/C2 Email Addresses (3) | 🟨 Medium | attribution | — |
| Silent SMS Sending Capability | 🟨 Medium | sms | — |
| No HTTPS URLs Found (Plaintext Communication) | 🟨 Medium | network | MASVS-NETWORK-1 · T1437 |
Why this score
The weighted rule engine's top scoring contributions:
| Rule | Severity | Points |
|---|---|---|
| VirusTotal: Confirmed Malicious | critical | +33.2 |
| VirusTotal: Suspicious / Low Detection | high | +14.8 |
| Silent SMS Sending Capability | medium | +6.0 |
MITRE ATT&CK Mobile mapping
| Technique | Tactic | Why |
|---|---|---|
| T1406 Obfuscated Files or Information | Defense Evasion | Using obfuscation to hide malicious code from static analysis. |
| T1412 Capture SMS Messages | Collection | Intercepting SMS messages including banking OTP codes. |
| T1422 System Information Discovery | Discovery | Malware author attribution indicators: build paths, certificate identity, langua |
| T1437 Application Layer Protocol: Web Protocols | Command and Control | Using HTTP/HTTPS for C2 communication. |
| T1533 Data from Local System | Collection | Insecure local data storage exposing credentials and PII. |
Reproduce it
curl -s -X POST https://droidwatch.app/api/upload \
-H "X-Upload-Consent: 1" -F "[email protected]" | jq -r .upload_id
# then POST /api/analyze, poll /api/jobs/<id>, read the report (verdict + MITRE + STIX 2.1)
Static-only analysis; the Android dynamic Frida sandbox was not used. Sample from a public 2021 research corpus, referenced by SHA-256. Family attribution is intentionally conservative.