Published 2026-06-07 by the Droidwatch Security Research team
This sample ships with no recoverable app name or package id — Droidwatch labels both unknown — yet still scored Malicious at 65/100 off 1 critical and 3 high findings. The reason it stays anonymous is the lead finding itself: a binary-obfuscated AndroidManifest.xml that resists normal parsing, a common evasion trick. The walkthrough below is pure static output (the artifact was decompiled but never run) and forms one case in our 10-sample static-triage roundup.
Sample at a glance
| Field | Value |
|---|---|
| App label | unknown |
| Package | unknown |
| Version | unknown (code 0) |
| Min / target SDK | 1 / 0 |
| Size | 3.82 MB |
| SHA-256 | 078e4e4f4f92d4b7e363806dc0d6ea058fe5dbaf8d6e6c88868cd41f338fb872 |
| MD5 | 9ab2b6e085134ec9de777b8974485e5b |
| Verdict | Malicious |
| Risk score | 65 / 100 |
| ML classifier | malicious (P(mal)=1.00), model lgbm_binary |
| Findings raised | 6 (1 critical · 3 high · 0 medium) |
The verdict, in the platform's words
'unknown' (package: unknown, vunknown, SDK 1–0) was analyzed and received a risk score of 65/100 (Malicious).
What analysis ran
This was a static pass through Droidwatch's pipeline. The stages below produced findings on this sample (stages that found nothing are omitted):
| Stage | What it inspects | Findings |
|---|---|---|
rules |
Weighted rule engine (final scoring) | 2 |
manifest |
AndroidManifest: permissions, components, exported surface, deep links | 1 |
framework |
Cross-platform framework fingerprinting (Flutter/RN/Unity/native) | 1 |
nsc |
Network Security Config (cleartext, trust anchors) | 1 |
certificates |
Code-signing certificate posture | 1 |
ml_intelligence |
Independent ML classifier (Androguard features, CICMalDroid-trained) | 1 |
Top findings
| Finding | Severity | Category | MASVS / ATT&CK |
|---|---|---|---|
| VirusTotal: Confirmed Malicious | 🟥 Critical | reputation | — |
| ML Engine: classified as 'Malicious' — family 'riskware' | 🟧 High | ml-intelligence | — |
| AndroidManifest.xml is Binary-Obfuscated (Anti-Analysis) | 🟧 High | binary-protection | MASVS-RESILIENCE-3 · T1406 |
| VirusTotal: Suspicious / Low Detection | 🟧 High | reputation | — |
| No Signing Certificate Found | 🟧 High | signing | MASVS-CODE-1 |
| No Network Security Config Defined | 🟦 Low | network | MASVS-NETWORK-1 · T1437 |
| Framework Detected: Native Android | ⬜ Info | framework | — |
Why this score
The weighted rule engine's top scoring contributions:
| Rule | Severity | Points |
|---|---|---|
| VirusTotal: Confirmed Malicious | critical | +33.2 |
| VirusTotal: Suspicious / Low Detection | high | +14.8 |
MITRE ATT&CK Mobile mapping
| Technique | Tactic | Why |
|---|---|---|
| T1406 Obfuscated Files or Information | Defense Evasion | Packer, protector, or anti-analysis technique detected. |
| T1437 Application Layer Protocol: Web Protocols | Command and Control | Using HTTP/HTTPS for C2 communication. |
Reproduce it
curl -s -X POST https://droidwatch.app/api/upload \
-H "X-Upload-Consent: 1" -F "[email protected]" | jq -r .upload_id
# then POST /api/analyze, poll /api/jobs/<id>, read the report (verdict + MITRE + STIX 2.1)
Static-only analysis; the Android dynamic Frida sandbox was not used. Sample from a public 2021 research corpus, referenced by SHA-256. Family attribution is intentionally conservative.