Published 2026-06-07 by the Droidwatch Security Research team
This entry is unusual: Droidwatch couldn't even parse its manifest, so the sample carries the placeholder name Parse Error (parse_error). A failed manifest parse is itself the lead finding, and it still earns a Malicious 65/100 on 1 critical and 3 high findings — a reminder that broken or deliberately malformed packages are a signal, not a dead end. Everything below is static output from a decompiled-but-never-run artifact, one of ten in our roundup.
Sample at a glance
| Field | Value |
|---|---|
| App label | Parse Error |
| Package | parse_error |
| Version | 0.0 (code 0) |
| Min / target SDK | 0 / 0 |
| Size | 4.77 MB |
| SHA-256 | 21b4cafde043ac30d406b4fbc033f28b39da84707f665b565b43083193d773af |
| MD5 | 744d3e3a67425b2c62206c2037f87476 |
| Verdict | Malicious |
| Risk score | 65 / 100 |
| Findings raised | 6 (1 critical · 3 high · 0 medium) |
The verdict, in the platform's words
'Parse Error' (package: parse_error, v0.0, SDK 0–0) was analyzed and received a risk score of 65/100 (Malicious).
What analysis ran
This was a static pass through Droidwatch's pipeline. The stages below produced findings on this sample (stages that found nothing are omitted):
| Stage | What it inspects | Findings |
|---|---|---|
rules |
Weighted rule engine (final scoring) | 2 |
manifest |
AndroidManifest: permissions, components, exported surface, deep links | 1 |
framework |
Cross-platform framework fingerprinting (Flutter/RN/Unity/native) | 1 |
nsc |
Network Security Config (cleartext, trust anchors) | 1 |
certificates |
Code-signing certificate posture | 1 |
Top findings
| Finding | Severity | Category | MASVS / ATT&CK |
|---|---|---|---|
| VirusTotal: Confirmed Malicious | 🟥 Critical | reputation | — |
| Manifest Parse Failed | 🟧 High | parsing | — |
| VirusTotal: Suspicious / Low Detection | 🟧 High | reputation | — |
| No Signing Certificate Found | 🟧 High | signing | MASVS-CODE-1 |
| No Network Security Config Defined | 🟦 Low | network | MASVS-NETWORK-1 · T1437 |
| Framework Detected: Native Android | ⬜ Info | framework | — |
Why this score
The weighted rule engine's top scoring contributions:
| Rule | Severity | Points |
|---|---|---|
| VirusTotal: Confirmed Malicious | critical | +33.2 |
| VirusTotal: Suspicious / Low Detection | high | +14.8 |
MITRE ATT&CK Mobile mapping
| Technique | Tactic | Why |
|---|---|---|
| T1437 Application Layer Protocol: Web Protocols | Command and Control | Using HTTP/HTTPS for C2 communication. |
Reproduce it
curl -s -X POST https://droidwatch.app/api/upload \
-H "X-Upload-Consent: 1" -F "[email protected]" | jq -r .upload_id
# then POST /api/analyze, poll /api/jobs/<id>, read the report (verdict + MITRE + STIX 2.1)
Static-only analysis; the Android dynamic Frida sandbox was not used. Sample from a public 2021 research corpus, referenced by SHA-256. Family attribution is intentionally conservative.