Analyzing APK files inside an online Android application sandbox
Anubis is an online project developed by International Secure Systems Lab, which focuses on analyzing of binaries for different type of systems. The online sandbox was first providing capabilities of analyzing Windows PE executables, but from mid-2012 they started supporting Android apps as well.
The Android module, codenamed Andrubis, provides its users with a simple way to execute Android apps in a fully functioning sandbox which does several tests and generates a detailed report for the uploaded APK file. Every report is divided into the following categories:
1. General information
2.Static Analysis Report
- Activities
- Services
- Broadcast Receivers
- Required Permissions
- Used Permissions
- Features
- URLs.
3. Dynamic Analysis Report
The reports are provided in both HTML and XML formats. PCAP data captures are provided for download as well.
Part of an actual report on Android/DNightmare Trojan, click for large version:
The service generates a “maliciousness rating” for every application which ranges from 0 (likely benign) to 10 (likely malicious). Do take this with a grain of salt, as I have tested a couple of legit applications which were mistakenly labeled as malicious, with very high scores such as 9.66931 or 9.93733.
Anubis is a free service and it doesn’t require registration. You can start the analysis by uploading the APK file here.