SandDroid

Features of SandDroid: Static Analysis: Basic Information Extraction: file size, file hash, package name, SDK version, etc Certification Analysis: Parse the certification and check if it's from AOSP. Category Analysis: Classify the APK to different categories based on the permission information Permission Analysis: Extract permissions (include customized permissions) and detect if the declared permission is used Component Analysis: List all the components (include dynamically registered broadcast receivers) and analyze if the component is exported Code Feature Analysis: Check native code, java reflection, dynamic loader usage Advertisement Module Analysis: Extract all the advertisement modules Sensitive API Analysis: List all the sensitive APIs and the caller code path Dynamic Analysis: Network Data Record: capture all the network data during the APK's running period Http Data Recovery: recover data from http flow IP Distribution Analysis: parse IP information based on the extracted URLs File Operation Monitor: record file path and data SMS & Phone Call Monitor: record sms sent and phone call SMS Block Monitor: record sms block behavior Crypto Operation Monitor: record crypto usage Data Leakage Monitor: data leakage Comprehensive Analysis: Risky Behaviors Summary: list risky behaviors Risk Score: Calculate the risk score based on the static and dynamic analysis resultSandDroid的特性如下： 一、静态分析 1. 基础信息提取：提取文件大小、文件哈希值、包名、SDK版本等基础信息 2. 证书分析：解析应用证书，并校验其是否来自安卓开源项目（Android Open Source Project, AOSP） 3. 分类分析：基于权限信息将APK归类至不同类别 4. 权限分析：提取权限（含自定义权限），并检测声明的权限是否被实际调用 5. 组件分析：列出所有组件（含动态注册的广播接收器），并分析组件是否处于导出状态 6. 代码特征分析：检测原生代码、Java反射及动态加载器的使用情况 7. 广告模块分析：提取所有广告模块 8. 敏感API分析：列出所有敏感API及其调用代码路径 二、动态分析 1. 网络数据记录：捕获APK运行期间的全部网络数据 2. HTTP数据恢复：从HTTP流量中恢复传输数据 3. IP分布分析：基于提取的URL解析IP相关信息 4. 文件操作监控：记录文件路径与操作数据 5. 短信与通话监控：记录已发送短信及通话行为 6. 短信拦截监控：记录短信拦截行为 7. 加密操作监控：记录加密操作的使用情况 8. 数据泄露监控：监测数据泄露事件 三、综合分析 1. 风险行为汇总：列出所有风险行为 2. 风险评分：基于静态与动态分析结果计算风险评分