To come, our analysis is mainly about could walk.
Now that you have enough knowledge about the Android security architecture, you know, what does an
HBK file has?
And you know, the components of an application.
We need to leverage this knowledge and use the keywords, specific keywords to search for potential
malicious code.
So what we will do, we will use some indicator words or some keywords to search for malicious classes,
malicious methods, malicious activities that the developer might have used in writing the application.
So mainly we will search for means to collect data such as storing the data and ask a light to be.
We will search for means to collect information such as sending a semi's or posting some requests to
an external Web site, compromising our credentials and sending those credentials, for example, to
an FTB server or to an IP server.
So different exfiltration techniques that can be used by the attacker.
So many will search for words such as Get Borst Eskew, El Address, send HP and HTP asked that MIRV
invoke a Web service or an IP Essam s m.
M.
S monitor Atzmon, for example.
If we are sending data to an admin portal action, send an action call.
This is a non comprehensive list of keyword search.
But let's make it easy and use the list here to perform our basic static analysis.