MobSFレポート

ANDROID STATIC ANALYSIS REPORT  A2B Client (1.0)

File Name: app-debug.apk Package Name: com.example.a2bclient Scan Date: Oct. 21, 2026, 1:53 a.m. App Security Score: 34/100 (HIGH RISK) Grade: C

 FINDINGS SEVERITY  HIGH  MEDIUM  INFO  SECURE  HOTSPOT 12 10 0 3 1  FILE INFORMATION File Name: app-debug.apk Size: 6.0MB MD5: f93d86963c28a4df3361b85022bbabb2 SHA1: a0d4985e1cf0ca982be059898f69a52073de6110 SHA256: 519a3c62e6d702b55970c2a88497fb2854df4585d3a48cf85773de82e5e9e707  APP INFORMATION App Name: A2B Client Package Name: com.example.a2bclient Main Activity: com.example.a2bclient.MainActivity Target SDK: 34 Min SDK: 24 Max SDK: Android Version Name: 1.0 Android Version Code: 1

 APP COMPONENTS Activities: 2 Services: 0 Receivers: 1 Providers: 1 Exported Activities: 1 Exported Services: 0 Exported Receivers: 1 Exported Providers: 0  CERTIFICATE INFORMATION Binary is signed v1 signature: False v2 signature: True v3 signature: False v4 signature: False v3.1 signature: False v3.2 signature: False X.509 Subject: CN=Android Debug, O=Android, C=US Signature Algorithm: rsassa_pkcs1v15 Valid From: 2026-10-21 01:53:23+00:00 Valid To: 2056-10-13 01:53:23+00:00 Issuer: CN=Android Debug, O=Android, C=US Serial Number: 0x1 Hash Algorithm: sha256 md5: ac824259d84a0ecc78eceb65fa7dc5a4 sha1: 374e24db8064b64a91fbf271a8f95c57c9af74c3 sha256: 1107e5a92d2af6a3107faa9d08d0b49d1c0deb63e7c4061c641769843472a8d8 sha512: c66cf0ef6447d4491ddd79e25c08efd0350dd4efdafce10d7a6db696f2ee058a705cee38990ddc30e6a5d34784698fe730480a1b8e0ad2f787cb96bfa06c528f PublicKey Algorithm: rsa Bit Size: 2048 Fingerprint: ae47d478d1dc15ca856c23ad5889f6789a288573426ccb84b3690e2308736e08 Found 1 unique certificates

 APPLICATION PERMISSIONS PERMISSION STATUS INFO DESCRIPTION normal full Internet access Allows an application to create network sockets. dangerous fine (GPS) location Access fine location sources, such as the Global Positioning System on the phone, where available. Malicious applications can use this to determine where you are and may consume additional battery power. android.permission.READ_EXTERNAL_STORAGE dangerous read external storage contents Allows an application to read from external storage. com.example.a2bclient.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION unknown Unknown permission Unknown permission from android reference android.permission.INTERNET android.permission.ACCESS_FINE_LOCATION  APKID ANALYSIS FILE DETAILS

FILE classes.dex DETAILS FINDINGS DETAILS Anti-VM Code Build.FINGERPRINT check Build.MODEL check Build.MANUFACTURER check Compiler r8 FINDINGS DETAILS Compiler unknown (please file detection issue!) classes2.dex FINDINGS DETAILS Compiler r8 FINDINGS DETAILS Compiler r8 classes3.dex classes4.dex

 NETWORK SECURITY HIGH: 3 | WARNING: 2 | INFO: 0 | SECURE: 1 NO SCOPE SEVERITY DESCRIPTION 1 * secure Base config is configured to disallow clear text traffic to all domains. 2 * warning Base config is configured to trust system certificates. 3 legacy.a2b-demo.example.com high Domain config is insecurely configured to permit clear text traffic to these domains in scope. 4 docs.a2b-demo.example.com high Domain config is insecurely configured to permit clear text traffic to these domains in scope. 5 docs.a2b-demo.example.com warning Domain config is configured to trust system certificates. 6 docs.a2b-demo.example.com high Domain config is configured to trust user installed certificates.  CERTIFICATE ANALYSIS HIGH: 1 | WARNING: 0 | INFO: 1 TITLE SEVERITY DESCRIPTION Signed Application info Application is signed with a code signing certificate Application signed with debug certificate high Application signed with a debug certificate. Production application must not be shipped with a debug certificate.

 MANIFEST ANALYSIS
HIGH: 3 | WARNING: 3 | INFO: 0 | SUPPRESSED: 0

NO

1

2

3

4

5

ISSUE

App can be installed on a vulnerable unpatched Android version 7.0,
[minSdk=24]

Clear text traffic is Enabled For App[android:usesCleartextTraffic=true]

App has a Network Security
Configuration[android:networkSecurityConfig=@xml/network_security_config]

Debug Enabled For App [android:debuggable=true]

Application Data can be Backed up [android:allowBackup=true]

SEVERITY

DESCRIPTION

high

This application can be installed on an older version of
android that has multiple unfixed vulnerabilities. These
devices won't receive reasonable security updates from
Google. Support an Android version => 10, API 29 to
receive reasonable security updates.

high

The app intends to use cleartext network traffic, such as
cleartext HTTP, FTP stacks, DownloadManager, and
MediaPlayer. The default value for apps that target API
level 27 or lower is "true". Apps that target API level 28 or
higher default to "false". The key reason for avoiding
cleartext traffic is the lack of confidentiality, authenticity,
and protections against tampering; a network attacker
can eavesdrop on transmitted data and also modify it
without being detected.

info

The Network Security Configuration feature lets apps
customize their network security settings in a safe,
declarative configuration file without modifying app
code. These settings can be configured for specific
domains and for a specific app.

high

Debugging was enabled on the app which makes it
easier for reverse engineers to hook a debugger to it.
This allows dumping a stack trace and accessing
debugging helper classes.

warning

This flag allows anyone to backup your application data
via adb. It allows users who have enabled USB debugging
to copy application data off of the device.

NO ISSUE SEVERITY DESCRIPTION 6 Activity (com.example.a2bclient.DocsWebViewActivity) is not Protected. [android:exported=true] warning An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. warning A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission. 7 Broadcast Receiver (androidx.profileinstaller.ProfileInstallReceiver) is Protected by a permission, but the protection level of the permission should be checked. <strong>Permission: </strong>android.permission.DUMP [android:exported=true]  CODE ANALYSIS HIGH: 5 | WARNING: 5 | INFO: 0 | SECURE: 1 | SUPPRESSED: 0 NO ISSUE SEVERITY STANDARDS FILES 1 Files may contain hardcoded sensitive information like usernames, passwords, keys etc. warning CWE: CWE-312: Cleartext Storage of Sensitive Information OWASP Top 10: M9: Reverse Engineering OWASP MASVS: MSTG-STORAGE-14 com/example/a2bclient/ApiService.java com/example/a2bclient/BuildConfig.java 2 IP Address disclosure warning CWE: CWE-200: Information Exposure OWASP MASVS: MSTG-CODE-2 com/example/a2bclient/Backends.java com/example/a2bclient/BuildConfig.java

• https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

NO ISSUE SEVERITY STANDARDS FILES 3 Debug configuration enabled. Production builds must not be debuggable. high CWE: CWE-919: Weaknesses in Mobile Applications OWASP Top 10: M1: Improper Platform Usage OWASP MASVS: MSTG-RESILIENCE-2 com/example/a2bclient/BuildConfig.java high CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm OWASP Top 10: M5: Insufficient Cryptography OWASP MASVS: MSTG-CRYPTO-4 com/example/a2bclient/LegacyCrypto.ja va warning CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm OWASP Top 10: M5: Insufficient Cryptography OWASP MASVS: MSTG-CRYPTO-4 com/example/a2bclient/LegacyCrypto.ja va com/example/a2bclient/DocsWebViewA ctivity.java 4 Weak Encryption algorithm used 5 MD5 is a weak hash known to have hash collisions. 6 Insecure WebView Implementation. Execution of user controlled code in WebView is a critical Security Hole. warning CWE: CWE-749: Exposed Dangerous Method or Function OWASP Top 10: M1: Improper Platform Usage OWASP MASVS: MSTG-PLATFORM-7 7 Ensure that user controlled URLs never reaches the Webview. Enabling file access from URLs in WebView can leak sensitive information from the file system. warning CWE: CWE-200: Information Exposure OWASP Top 10: M1: Improper Platform Usage OWASP MASVS: MSTG-PLATFORM-7 com/example/a2bclient/DocsWebViewA ctivity.java 8 The file or SharedPreference is World Writable. Any App can write to the file high CWE: CWE-276: Incorrect Default Permissions OWASP Top 10: M2: Insecure Data Storage OWASP MASVS: MSTG-STORAGE-2 com/example/a2bclient/AdminStore.jav a 9 The file or SharedPreference is World Readable. Any App can read from the file high CWE: CWE-276: Incorrect Default Permissions OWASP Top 10: M2: Insecure Data Storage OWASP MASVS: MSTG-STORAGE-2 com/example/a2bclient/AdminStore.jav a

• https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing
• https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4
• https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5
• https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-6
• https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#testing-local-storage-for-sensitive-data-mstg-storage-1-and-mstg-storage-2

NO ISSUE SEVERITY 10 This App uses SSL certificate pinning to detect or prevent MITM attacks in secure communication channel. secure 11 The App uses ECB mode in Cryptographic encryption algorithm. ECB mode is known to be weak as it results in the same ciphertext for identical blocks of plaintext. high STANDARDS FILES OWASP MASVS: MSTG-NETWORK-4 CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm OWASP Top 10: M5: Insufficient Cryptography OWASP MASVS: MSTG-CRYPTO-2 com/example/a2bclient/ApiClient.java com/example/a2bclient/ProdCrypto.java  NIAP ANALYSIS v1.3 NO IDENTIFIER REQUIREMENT FEATURE DESCRIPTION  BEHAVIOUR ANALYSIS RULE ID BEHAVIOUR LABEL FILES 00013 Read file and put it into a stream file okio/Okio__JvmOkioKt.java  ABUSED PERMISSIONS

• https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4
• https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-block-cipher-mode

TYPE MATCHES PERMISSIONS Malware Permissions 3/25 android.permission.INTERNET, android.permission.ACCESS_FINE_LOCATION, android.permission.READ_EXTERNAL_STORAGE Other Common Permissions 0/44 Malware Permissions: Top permissions that are widely abused by known malware. Other Common Permissions: Permissions that are commonly abused by known malware.  OFAC SANCTIONED COUNTRIES This app may communicate with the following OFAC sanctioned list of countries. DOMAIN COUNTRY/REGION  DOMAIN MALWARE CHECK DOMAIN STATUS GEOLOCATION docs.a2b-demo.example.com ok No Geolocation information available. metrics.internal.a2b-demo.example.com ok No Geolocation information available. admin.a2b-demo.example.com ok No Geolocation information available.

DOMAIN STATUS GEOLOCATION legacy.a2b-demo.example.com ok No Geolocation information available. api.a2b-demo.example.com ok No Geolocation information available.  HARDCODED SECRETS POSSIBLE SECRETS 258EAFA5-E914-47DA-95CA-C5AB0DC85B11  SCAN LOGS Timestamp Event Error 2026-10-21 01:53:58 Generating Hashes OK 2026-10-21 01:53:58 Extracting APK OK 2026-10-21 01:53:58 Unzipping OK 2026-10-21 01:53:58 Parsing APK with androguard OK

2026-10-21 01:53:58 Extracting APK features using aapt/aapt2 OK 2026-10-21 01:53:58 Getting Hardcoded Certificates/Keystores OK 2026-10-21 01:54:00 Parsing AndroidManifest.xml OK 2026-10-21 01:54:00 Extracting Manifest Data OK 2026-10-21 01:54:00 Manifest Analysis Started OK 2026-10-21 01:54:00 Reading Network Security config from network_security_config.xml OK 2026-10-21 01:54:00 Parsing Network Security config OK 2026-10-21 01:54:00 Performing Static Analysis on: A2B Client (com.example.a2bclient) OK 2026-10-21 01:54:00 Fetching Details from Play Store: com.example.a2bclient OK 2026-10-21 01:54:00 Checking for Malware Permissions OK

2026-10-21 01:54:00 Fetching icon path OK 2026-10-21 01:54:00 Library Binary Analysis Started OK 2026-10-21 01:54:01 Reading Code Signing Certificate OK 2026-10-21 01:54:01 Running APKiD 3.1.0 OK 2026-10-21 01:54:05 Detecting Trackers OK 2026-10-21 01:54:06 Decompiling APK to Java with JADX OK 2026-10-21 01:54:15 Converting DEX to Smali OK 2026-10-21 01:54:15 Code Analysis Started on - java_source OK 2026-10-21 01:54:15 Android SBOM Analysis Completed OK 2026-10-21 01:54:18 Android SAST Completed OK

2026-10-21 01:54:18 Android API Analysis Started OK 2026-10-21 01:54:20 Android API Analysis Completed OK 2026-10-21 01:54:20 Android Permission Mapping Started OK 2026-10-21 01:54:22 Android Permission Mapping Completed OK 2026-10-21 01:54:22 Android Behaviour Analysis Started OK 2026-10-21 01:54:24 Android Behaviour Analysis Completed OK 2026-10-21 01:54:24 Extracting Emails and URLs from Source Code OK 2026-10-21 01:54:25 Email and URL Extraction Completed OK 2026-10-21 01:54:25 Extracting String data from APK OK 2026-10-21 01:54:25 Extracting String data from Code OK 2026-10-21 01:54:25 Extracting String values and entropies from Code OK

2026-10-21 01:54:25 Performing Malware check on extracted domains OK 2026-10-21 01:54:29 Saving to Database OK Report Generated by - MobSF v4.5.4 Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. © 2026 Mobile Security Framework - MobSF | Ajin Abraham | OpenSecurity.

• https://ajinabraham.com
• https://opensecurity.in