---
title: MobSFレポート
tags: 
author: [KAZI](https://www.docswell.com/user/4342605229)
site: [Docswell](https://www.docswell.com/)
thumbnail: https://bcdn.docswell.com/page/V7P39ZV3J8.jpg?width=480
description: Mantis 検証用の脆弱性仕込みAndroidアプリのレポート
published: November 02, 26
canonical: https://www.docswell.com/s/4342605229/53JV4L-2026-11-02-112331
---
# Page. 1

![Page Image](https://bcdn.docswell.com/page/V7P39ZV3J8.jpg)

ANDROID STATIC ANALYSIS REPORT
 A2B Client (1.0)


# Page. 2

![Page Image](https://bcdn.docswell.com/page/2JV4MWZN7Q.jpg)

File Name:
app-debug.apk
Package Name:
com.example.a2bclient
Scan Date:
Oct. 21, 2026, 1:53 a.m.
App Security Score:
34/100 (HIGH RISK)
Grade:
C


# Page. 3

![Page Image](https://bcdn.docswell.com/page/5EG1GD45JL.jpg)

 FINDINGS SEVERITY
 HIGH
 MEDIUM
 INFO
 SECURE
 HOTSPOT
12
10
0
3
1
 FILE INFORMATION
File Name: app-debug.apk
Size: 6.0MB
MD5: f93d86963c28a4df3361b85022bbabb2
SHA1: a0d4985e1cf0ca982be059898f69a52073de6110
SHA256: 519a3c62e6d702b55970c2a88497fb2854df4585d3a48cf85773de82e5e9e707
 APP INFORMATION
App Name: A2B Client
Package Name: com.example.a2bclient
Main Activity: com.example.a2bclient.MainActivity
Target SDK: 34
Min SDK: 24
Max SDK:
Android Version Name: 1.0
Android Version Code: 1


# Page. 4

![Page Image](https://bcdn.docswell.com/page/4JQDX1GL7P.jpg)

 APP COMPONENTS
Activities: 2
Services: 0
Receivers: 1
Providers: 1
Exported Activities: 1
Exported Services: 0
Exported Receivers: 1
Exported Providers: 0
 CERTIFICATE INFORMATION
Binary is signed
v1 signature: False
v2 signature: True
v3 signature: False
v4 signature: False
v3.1 signature: False
v3.2 signature: False
X.509 Subject: CN=Android Debug, O=Android, C=US
Signature Algorithm: rsassa_pkcs1v15
Valid From: 2026-10-21 01:53:23+00:00
Valid To: 2056-10-13 01:53:23+00:00
Issuer: CN=Android Debug, O=Android, C=US
Serial Number: 0x1
Hash Algorithm: sha256
md5: ac824259d84a0ecc78eceb65fa7dc5a4
sha1: 374e24db8064b64a91fbf271a8f95c57c9af74c3
sha256: 1107e5a92d2af6a3107faa9d08d0b49d1c0deb63e7c4061c641769843472a8d8
sha512: c66cf0ef6447d4491ddd79e25c08efd0350dd4efdafce10d7a6db696f2ee058a705cee38990ddc30e6a5d34784698fe730480a1b8e0ad2f787cb96bfa06c528f
PublicKey Algorithm: rsa
Bit Size: 2048
Fingerprint: ae47d478d1dc15ca856c23ad5889f6789a288573426ccb84b3690e2308736e08
Found 1 unique certificates


# Page. 5

![Page Image](https://bcdn.docswell.com/page/K74Z6R55E1.jpg)

 APPLICATION PERMISSIONS
PERMISSION
STATUS
INFO
DESCRIPTION
normal
full
Internet
access
Allows an application to create network sockets.
dangerous
fine (GPS)
location
Access fine location sources, such as the Global
Positioning System on the phone, where available.
Malicious applications can use this to determine where
you are and may consume additional battery power.
android.permission.READ_EXTERNAL_STORAGE
dangerous
read
external
storage
contents
Allows an application to read from external storage.
com.example.a2bclient.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
unknown
Unknown
permission
Unknown permission from android reference
android.permission.INTERNET
android.permission.ACCESS_FINE_LOCATION
 APKID ANALYSIS
FILE
DETAILS


# Page. 6

![Page Image](https://bcdn.docswell.com/page/LJ1RVQW2JG.jpg)

FILE
classes.dex
DETAILS
FINDINGS
DETAILS
Anti-VM Code
Build.FINGERPRINT check
Build.MODEL check
Build.MANUFACTURER check
Compiler
r8
FINDINGS
DETAILS
Compiler
unknown (please file detection issue!)
classes2.dex
FINDINGS
DETAILS
Compiler
r8
FINDINGS
DETAILS
Compiler
r8
classes3.dex
classes4.dex


# Page. 7

![Page Image](https://bcdn.docswell.com/page/GJW1LM62E2.jpg)

 NETWORK SECURITY
HIGH: 3 | WARNING: 2 | INFO: 0 | SECURE: 1
NO
SCOPE
SEVERITY
DESCRIPTION
1
*
secure
Base config is configured to disallow clear text traffic to all domains.
2
*
warning
Base config is configured to trust system certificates.
3
legacy.a2b-demo.example.com
high
Domain config is insecurely configured to permit clear text traffic to these domains in scope.
4
docs.a2b-demo.example.com
high
Domain config is insecurely configured to permit clear text traffic to these domains in scope.
5
docs.a2b-demo.example.com
warning
Domain config is configured to trust system certificates.
6
docs.a2b-demo.example.com
high
Domain config is configured to trust user installed certificates.
 CERTIFICATE ANALYSIS
HIGH: 1 | WARNING: 0 | INFO: 1
TITLE
SEVERITY
DESCRIPTION
Signed Application
info
Application is signed with a code signing certificate
Application signed with debug
certificate
high
Application signed with a debug certificate. Production application must not be shipped with a debug
certificate.


# Page. 8

![Page Image](https://bcdn.docswell.com/page/4EZPMQY4J3.jpg)

 MANIFEST ANALYSIS
HIGH: 3 | WARNING: 3 | INFO: 0 | SUPPRESSED: 0
NO
1
2
3
4
5
ISSUE
App can be installed on a vulnerable unpatched Android version 7.0,
[minSdk=24]
Clear text traffic is Enabled For App[android:usesCleartextTraffic=true]
App has a Network Security
Configuration[android:networkSecurityConfig=@xml/network_security_config]
Debug Enabled For App [android:debuggable=true]
Application Data can be Backed up [android:allowBackup=true]
SEVERITY
DESCRIPTION
high
This application can be installed on an older version of
android that has multiple unfixed vulnerabilities. These
devices won't receive reasonable security updates from
Google. Support an Android version => 10, API 29 to
receive reasonable security updates.
high
The app intends to use cleartext network traffic, such as
cleartext HTTP, FTP stacks, DownloadManager, and
MediaPlayer. The default value for apps that target API
level 27 or lower is "true". Apps that target API level 28 or
higher default to "false". The key reason for avoiding
cleartext traffic is the lack of confidentiality, authenticity,
and protections against tampering; a network attacker
can eavesdrop on transmitted data and also modify it
without being detected.
info
The Network Security Configuration feature lets apps
customize their network security settings in a safe,
declarative configuration file without modifying app
code. These settings can be configured for specific
domains and for a specific app.
high
Debugging was enabled on the app which makes it
easier for reverse engineers to hook a debugger to it.
This allows dumping a stack trace and accessing
debugging helper classes.
warning
This flag allows anyone to backup your application data
via adb. It allows users who have enabled USB debugging
to copy application data off of the device.


# Page. 9

![Page Image](https://bcdn.docswell.com/page/Y76MN6DGEV.jpg)

NO
ISSUE
SEVERITY
DESCRIPTION
6
Activity (com.example.a2bclient.DocsWebViewActivity) is not Protected.
[android:exported=true]
warning
An Activity is found to be shared with other apps on the
device therefore leaving it accessible to any other
application on the device.
warning
A Broadcast Receiver is found to be shared with other
apps on the device therefore leaving it accessible to any
other application on the device. It is protected by a
permission which is not defined in the analysed
application. As a result, the protection level of the
permission should be checked where it is defined. If it is
set to normal or dangerous, a malicious application can
request and obtain the permission and interact with the
component. If it is set to signature, only applications
signed with the same certificate can obtain the
permission.
7
Broadcast Receiver (androidx.profileinstaller.ProfileInstallReceiver) is
Protected by a permission, but the protection level of the permission should
be checked. <strong>Permission: </strong>android.permission.DUMP
[android:exported=true]
 CODE ANALYSIS
HIGH: 5 | WARNING: 5 | INFO: 0 | SECURE: 1 | SUPPRESSED: 0
NO
ISSUE
SEVERITY
STANDARDS
FILES
1
Files may contain hardcoded
sensitive information like usernames,
passwords, keys etc.
warning
CWE: CWE-312: Cleartext Storage of Sensitive
Information
OWASP Top 10: M9: Reverse Engineering
OWASP MASVS: MSTG-STORAGE-14
com/example/a2bclient/ApiService.java
com/example/a2bclient/BuildConfig.java
2
IP Address disclosure
warning
CWE: CWE-200: Information Exposure
OWASP MASVS: MSTG-CODE-2
com/example/a2bclient/Backends.java
com/example/a2bclient/BuildConfig.java


# Page. 10

![Page Image](https://bcdn.docswell.com/page/G75Z563XJ4.jpg)

NO
ISSUE
SEVERITY
STANDARDS
FILES
3
Debug configuration enabled.
Production builds must not be
debuggable.
high
CWE: CWE-919: Weaknesses in Mobile Applications
OWASP Top 10: M1: Improper Platform Usage
OWASP MASVS: MSTG-RESILIENCE-2
com/example/a2bclient/BuildConfig.java
high
CWE: CWE-327: Use of a Broken or Risky
Cryptographic Algorithm
OWASP Top 10: M5: Insufficient Cryptography
OWASP MASVS: MSTG-CRYPTO-4
com/example/a2bclient/LegacyCrypto.ja
va
warning
CWE: CWE-327: Use of a Broken or Risky
Cryptographic Algorithm
OWASP Top 10: M5: Insufficient Cryptography
OWASP MASVS: MSTG-CRYPTO-4
com/example/a2bclient/LegacyCrypto.ja
va
com/example/a2bclient/DocsWebViewA
ctivity.java
4
Weak Encryption algorithm used
5
MD5 is a weak hash known to have
hash collisions.
6
Insecure WebView Implementation.
Execution of user controlled code in
WebView is a critical Security Hole.
warning
CWE: CWE-749: Exposed Dangerous Method or
Function
OWASP Top 10: M1: Improper Platform Usage
OWASP MASVS: MSTG-PLATFORM-7
7
Ensure that user controlled URLs
never reaches the Webview. Enabling
file access from URLs in WebView can
leak sensitive information from the
file system.
warning
CWE: CWE-200: Information Exposure
OWASP Top 10: M1: Improper Platform Usage
OWASP MASVS: MSTG-PLATFORM-7
com/example/a2bclient/DocsWebViewA
ctivity.java
8
The file or SharedPreference is World
Writable. Any App can write to the file
high
CWE: CWE-276: Incorrect Default Permissions
OWASP Top 10: M2: Insecure Data Storage
OWASP MASVS: MSTG-STORAGE-2
com/example/a2bclient/AdminStore.jav
a
9
The file or SharedPreference is World
Readable. Any App can read from the
file
high
CWE: CWE-276: Incorrect Default Permissions
OWASP Top 10: M2: Insecure Data Storage
OWASP MASVS: MSTG-STORAGE-2
com/example/a2bclient/AdminStore.jav
a


# Page. 11

![Page Image](https://bcdn.docswell.com/page/9J2RNMZQ7R.jpg)

NO
ISSUE
SEVERITY
10
This App uses SSL certificate pinning
to detect or prevent MITM attacks in
secure communication channel.
secure
11
The App uses ECB mode in
Cryptographic encryption algorithm.
ECB mode is known to be weak as it
results in the same ciphertext for
identical blocks of plaintext.
high
STANDARDS
FILES
OWASP MASVS: MSTG-NETWORK-4
CWE: CWE-327: Use of a Broken or Risky
Cryptographic Algorithm
OWASP Top 10: M5: Insufficient Cryptography
OWASP MASVS: MSTG-CRYPTO-2
com/example/a2bclient/ApiClient.java
com/example/a2bclient/ProdCrypto.java
 NIAP ANALYSIS v1.3
NO
IDENTIFIER
REQUIREMENT
FEATURE
DESCRIPTION
 BEHAVIOUR ANALYSIS
RULE ID
BEHAVIOUR
LABEL
FILES
00013
Read file and put it into a stream
file
okio/Okio__JvmOkioKt.java
 ABUSED PERMISSIONS


# Page. 12

![Page Image](https://bcdn.docswell.com/page/DEYDPXRYEM.jpg)

TYPE
MATCHES
PERMISSIONS
Malware Permissions
3/25
android.permission.INTERNET, android.permission.ACCESS_FINE_LOCATION,
android.permission.READ_EXTERNAL_STORAGE
Other Common
Permissions
0/44
Malware Permissions:
Top permissions that are widely abused by known malware.
Other Common Permissions:
Permissions that are commonly abused by known malware.
 OFAC SANCTIONED COUNTRIES
This app may communicate with the following OFAC sanctioned list of countries.
DOMAIN
COUNTRY/REGION
 DOMAIN MALWARE CHECK
DOMAIN
STATUS
GEOLOCATION
docs.a2b-demo.example.com
ok
No Geolocation information available.
metrics.internal.a2b-demo.example.com
ok
No Geolocation information available.
admin.a2b-demo.example.com
ok
No Geolocation information available.


# Page. 13

![Page Image](https://bcdn.docswell.com/page/VJN651DRJ8.jpg)

DOMAIN
STATUS
GEOLOCATION
legacy.a2b-demo.example.com
ok
No Geolocation information available.
api.a2b-demo.example.com
ok
No Geolocation information available.
 HARDCODED SECRETS
POSSIBLE SECRETS
258EAFA5-E914-47DA-95CA-C5AB0DC85B11
 SCAN LOGS
Timestamp
Event
Error
2026-10-21 01:53:58
Generating Hashes
OK
2026-10-21 01:53:58
Extracting APK
OK
2026-10-21 01:53:58
Unzipping
OK
2026-10-21 01:53:58
Parsing APK with androguard
OK


# Page. 14

![Page Image](https://bcdn.docswell.com/page/YE9LY5GZ73.jpg)

2026-10-21 01:53:58
Extracting APK features using aapt/aapt2
OK
2026-10-21 01:53:58
Getting Hardcoded Certificates/Keystores
OK
2026-10-21 01:54:00
Parsing AndroidManifest.xml
OK
2026-10-21 01:54:00
Extracting Manifest Data
OK
2026-10-21 01:54:00
Manifest Analysis Started
OK
2026-10-21 01:54:00
Reading Network Security config from network_security_config.xml
OK
2026-10-21 01:54:00
Parsing Network Security config
OK
2026-10-21 01:54:00
Performing Static Analysis on: A2B Client (com.example.a2bclient)
OK
2026-10-21 01:54:00
Fetching Details from Play Store: com.example.a2bclient
OK
2026-10-21 01:54:00
Checking for Malware Permissions
OK


# Page. 15

![Page Image](https://bcdn.docswell.com/page/GE8X6Y8YJD.jpg)

2026-10-21 01:54:00
Fetching icon path
OK
2026-10-21 01:54:00
Library Binary Analysis Started
OK
2026-10-21 01:54:01
Reading Code Signing Certificate
OK
2026-10-21 01:54:01
Running APKiD 3.1.0
OK
2026-10-21 01:54:05
Detecting Trackers
OK
2026-10-21 01:54:06
Decompiling APK to Java with JADX
OK
2026-10-21 01:54:15
Converting DEX to Smali
OK
2026-10-21 01:54:15
Code Analysis Started on - java_source
OK
2026-10-21 01:54:15
Android SBOM Analysis Completed
OK
2026-10-21 01:54:18
Android SAST Completed
OK


# Page. 16

![Page Image](https://bcdn.docswell.com/page/LEL894R97R.jpg)

2026-10-21 01:54:18
Android API Analysis Started
OK
2026-10-21 01:54:20
Android API Analysis Completed
OK
2026-10-21 01:54:20
Android Permission Mapping Started
OK
2026-10-21 01:54:22
Android Permission Mapping Completed
OK
2026-10-21 01:54:22
Android Behaviour Analysis Started
OK
2026-10-21 01:54:24
Android Behaviour Analysis Completed
OK
2026-10-21 01:54:24
Extracting Emails and URLs from Source Code
OK
2026-10-21 01:54:25
Email and URL Extraction Completed
OK
2026-10-21 01:54:25
Extracting String data from APK
OK
2026-10-21 01:54:25
Extracting String data from Code
OK
2026-10-21 01:54:25
Extracting String values and entropies from Code
OK


# Page. 17

![Page Image](https://bcdn.docswell.com/page/4JM6ZKRVEW.jpg)

2026-10-21 01:54:25
Performing Malware check on extracted domains
OK
2026-10-21 01:54:29
Saving to Database
OK
Report Generated by - MobSF v4.5.4
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment
framework capable of performing static and dynamic analysis.
© 2026 Mobile Security Framework - MobSF | Ajin Abraham | OpenSecurity.