Analysis of Trojan APK

The video tutorial explains how Android applications request permissions, focusing on the Android Manifest XML file. It covers the distinction between normal and dangerous permissions and how users can revoke permissions starting from Android 6.0. The tutorial then delves into static malware analysis, using a Trojan APK as an example. It highlights the importance of checking permissions and activity tags in the manifest file. The video also demonstrates how to use keyword searches in JD GUI to identify potential malicious activities, such as external server connectivity through sockets and HTTP declarations.

What file is used by Android applications to declare the permissions they require?

• Config.json

• AndroidManifest.xml

• Manifest.doc

• Permissions.txt

Which type of permissions require explicit user approval in Android?

• Normal permissions

• Optional permissions

• Dangerous permissions

• System permissions

What can users do with app permissions starting from Android 6.0?

• Permissions cannot be changed

• Change permissions only through developer settings

• Revoke permissions at any time

• Grant permissions only during installation

What is a key indicator of potential malicious activity in an Android app?

• Presence of normal permissions

• Presence of a large number of files

• Use of activity tags

• Absence of permissions

What tool is used to analyze the classes declared by an Android application?

• Eclipse

• Visual Studio

• Android Studio

• JD GUI

What does the presence of a 'Socket' declaration in an app's code suggest?

• The app is reading user contacts

• The app is establishing a network connection

• The app is accessing the camera

• The app is using local storage

What might the presence of 'HTTP' in an app's code indicate?

• The app is connecting to an external server

• The app is accessing the file system

• The app is using GPS

• The app is using Bluetooth