The 47-Point APK Scanner.
A versioned, signed, publicly auditable methodology that runs against every upload before it reaches the basket — release-tagged, diff-checked, and timestamped.
A transparent scan, not a black box.
Every APK uploaded to APKBasket is pushed through the same 47-point checklist before it appears in the public index. The scan is open by design: each check is named, versioned, and reproducible. Each published listing ships with the diffed manifest, the original developer signature chain, a VirusTotal cross-report, and a pinned changelog — so a security researcher, journalist, or developer can audit what we ran, when we ran it, and what we saw.
The scanner is maintained by APKBasket OÜ's reverse-engineering team — three analysts with a combined 19 years in mobile threat research, operating from Tallinn since 2018. The methodology is updated on a numbered release cycle (currently v4.7.2), with every change logged in a public diff. We do not promise zero malware; we promise no detected threats across our 47-point scan, with the full chain of evidence attached.
The seven scan categories.
The 47 checks are grouped into seven categories. Each check has an ID, a pass/fail rule, and a logged verdict attached to every listing. Researchers can audit coverage at a glance and compare against competing mirrors.
-
01
Malware
11 checks
Static + dynamic detection against known and emerging mobile threat families, including droppers, banking trojans, spyware, and repackaged variants observed across the wider Android ecosystem.
- Known family signature match
- Heuristic opcode behaviour
- Suspicious payload extraction
- Cross-reference to 2024 blocklist
-
02
Tamper
9 checks
Detects repackaging, injected DEX, modified resources, and overlay layers. Compares the upload against the upstream developer build where available, and flags structural drift on otherwise identical packages.
- DEX alignment integrity
- Resource manifest diff
- ZIP central directory audit
- Overlay / accessibility abuse
-
03
Signature
8 checks
Verifies the APK signature scheme (v1/v2/v3/v4), confirms the certificate chain matches the original developer key, and rejects uploads that have been re-signed with a different key — a strong repackaging signal.
- v1 + v2 + v3 scheme presence
- Cert chain to developer root
- Re-signing detection
- Key rotation log
-
04
Permissions
6 checks
Audits requested permissions against the app's declared functionality, flags dangerous permission combinations, and surfaces over-broad runtime requests that diverge from the upstream package baseline.
- Dangerous permission grouping
- SMS / Accessibility / Device-admin
- Background execution flags
- Permission delta vs upstream
-
05
Manifest
5 checks
Parses AndroidManifest.xml against the expected schema, flags hard-coded secrets, exported components with no auth gate, and debuggable builds released outside of an explicit beta channel.
- Exported component audit
- Debuggable flag check
- Hard-coded secret scan
- Manifest schema validation
-
06
Code
4 checks
Static analysis of the primary DEX — reflection calls, dynamic class loading, native library presence, and obfuscation patterns that correlate with observed malware families.
- Reflection / DexClassLoader use
- Native lib whitelist
- Anti-analysis patterns
- Obfuscation fingerprint
-
07
Network
4 checks
Inspects embedded URLs, C2 endpoints, and cert-pinning behaviour. Flags hard-coded IPs, plain-text endpoints, and resolved hostnames that appear on threat-intel feeds.
- Plain-text endpoint detection
- C2 IOC cross-reference
- Cert pinning audit
- Hard-coded IP rejection
What one verified listing actually contains.
A representative record for a single verified APK. Every field below is attached to the public listing — a security researcher can pull the same payload from the listing page and reproduce the verdict byte-for-byte.
{
"package": "com.example.app",
"version_name": "4.2.1",
"version_code": 402100,
"size_bytes": 28471936,
"sha256": "9f1c2b8a47d0e3a1c5b6a8e2f4d7c0a9b3e6f1c2b8a47d0e3a1c5b6a8e2f4d7c",
"signature": {
"scheme": "v2+v3",
"signer_cn": "CN=Example Software, O=Example Software Ltd, C=US",
"key_id": "9a3f1c2b8a47d0e3",
"original": true,
"resigned": false
},
"manifest_diff": {
"added": [],
"removed": ["READ_CONTACTS (deprecated upstream)"],
"modified": ["targetSdkVersion: 33 → 34"],
"exported_components": 4,
"debuggable": false
},
"virustotal": {
"engines_run": 72,
"malicious": 0,
"suspicious": 0,
"undetected": 72,
"report_url": "https://www.virustotal.com/file/9f1c2b.../"
},
"scan": {
"release": "v4.7.2",
"checks_run": 47,
"checks_passed": 47,
"checks_failed": 0,
"duration_sec": 612
},
"changelog": [
{ "version": "4.2.1", "date": "2024-12-11", "note": "Upstream release, signed by original developer" },
{ "version": "4.2.0", "date": "2024-11-28", "note": "Upstream release" }
],
"blocklist_match": false,
"evidence_url": "/listing/com.example.app/4.2.1/evidence.json"
}This record is what you, the researcher, see. The full evidence bundle — including the original VirusTotal report, the manifest diff side-by-side, and the developer signature chain — is downloadable from any listing page. No redaction, no registration.
Quantified throughput, coverage, and blocklist activity.
The methodology is operationally backed, not theoretical. The figures below are drawn from the trailing 12-month window and audited quarterly.
Apply the scan to a real APK.
Browse the verified index, pull the full evidence bundle from any listing, or watch the public queue and blocklist update in real time.