app/services/copilot/knowledge/security/static-analysis-guide.md

# Static APK Analysis: Reading an App Without Running It

## What this means for you

Before Shield ever considers letting an app run, it can already learn a lot just by "reading" the app file itself — much like inspecting a package's contents and shipping label before opening it. This is called static analysis, because nothing is executed; Shield simply parses the APK's internal structure. It's fast, safe (nothing malicious ever actually runs during this step), and it's the first line of defense against fake or tampered banking apps, since it can immediately reveal whether an app's declared identity, permissions, or signing certificate look wrong.

## The mechanism: Androguard

Shield's static-analysis pass uses **Androguard**, an open-source tool for parsing Android APK files, to extract structured information directly from the app package without installing or executing it. Specifically, Androguard pulls out:

**The manifest** — every APK ships an `AndroidManifest.xml` describing what the app is and what it's allowed to do. Androguard parses this to get the package name (the app's unique identifier), the declared **min SDK** and **target SDK** versions (which Android versions the app supports/targets), and the full list of declared **activities, services, and receivers** — the components that make up the app's structure and entry points.

**Declared permissions** — the full list of Android permissions the app asks for, which is then handed off for permission-category analysis (see `permission-guide.md`) to check for combinations associated with banking malware, such as SMS access, Accessibility Service, or overlay permissions.

**Signing certificate details** — every Android app is cryptographically signed by its developer, and that signature is embedded in the APK. Androguard extracts the certificate's details (issuer, fingerprint, validity), which Shield then compares against known-legitimate certificates and against a reputation history of certificates seen across previously analyzed APKs (see `network-and-certificate-intelligence.md`).

## Why this catches fake and tampered apps

A genuine SBI YONO app is signed with SBI's real signing certificate, and its manifest, permissions, and package name follow a consistent, known pattern release after release. Fake or repackaged apps almost always diverge from this in at least one detectable way:

- **Wrong or unknown certificate** — an attacker cannot produce SBI's actual private signing key, so any fake or repackaged app is necessarily signed with a different certificate. This single fact is one of the strongest and most reliable signals static analysis can produce.
- **Mismatched package name or app identity** — a fake app may use a package name that's similar to but not exactly the real one, which static analysis surfaces directly.
- **Excess or mismatched permissions** — a repackaged version of a legitimate app that's had malicious code injected into it often ends up declaring extra permissions the original never needed (see `permission-guide.md`).
- **Unusual manifest structure** — extra or unexpected activities, services, and receivers can indicate injected malicious components bolted onto an otherwise legitimate-looking app.

## How it fits with the rest of the pipeline

Static analysis is deliberately the fastest and most foundational check in Shield's pipeline — it runs before or alongside pattern-matching (YARA/APKiD, see `yara-and-apkid-guide.md`) and the ML classifier (see `ml-classification-guide.md`), and its output (permissions, certificate, package identity) directly feeds the impersonation/fake-app detection engine, certificate reputation scoring, and the overall risk-fusion score described in `risk-score-guide.md`. Because it never executes the app, static analysis alone cannot observe what an app actually *does* at runtime — that's the role of dynamic analysis (see `dynamic-analysis-guide.md`) when it's enabled — but it reliably catches the identity and structural red flags that make up the majority of fake-app and repackaged-APK cases.