Static analysis of Android applications using Androguard

Question

I am building a project a part of which involves performing static analysis for Android applications.

I know of Androguard and its tools that help in analyzing Android apks. But I am stuck and don't know how to proceed after this. For example, using androaxml tool of Androguard I can convert binary Android xml to readable AndroidManifest.xml.

Similarly Androapkinfo displays information such as permissions, services, activities on a given APK.

But how can I use this information and determine what makes this AndroidManifest.xml or apk malicious?

I am not looking for exact answers but more of helpful advice, a push in the right direction and some things I should be doing is all I ask

Answer 1

I would take a look into apkinspector. It puts together in an easy gui androguard and other helpful tools. It will let you look at permissions that the apk uses and track down exactly where those permissions are exercised.

I recommend following blogs and RSS feeds that relate to this topic(Google for this, you'll find some good resources). Find an interesting article that profiles a malicious apk. Obtain that apk and follow the analysis yourself.

See this SE question. Check out all the answers they all have pretty good resources for you.