Working on android malwares, i have faced many android malwares that typically contain urls which are bank phishing page. This type of malwares are growing in number so an automated detection system is really needed. The very first step to detect such malwares is url/link extraction.
One simple static approach is to decompile the app and search for strings beginning with "http" in source code. There are many tools and libraries such as stringoid, Diggy, NinjaDroid, Androguard and many others but as far as i have tested these tools, they can not detect obfuscated urls. For example, consider this code:
this.c = "/something"; this.d = new String(Base64.decode(Application.a, 0)); this.a.loadUrl(this.d + this.c);
It's clear that static analysis alone is insufficient so i'm looking for some other solutions. So far, i have seen some approaches in some articles that try to extract such obfuscated strings from android APK files. One example is ForceDROID that presents a hybrid (both static and dynamic) technique for extracting hidden information. This technique works by changing control flow conditions to execute a certain path. Another example is based on deobfuscation.
These techniques are all great but the problem is that there isn't any implementation of them available.
Unfortunately, i'm not skilled enough to implement such techniques. One approach i think of is to first use an deobfuscator such as simplify and then extract urls through static analysis (using the tools mentioned above).
What are other ways to automatically extract obfuscated urls? Is there any tools or library out there?