artifacts CLI toolkit for static triage of suspicious APKs

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/drego85/artifacts
• Blog Title: artifacts: CLI toolkit for static triage of suspicious APKs
• Suggested Section: 📱 Mobile Pentesting -> Android Applications Pentesting (static analysis / APK triage tooling) or 🤩 Basic Forensic Methodology -> Malware Analysis / Specific Software/File-Type Tricks

🎯 Content Summary

Title/Goal: artifacts is a Python 3.10+ CLI toolkit for static first-pass triage of suspicious Android APKs. It is meant to quickly surface high-signal artifacts (manifest indicators, strings/IOCs) and suggest likely malware families by comparing extracted features to a LiteJDB-backed dataset, before moving to heavyweight tooling such as Jadx, Bytecode-Viewer...

🔧 Technical Details

Robust APK extraction when ZIP parsers fail: If APKs are tampered/obfuscated and break standard ZIP tooling (e.g., Python zipfile), extract using apkInspector.headers.ZipEntry to unpack entries directly into a working directory, improving success on malformed ZIP structures during triage.

Manifest-first analysis from binary AXML: Decode AndroidManifest.xml directly from the APK even when stored as binary AXML with apkInspector.axml.parse_apk_for_manifest. This yields package/launcher activity and permission/component metadata quickly without needing full decompilation.

Family fingerprinting with explainable Jaccard scoring: Normalize manifest-derived indicators into separate buckets (permission, application, intent), compute per-bucket Jaccard similarity (|A∩B|/|A∪B|*100) against known-family reference sets, then avera...

🤖 Agent Actions

Summary:
Added a new static APK triage tool section for artifacts with key techniques (robust extraction, binary manifest decode, IOC/base64 decoding, Jaccard family scoring) and usage examples, plus references.

Files modified:

• src/mobile-pentesting/android-app-pentesting/README.md

Tests:

• Not run (not requested).

If you want, I can also cross-link this tool from a dedicated static analysis subsection or add a brief checklist item.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/drego85/artifacts

Content Categories: Based on the analysis, this content was categorized under "📱 Mobile Pentesting -> Android Applications Pentesting (static analysis / APK triage tooling) or 🤩 Basic Forensic Methodology -> Malware Analysis / Specific Software/File-Type Tricks".

Repository Maintenance:

• MD Files Formatting: 949 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0