APK Malware Analysis: A Static Triage Worksheet
Static APK malware analysis examines a package without executing it. The goal of an initial triage is to produce testable observations: suspicious.
Security & malware
APK Suspicious Behavior Scanner
Surface suspicious behaviors in an APK — risky API combinations, permissions, and patterns worth a closer look.
APK Suspicious Behavior Scanner is part of APKLint, an online toolkit for inspecting Android APK files. Surface suspicious behaviors in an APK — risky API combinations, permissions, and patterns worth a closer look. Upload an APK in your browser to view the relevant details; results reflect what the file itself exposes.
Drop your file here
or click to choose from your device
Accepts: .APK · up to 1 GB
Deleted after your scan. Files you upload are processed on our servers over an encrypted connection, then removed by the next hourly cleanup after analysis finishes (long scans are protected while they run). We never share them, and need no account.
About APK Suspicious Behavior Scanner
Surface suspicious behaviors in an APK — risky API combinations, permissions, and patterns worth a closer look.
APK Suspicious Behavior Scanner is part of APKLint’s security & malware toolkit — Find risky behavior, trackers, and suspicious patterns. It’s free to use and needs no account.
Your privacy is the default: files you upload are processed on our servers over an encrypted connection and permanently deleted by a scheduled hourly cleanup after analysis finishes, and never shared.
What APK Suspicious Behavior Scanner checks
- Suspicious API/string combinations via YARA
- Packer and obfuscation indicators
- Risky behaviors: dynamic code loading, accessibility abuse, overlays
- ClamAV signature match where available
Good to know: Surfaces behaviors worth a closer look; it doesn't deliver a malware verdict.
When to use APK Suspicious Behavior Scanner
- Best for
- Surfacing suspicious behavior in an APK, risky API combinations, dangerous permission clusters, and known-bad patterns, when you want a behavior-and-signature read.
- Not the right tool for
- Not a guarantee of safety and not a structural breakdown; treat a clean result as 'no known indicators', not 'proven safe'.
- What you get back
- Flagged suspicious behaviors and a signature/heuristic read (including ClamAV/YARA where relevant), with the matched indicators.
- How it differs from related APKLint tools
- APK Virus Scanner is the same engine in plainer 'is it a virus' language; this page leans into behavioral indicators and is aimed at a more technical reader.
- Limitations
- Signature and heuristic scanning only catches known malware and patterns; pair it with Google Play Protect for a definitive check.
How to use APK Suspicious Behavior Scanner
- Choose your APK file — Drop an .apk file onto the page, or click to select it from your device.
- Send securely — The file is uploaded over an encrypted connection to our analysis servers.
- Read your report — APKLint unpacks and inspects the package and lays out the results on screen.
- Your file is removed — It's deleted by an hourly cleanup job after analysis finishes.
Why use APKLint
Always free
Every tool is free with no login and no paywall. Reasonable file and input limits keep the free service stable.
No on-page ad banners
A clean, focused interface with no third-party ad banners cluttering your results.
Privacy-first
Files you upload are deleted by a scheduled hourly cleanup after analysis finishes, and never shared.
Open-source engines
Built on ClamAV signature scanning, YARA heuristic indicators, and an androguard manifest-permission check.
No sign-up
Start immediately — no account, login, or email required.
Works anywhere
Runs in any modern browser, on desktop or mobile.
Frequently asked questions
What does APK Suspicious Behavior Scanner do?
Surface suspicious behaviors in an APK — risky API combinations, permissions, and patterns worth a closer look.
What's the difference from the Virus Scanner?
They share the engine but this view leads with behavioral indicators (risky API patterns), while the Virus Scanner leads with signature matches.
Is it free to use?
Yes. Every tool on APKLint is completely free, with no sign-up and no account.
How is my data handled?
Your uploaded file and its result are processed on our servers over an encrypted connection, then removed by the next hourly cleanup after analysis finishes. We never share them.
What files can I send?
An Android APK — a .apk file — up to 1 GB.
Related tools
All product names, logos, and trademarks are property of their respective owners. APKLint is an independent toolset and is not affiliated with, endorsed by, or sponsored by Google, Android, or any other party.