There it is. There's an app you've been pining over for months. And it's not on the Play Store! Maybe it was pulled, maybe it’s region-locked, maybe it’s some heavily modified version with exactly the extra features you crave. So you grab the APK from some sketchy-looking website and hover your finger over the 'Install' button. Your internal voice says, "Is this…safe?" That’s the voice that has probably saved more phones than any antivirus program. Sideloading an APK file isn’t inherently risky. Android was designed to do this, and tons of perfectly legit apps aren't on the store (F-Droid builds, beta programs, etc).
APKs, however, are an easy platform for malware to creep in because, unlike on the Play Store, no one's scanning the file before it lands on your phone. That's how you inadvertently get malware on your phone.
Read on for a breakdown of exactly how to know whether your APK is safe, from super quick checks that anyone can do to in-depth technical analysis if you’re feeling adventurous. Let's get started!
Why APK Safety Checks Matter More Than You Think
But before we cover the "how", let's take a minute to address the "why", because that will make all the difference in how much care you apply to each subsequent step.
When you install a file via the Google Play Store, it gets a stamp of approval (more or less) by Play Protect, an automated malware scanner, and (for many applications) even human eyes. That process isn't foolproof, but it does mean the software you're installing has at least some degree of safety and legitimacy.
An APK file that you've downloaded from some obscure web site, on the other hand, doesn't have any of those safeguards. It's just a file that might be anything from:
- Original and legitimate app with no malware.
- A cracked or modded version of an app with cleverly hidden malware in it.
- A malicious app designed to look like an original app from above.
These malware-infested APK files are designed so that a general user cannot distinguish them from the original app. Even their UX is designed to match the original.
Step 1: Start With the Source (This Alone Filters Out Most Risk)
Before scanning the APK file, first see where you have sourced the file. This alone reduces the risk by many folds.
Trustworthy Sources
- Google Play Store: Undoubtedly the safest and the most reliable option.
- Official developer websites: Best option for apps not present on the Google Play Store.
- Reputable third-party stores: Reputable stores like APKMirror or F-Droid. These stores verify the APK files against the app's developer signatures.
- GitHub release pages: Official repository of the popular open source applications.
Red Flag Sources
- Websites and blogs offering premium unlocked versions of popular apps for free.
- Private forums and Telegram channels offering unverified or cracked versions of apps.
- Shortened links redirecting users to unknown destinations for unverified APK files.
- Shady websites littered with ads and download buttons pointing to random APK files.
Here's a simple rule to avoid downloading infected APK files. If a fully functional version of a premium app is being offered for free, it's the first red flag you shouldn't ignore.
Step 2: Verify the APK’s Digital Signature
Every Android app is digitally signed by its original developer before releasing it for the general public. It's more or less like a fingerprint of an app.
If the original APK is tampered with, this signature breaks, and that's how you can identify if the app is safe to use or not.
How to Check the Signature Using ADB
If you are comfortable with a command-line environment, this is one of the best and most reliable ways to check the signature of an APK file.
- Start by installing Android SDK Platform Tools on your computer system. It's available for Windows, Linux, and Mac.
- Open the terminal or command prompt window and switch to the folder containing the APK file.
- Now run this command:
And the output may look something like this:apksigner verify --print-certs yourapp.apkSigner #1 certificate DN: CN=Example Developer, O=Example Inc. Signer #1 certificate SHA-256 digest: a1b2c3d4e5f6... - All you have to do is compare the SHA-256 digest with the one provided by the app developer.
If the digests do not match, it's a tampered APK, and you should not install it on your phone.
Note: If you can't find the apksigner tool, search for it inside the build-tools folder of the SDK installation directory.
Step 3: Check the File Hash Against a Known-Good Value
Another powerful technique is to compare the locally generated file hash with the one provided by the app developer. Most open source or security app developers publish the file hash for verification purposes.
Here's how you can verify the integrity of an APK file using a file hash:
On Windows (PowerShell)
Get-FileHash yourapp.apk -Algorithm SHA256On macOS/Linux
shasum -a 256 yourapp.apkA long and cryptic alphanumeric string will be the output of these commands. Now compare it with the hash string provided by the app developer on the official website, or on the app's GitHub release page.
Both strings should 100% match. Even if one character does not match, do not use that APK file.
Step 4: Scan the APK With Multiple Antivirus Engines
Most people are aware of this method, but doing it correctly is what matters.
Using VirusTotal
VirusTotal is perhaps the only service that scans the uploaded files with 60+ antivirus engines at once. It gives you much confidence in assessing the integrity of the APK file.
- To get started, go to the website and upload the APK file. Free plan users can upload a maximum file size of 650MB, which is good enough for most users.
- Let the scan get completed.
- Assess the detection ratio. For example, a detection ratio of '2/68' implies 2 out of 68 antivirus engines have flagged the file as malicious.
How to interpret the results:
| Detection Ratio | What It Means |
|---|---|
| 0/68 | A clean file. Generally a good indication. |
| 1–3/68 flagged as 'generic' or 'heuristic' | More or less a false positive, specifically for modded or unofficial builds. |
| 5+/68 flagged with malware names | Risky to install these APKs. |
| Named detections (e.g., 'Trojan.AndroidOS.Agent') | 100% malware infested. Completely avoid them. |
Other Scanning Options
- Google’s Play Protect: It scans all the apps installed on your phone automatically. Even sideloaded apps are scanned automatically.
- MetaDefender Cloud: It's a similar service to VirusTotal. Do give it a try.
- Hybrid Analysis: Advanced users can run the APK in a sandbox to analyze its behaviour without risking an infection on the mobile device.
Step 5: Inspect App Permissions Before Installing
One of the ways to detect a harmful APK is to check the permissions it is seeking on the mobile device. Any unnecessary permission sought is a definite red flag.
Before installing, question yourself. Does the permission list of this app make sense?
Example: A Simple Flashlight App
| Permission Requested | Reasonable? |
|---|---|
| Camera (to control the flash) | ✅ Makes sense |
| Storage access | ⚠ Questionable |
| SMS read/send | 🚩 Major red flag |
| Contacts access | 🚩 Major red flag |
| Device admin privileges | 🚩 Serious red flag |
Why would a flashlight app need access to your texts and contacts? And asking for admin privileges is a huge red flag. This is how malware-infested apps damage your phone under the hood.
How to Check Permissions Before Installing
Before installing the app, extract its manifest to check the permissions. You can use the aapt2 tool to see these permissions. First, download and extract it on the desktop.
Thereafter, open the command prompt or terminal and run the following command:
aapt2 dump permissions yourapp.apk
Through this tool, you can list all the permissions an app may seek to function. Analyze all the listed permissions carefully before making a decision.
Step 6: Decompile and Inspect the Code (For the Tech Savvy)
Developers and technically sound individuals can take this approach to thoroughly check the source code of the app. It's one of the best ways to scrutinize an application's features and functions.
You'll need a tool called jadx to decompile and get the app's Java-like source code for analysis and scrutiny.
Using JADX Tool
- Download the JADX tool. It's a free and open-source application.
- Run it for the APK in question.
jadx yourapp.apk -d code_output - Now you can dive into the
code_outputfolder to inspect the source code files. - The following are some of the suspicious patterns you must look for:
- Hardcoded and cryptic URLs pointing to suspicious domains.
- Obfuscated code that has no reason to exist.
- Access attempts to SMS, contacts, or accessibility services that go against the nature or function of the app.
- Existence of embedded native libraries (
.sofiles) that have no clear origin.
You don't have to go through every single line of code. Scan for suspicious strings, viz., IP addresses, .onion links, encoded payloads, etc.
For a More Automated Approach: MobSF
Mobile Security Framework (MobSF) is a free and powerful tool that can help you automate the code scanning process to find vulnerabilities like:
- Unnecessary permissions
- Code-level vulnerabilities
- Embedded trackers
- Suspicious network behavior
To use it, first set up the environment.
docker pull opensecurity/mobsf
docker run -it -p 8000:8000 opensecurity/mobsfNow navigate to http://localhost:8000 and upload the APK file through the web interface. It'll scan and give you a complete security report for the app.
Step 7: Watch the App’s Behavior After Installation
Another handy method is to first install the app on a spare mobile device and see how the app behaves after the installation.
Best Practices for Safe Testing
- If you are dealing with an unknown APK, first install it either on a spare mobile device or run it within an Android emulator.
- Use applications like NetGuard or Wireshark to see where the app is sending the data on the network stream.
- After 2 to 3 days of usage, see if there's an unexpected spike in network and battery usage.
- Look for sudden pop-up ads or the app itself spawning unfamiliar background processes.
For those who don't have a spare mobile device, use the Android emulator bundled with Android Studio.
Common Mistakes People Make When Sideloading APKs
The following are some of the mistakes you may make while sideloading apps on your Android device:
- Taking a small file size as a parameter for a safe app. Malware has nothing to do with the file size. It can be hidden in the smallest-size APK files.
- Assuming a huge download count mentioned on a 3rd-party website is a signal of a safe and popular app. This data can be faked by these dodgy websites.
- Quickly approving permission-seeking prompts without even looking carefully at them.
- Disabling the Play Protect system permanently.
- And last but not least, trying out modded or cracked versions of the premium apps. This is a huge risk. Don't ever take this route.
Conclusion
Checking an APK sourced from an external source is a habit one must religiously follow. It can save your sensitive data from hackers.
Follow all the steps given above to ensure the APK you're installing on your Android device is safe to use.
But remember, no silver bullet guarantees 100% immunity from APKs sourced from unknown locations. Follow the best practices, check for safety, and you reduce the chances of getting infected by a compromised APK manyfold.
