Auto Secure LoginUpload an Android app. Get a plain-English malware verdict.
ASL APK Security accepts an APK, runs an antivirus preflight, recovers three independent static views of the app, and correlates them into a human-readable risk report — without ever installing, launching, emulating, or networking the app. It explains what an app can do and why it matters, points to the evidence, and is honest about its coverage limits. Reports export as JSON, Markdown, or HTML.
The problem
A permission list isn't a verdict.
When someone hands you a sideloaded or suspicious APK, the usual options are bad: run it in a sandbox and hope the containment holds, or squint at a permission list that tells you what's possible, not what's happening. Neither gives a reviewer something they can act on.
APK Security reads the app three different ways, correlates capabilities into attack-chains, and writes a verdict a human can actually use — while stating exactly where its visibility ends.
Honest by design
- "An aid, not proof" — stated on every report
- Coverage limits always disclosed
- Obfuscation, encryption, dynamic & native code = blind spots
- "No finding" is never the same as "safe"
- Reports contain no
<script>and never leak host paths
Capabilities
Three views, one correlated story.
ClamAV preflight
Scans the original bytes first — a known-malware hit goes straight to Critical while the worker keeps collecting evidence.
Three static engines
JADX 1.5.5, apktool 3.0.2, and bounded resource extraction — three independent recoveries of what the app contains.
48-rule catalog
DEX, behavioral, manifest, and API rules — one rule maps to one behavior across engines, so signals agree.
10 attack-chain rules
Higher-order chains like credential-theft, dropper, ransomware, and remote-control that connect individual behaviors.
Capability correlation
Permissions, components, APIs, persistence, exfil, exec, endpoints, evasion, and native code correlated into purpose → capabilities → sequence.
Two-process isolation
The worker runs with PrivateNetwork and a single job slot — the analyzer itself can't phone home.
Privacy-preserving ownership
ASL OIDC PKCE role-gating with HMAC ownership — no raw usernames stored against a job.
Ephemeral by default
The raw APK is deleted after the job and reports expire in 24 hours, with hard ceilings (250 MiB, 2 jobs, zip-bomb guard).
Native companion
A native Android app (AppAuth PKCE, Keystore) plus a separate offline Android Security Lab for Windows.
Judge an app without trusting it.
Three independent static views, correlated attack-chains, and a plain-English verdict — with the blind spots stated out loud.