Hey AndroGuard, I Will Crash Your Python Buddy!
ID: 6c5df98a-d1fc-53e8-a559-3cc099a8f390
STIX ID: report--6c5df98a-d1fc-53e8-a559-3cc099a8f390
Feed Name: Zscaler Security Research Blog
Threat Score
This research post describes Android malware samples that exploit uncommon ZIP extra-field padding and Python zipfile unpacking alignment to crash AndroGuard during APK analysis, and that can return unexpected values from method search routines to hide risky behaviors like audio recording. The author demonstrates an example sample (MD5 supplied) with low AV detection, explains the root causes, and recommends updating to the Dec 2012 AndroGuard/zipfile.py patch that fixes the issue.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.