Analyzing Android DEX Malware
APK triage workflow: inventory DEX and native payloads, then decompile with jadx
Test report
- Verdict
- Works with setup
- Score
- Tested
- Aug 10, 2026
- Environment
- Claude Code 2.x (agent harness)
Ran the bundled inspector against a purpose-built multidex APK: it correctly listed classes.dex through classes3.dex, the arm64 libpayload.so and assets/config.enc, and raised all three triage flags including 'possible encrypted payload assets'. It also survived a real APK with no DEX at all and returned a clean 'not a ZIP/APK' error on a text file. The catch is that the script is essentially a classified 'unzip -l' — a plain unzip listing showed the same twelve entries, so the measurable gain over no skill is the auto-flagging plus the workflow's validation rules (tie every dangerous permission to a code path, dump dynamically loaded DEX rather than just noting it). Everything past step 1 depends on jadx and apktool, which the skill lists as prerequisites but neither bundles nor helps install; jadx was absent on the test machine, so the headline promise of decompiling DEX to readable Java could not be exercised. Useful as a checklist and a first-pass inventory, but budget time for the external toolchain.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 6/10
- Docs & honesty 4/5
What Analyzing Android DEX Malware does
A reverse-engineering workflow for suspicious Android apps: unpack the APK, audit the manifest for abused permissions and exported components, decompile DEX to Java, and chase dynamically loaded or native payloads to their IOCs. Ships a small Python inspector that inventories every DEX, .so and asset in the archive and flags multidex and likely encrypted payloads. Triggers on requests to analyze an APK, decompile DEX, or investigate a suspicious Android app.
How to install Analyzing Android DEX Malware
git clone https://github.com/meltedinhex/analyst-ai-pack.git
mkdir -p ~/.claude/skills
cd analyst-ai-pack && cp -r skills/analyzing-android-dex-malware ~/.claude/skills/analyzing-android-dex-malware
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Analyzing Android DEX Malware
-
/analyzing-android-dex-malwareAPK triage workflow: inventory DEX and native payloads, then decompile with jadx
It also activates on plain-language prompts like these:
-
Triage this suspicious multidex APK and list its DEX files -
Decompile this Android app and check for abused permissions -
Find the IOCs from this app's dynamically loaded native payload
Frequently asked questions
- Is the Analyzing Android DEX Malware skill free?
- Yes. The skill itself is free from meltedinhex/analyst-ai-pack. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Analyzing Android DEX Malware work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Aug 10, 2026. Verdict: Works with setup. Ran the bundled inspector against a purpose-built multidex APK: it correctly listed classes.dex through classes3.dex, the arm64 libpayload.so and assets/config.enc, and raised all three triage flags including 'possible encrypted payload assets'. It also survived a real APK with no DEX at all and returned a clean 'not a ZIP/APK' error on a text file. The catch is that the script is essentially a classified 'unzip -l' — a plain unzip listing showed the same twelve entries, so the measurable gain over no skill is the auto-flagging plus the workflow's validation rules (tie every dangerous permission to a code path, dump dynamically loaded DEX rather than just noting it). Everything past step 1 depends on jadx and apktool, which the skill lists as prerequisites but neither bundles nor helps install; jadx was absent on the test machine, so the headline promise of decompiling DEX to readable Java could not be exercised. Useful as a checklist and a first-pass inventory, but budget time for the external toolchain.
- What is the Analyzing Android DEX Malware SkillProof Score?
- 8.0/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 6/10, docs & honesty 4/5.
- How do I install Analyzing Android DEX Malware?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Analyzing Android DEX Malware with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.