# Evaluation of Survivability of the Automatically Obfuscated Android Malware
## 3 Results
### Findings: Manual Dynamic Analysis  
The goal of this stage was to manually confirm the results obtained at the automated dynamic-analysis stage. The system calls were extracted to compare the behavior of original and obfuscated APKs, as all requests from malicious apps move through the system call interface before being processed. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Samples** & **Obfuscation** & **Execution Ratio** \\ \hline
5299 & Encryption & 79.39\% \\ \hline
5299 & Rename & 79.36\% \\ \hline
5299 & Code & 79.48\% \\ \hline
5299 & High & 70.48\% \\ \hline
5299 & Medium & 70.04\% \\ \hline
5299 & Low & 77.65\% \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Executability of Obfuscated samples seen under VirusTotal Droidy and R2 DBox results. \begin{table}
\begin{tabular}{c c c} \hline \hline
**APK** & **Permissions in the Original APK** & **Permissions in the Obfuscated Apk** \\ \hline xxxxB917 & 23 & 21 \\ \hline xxxxD1C8 & 5 & 4 \\ \hline xxxx7C07 & 15 & 9 \\ \hline xxxx93 FF & 10 & 10 \\ \hline xxxxD60C & 10 & 10 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Comparison of permissions in the manifest file of the original APK with the obfuscated APK. The APKs that were not executed at all called only nine basic system calls such as read app files, open app files, get process id, get file status, read the clock, and write operations on the files stored in the external storage. The original and malicious APKs that survived the obfuscation actively used process-related functions such as futex, getpid, getuid, gettid, sigprocmask, and prctl. These APKs used sendto() and recvfrom() system calls that are responsible for sending and receiving data from remote servers. Other heavily used system calls that were noticed while performing the manual dynamic analysis were related to accessing data and performing read-write operations on files stored in the external storage and performing memory functions such as read, write, open, close, fcnt64, dup, mmap, mmap, stat64, stat64, etc. These malicious system calls were used by both original and obfuscated malicious APK samples. Table 11 indicates the executability of APK samples manually analyzed with the _Strace_ tool in _Android Studio_. For detailed results, refer to the supplementary website: [[https://sites.google.com/concordia.ab.ca/evaluation-obfuscated-malware/executability-and-system-calls](https://sites.google.com/concordia.ab.ca/evaluation-obfuscated-malware/executability-and-system-calls)]([https://sites.google.com/concordia.ab.ca/evaluation-obfuscated-malware/executability-and-system-calls](https://sites.google.com/concordia.ab.ca/evaluation-obfuscated-malware/executability-and-system-calls)) (accessed on 1 May 2022). It shows that all obfuscation methods--High, Low, and Medium--impacted the executability of malicious APK samples. The Medium obfuscation method affected the executability the most and decreased it by 15.7%. The following two obfuscation strategies, High and Low, decreased executability by 12.8% and 10%, respectively. Surprisingly, the High strategy had less of an impact on the survival ratio compared to the Medium strategy. This can be explained by the relatively small sample that underwent manual verification. All other methods had a percentage of executability that was almost the same, i.e., near 70%. Moreover, some obfuscated APKs were successfully executed but affected the working of the Android OS. For instance, while analyzing the APK samples manually, it was noted that 7 % of APKs obfuscated using the High strategy, 5% were obfuscated using the Rename strategy, 4% with Encryption, and Medium obfuscated APKs froze or drastically slowed down the emulator. Furthermore, the system calls generated by the original and obfuscation methods were also recorded to identify any changes in their frequency. It was observed that APK samples obfuscated with High and Medium methods generated more system calls in 9% of the APK samples as compared to the original and other obfuscation techniques.