# Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
## 3 The Proposed Hybrid-Based Analysis for Ransomware Detection
### Static Analysis Phase  
Static analysis scans the source code of a malicious program without executing it in an attempt to conclude its behavior and attributes. Thus, static analysis has many benefits. One of the most important benefits of applying static analysis is the discovery of the potential behavioral scenarios related to malicious software. This is due to the possibility of examining the complete source code, even the parts that are not executed, thus achieving full code coverage [42]. Another benefit of static analysis is that it is safer than dynamic analysis since it does not require the execution of the application. Furthermore, the cost of performing static analysis is less than the dynamic with an acceptable performance [43].  
The static analysis phase was implemented by employing the scanning features provided by the VirusTotal platform ([[https://www.virustotal.com/](https://www.virustotal.com/)]([https://www.virustotal.com/](https://www.virustotal.com/)), accessed on 28 August 2021) utilizing more than 70 antivirus engines [44]. Initially, the ransomware APKs were submitted to VirusTotal in order to check the total number of available engines, the total number of engines that detect the uploaded sample as malware, and the total number of engines that cannot detect the malware. Furthermore, among the detected engines, textual analysis was performed to search for keywords indicating the ransomware family type in the names generated by the detected engines, such as \"Rans\", \"Ransome\", \"Lock\", \"Locker\", and \"Encode\". This step aims to determine how accurate these engines are in identifying the submitted samples as ransomware apps. Moreover, the generated static features, such as permissions, API level, size, and other information, are recorded for further investigation.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**S/N**} & \multirow{2}{*}{**Tool Name**} & \multirow{2}{*}{**Analysis Type**} & \multirow{2}{*}{**Extracted Features**} & \multicolumn{2}{c}{**Published in Other Research**} & \multirow{2}{*}{**Research Article**} & \multirow{2}{*}{**Availability**} & \multirow{2}{*}{**Released Year**} & \multirow{2}{*}{**Categ**} \\ \hline
14 & \
\begin{tabular}{c} Nviso APK \\ Scan \\ \end{tabular} & Hybrid &
\begin{tabular}{c} Not \\ mentioned \\ \end{tabular} & Yes & [30] & No & 2013 & Online/free \\ \hline
15 & \
\begin{tabular}{c} \\ \end{tabular} &
\begin{tabular}{c} Privacy- \\ sensitive \\ data which \\ include \\ location, \\ camera, microphone \\ and \\ message \\ \end{tabular} & Yes & [37] & No longer working & 2013 & Online/free \\ \hline
16 & \begin{tabular}{c} \\ \end{tabular} & Hybrid & \
\begin{tabular}{c} Permissions, \\ entry \\ points \\ activities, \\ content \\ providers \\ and \\ services \\ \end{tabular} & Yes & [28] & - & 2013 &
\begin{tabular}{c} Online/ \\ Commercial \\ \end{tabular} \\ \hline
17 & \begin{tabular}{c} Crowdroid \\ \end{tabular} & \begin{tabular}{c} Static (for \\ android applications)/ \\ dynamic \\ \end{tabular} & \begin{tabular}{c} System \\ calls \\ \end{tabular} & Yes & [33] & \
\begin{tabular}{c} last update in \\ 2013 \\ \end{tabular} & 2011 &
\begin{tabular}{c} Online/ \\ commercial \\ \end{tabular} \\ \hline
18 & \begin{tabular}{c} Ostorlab \\ \end{tabular} & Dynamic & \
\begin{tabular}{c} Not \\ mentioned \\ \end{tabular} & Yes & [40] & 2020 & 2018 &
\begin{tabular}{c} Online/ \\ commercial \\ \end{tabular} \\ \hline
19 & \
\begin{tabular}{c} DroidBox \\ \end{tabular} & Dynamic &
\begin{tabular}{c} Hashes, \\ network \\ data, permissions and API \\ \end{tabular} & Yes & [41] & This project is abandoned & 2015 & Installation on PC/free \\ \hline \hline \end{tabular}
\end{table}
Table 2: _Cont._