search

ClaudiuGeorgiu / Obfuscapk

An automatic obfuscation tool for Android apps that works in a black-box fashion, supports advanced obfuscation features and has a modular architecture easily extensible with new techniques
MIT License
1.09k stars 285 forks source link

Antivirus app determine obfuscated app as a threat #149

Closed risaruno closed 1 year ago

risaruno commented 1 year ago

I test my app before and after obfuscating, The obfuscated version has been caught as a threat by an app named Dr. Capsule, which is an antivirus application. Even just a Rebuild, NewAlignment, NewSignature option that has been applied, this Dr. Capsule catches the same thing on the obfuscated version, while the unobfuscated version is doing well. I'm not sure if this Dr. Capsule app is a problem, or if obfuscating simply means that the data might be damaged and make an antivirus determine it as a threat.

Screenshot_20221214-121812_DrCapsule

I've also tried installing other several antivirus apps that I know of. But, it seems to be just the Dr. Capsule app catching the obfuscated app as a threat.

ClaudiuGeorgiu commented 1 year ago

I suspect this is caused by the keystore used to sign the obfuscated apk: since many people probably used this tool to obfuscate malicious apps, now every app signed with Obfuscapk's keystore is detected as dangerous. You can try using another keystore to sign the app and check if it's still detected by the antivirus.

More information can also be found in the first entry of the FAQs.

risaruno commented 1 year ago

I didn't think about that. I've tested it with my keystore, and now the antivirus doesn't see the obfuscated app as a threat. Thank you for your quick responses. Appreciate it.