2026-04-15 –, Amphitheater
APK malformation has ceased to be a niche evasion tactic; it is now the de facto standard for anti-analysis in the modern Android threat landscape. Implemented by default in the vast majority of Malware-as-a-Service (MaaS) builders and crypters, this technique allows families like TeaBot, TrickMo, and SpyNote to exploit Android's installation leniency while crippling traditional static analysis tools. By intentionally corrupting the APK structure, Threat Actors cause standard parsers (e.g., JADX) to crash or yield incomplete data, effectively blinding analysts and breaking automated triage pipelines.
In this session, we will present a comprehensive dissection of these techniques, categorized into three pillars:
- ZIP Structure Manipulation: Exploiting parser discrepancies via Unsupported Compression Methods and deliberate Local File Header/Central Directory mismatches.
- AXML Obfuscation: Corrupting the AndroidManifest binary XML through Attribute Size Violations and String Pool manipulation to exploit parser rigidity.
- Asset Directory Abuse: Leveraging non-ASCII characters to induce path traversal errors.
Critically, the defensive landscape lacks consolidated tools to reliably handle these malformations. To bridge this gap, we introduce Malfixer, a specialized utility that has been developed and refined over the past two years within our threat intelligence operations. We will demonstrate how Malfixer detects and surgically repairs structural corruptions, restoring file integrity without altering the payload, to unblock large-scale triage and classification pipelines.
Finally, Malfixer will be officially released as open-source during this talk. This contribution aims to provide analysts with a standard for APK repair and to foster a collaborative framework, enabling the community to extend capabilities against future, yet unknown, malformation techniques.
Solid background in Penetration testing and modern malware analysis. His main research topics are threat intelligence and computer forensics. Nevertheless, he is passionate about binary exploitation, reverse engineering, and privilege escalation techniques. He now works as a principal malware analyst at Cleafy. He has spoken at Botconf 2023, Cert-EU 2023, BSides Cyprus 2023, FS-ISAC 2024, and Botconf 2025 as well as DEFCon 2025.
Federico is passionate about technology in general, with a deep interest in cybersecurity, particularly Penetration Testing, Malware Analysis, and Social Engineering. He's currently leading the Threat Intelligence Team and Incident Response at Cleafy. He oversees all activities related to monitoring and uncovering new threats and attack patterns used by malicious actors. He has spoken at HackInBO 2022, Botconf 2023, Cert-EU 2023, BSides Cyprus 2023, FS-ISAC 2024, Botconf 2025, DEFCON33 and other private events managed by CertFIN in the Italian territory.
Cybersecurity professional with experience in malware analysis and threat intelligence. I’m specialized in reverse engineering Windows and Android malware, gaining deep insights into malicious operations and behaviors. Currently, I am a Malware Analyst at Cleafy, focusing on analyzing and mitigating emerging mobile cyber threats.