Malicious URL Scanning

Malicious URL Scanning

HydraDragonAV Mobile scans files and APKs for embedded malicious URLs at rest, without network interception.

How It Works

1. URL Extraction: Every http(s):// URL is extracted from the raw bytes of the scanned file or APK.
2. XOR Filter Check: Each extracted URL is checked against native malware/phishing URL XOR filters loaded into memory.
3. Verdict: URLs matching known-malicious or known-phishing patterns are flagged.

┌──────────────────┐
│  File / APK      │
│  Raw Bytes       │
└────────┬─────────┘
         │
    ┌────▼────┐
    │ Extract │
    │ all URLs │
    │ via regex│
    └────┬────┘
         │
    ┌────▼────┐
    │ Check   │
    │ against │
    │ xor     │
    │ filters │
    └────┬────┘
         │
    ┌────▼────┐
    │ Match?  │
    └────┬────┘
         │
    ┌────┴────┐
    │  Yes    │        No
    │  ┌──────▼──┐  ┌──▼──┐
    │  │ Flagged │  │Clean│
    │  └─────────┘  └─────┘

Advantages Over Live Interception

Approach	URL Scanner (HydraDragon)	Live HTTPS Interception
CA cert required	No	Yes
Root required	No	No (but needs user to trust CA)
Works offline	Yes	No (requires live traffic)
Detects dormant malware	Yes (URLs in installed apps)	No (only active connections)
Privacy impact	None	Inspects all HTTPS traffic
Breaking cert pinning	N/A	Breaks pinned connections

Supported URL Types

• http:// and https:// URLs
• URLs with paths, query parameters, and fragments (matched in full)
• URLs embedded in DEX bytecode, native libraries, resources, and manifest files

Performance

• URLs are extracted via optimized regex scanning
• XOR filter lookups are O(1) — constant time regardless of database size
• No network calls — completely offline

See Also

• Detection-Engines — Overview of all engines
• Network-Security — Network-level threat detection
• Data-Pipeline — XOR filter generation