System and method for analyzing repackaged application through risk calculation

A system for analyzing a repackaged application through risk calculation, which detects the repackaged application by analyzing an Android application, the system comprising:

• a decompiler 102 for loading the Android application, which is an analysis target, decompressing the application and extracting an AndroidManifest file and a Dex file;
• an analysis module 106 for analyzing whether or not specific information is modified in the extracted AndroidManifest or Dex file;
• a blacklist database 108 for storing a blacklist collecting IDs of publishers related to creation and distribution of a malicious code, a white list collecting IDs of publishers unrelated to creation and distribution of the malicious code, and information on malicious package names and malicious code character strings;
• and
• a risk calculation module 110 for converting, if analysis information on the Android application created by the analysis module 106 is transmitted, a risk expressing possibility of the malicious code to be contained in the Android application as a score based on the analysis information;
• wherein
• the Android application, which is the analysis target, is classified as one of a normal application, a repackaging suspected application and a repackaged malicious application depending on the risk.