test.rule

rule Signed_APK_with_dex
{
       meta:
	author = "Tim Strazzere"
	twitter = "@timstrazz"
	date = "10/25/2012"
	version = "1.0"
	tag = "Android"
	comment = "Attempted to detect an APK file with a classes.dex that is signed"

     strings:
	$PK_HEADER = {50 4B 03 04}
	$MANIFEST = "META-INF/MANIFEST.MF"
	$DEX_FILE = "classes.dex"

       condition:
	$PK_HEADER in (0..4) and $MANIFEST and $DEX_FILE
}