potentially unsafe"},
    "Fortinet":{"detected":true,"result":"Android/Generic.S.1BE3EB!tr"},
    "AVG":{"detected":true,"result":"Android/G2P.R.0C64D4E32B5E"}
    "McAfee":{"detected":false,"result":null},
    ... ...
    "Qihoo-360":{"detected":false,"result":null}
    }}

    App Sandbox Permission Checking:
     [getSharedPreferences] Lcom/google/android/gms/flags/impl/zzb$1;->zzvw()Landroid/content/SharedPreferences;
     [openFileOutput] Lcom/mopub/mobileads/AdAlertReporter;->addImageAttachment(Ljava/lang/String; Landroid/graphics/Bitmap;)V
    [Critical] <Implicit_Intent> Implicit Service Checking:
     com.yandex.metrica.MetricaService
    [Critical] <SSL_Security> SSL Connection Checking:
    http://a.applovin.com/
     Lcom/applovin/impl/sdk/bw;-><clinit>()V
    [Critical] <WebView><Remote Code Execution><#CVE-2013-4710#> WebView RCE Vulnerability Checking:
     Lcom/startapp/android/publish/slider/b;->b()V --->
     Landroid/webkit/WebView;->addJavascriptInterface(Ljava/lang/Object; Ljava/lang/String;)V

Others
------

In addition to the aforementioned metadata, in this work, we also collect several advanced ones that are collected following specific rules.

-   **Piggybacking App Pairs:** Piggybacking constitutes a specific subset of repackaging, is defined in the literature as an activity where a given Android app is repackaged after manipulating the app content, e.g., to insert a malicious payload, an advertisement library, etc. In this work, we provide to the research community a set of piggybacking pairs that are collected based on the following rules: 1) The original app is benign while the piggybacked app is malicious. 2) The two apps share the same application ID. 3) The two apps are signed by different signatures (one must not be the real one). 4) The two apps are developed based on the same SDK version. 5) The two apps have over 80% of similarity in terms of app code.

-   **Common/Ad Libraries:** Despite some efforts on investigating 