As a general rule, I don't trust any "freeware" or "shareware" site that has not specifically been recommended to me by someone I know and trust, and because these sites aren't my thing I can't either recommend or condemn this specific example. I can answer part of your question, though, and say an emphatic yes, unscrupulous people can inject malware into APKs. Installing an APK from an unknown source is generally very a bad idea.

The permissions you mention, though, are actually the same that the legit Facebook for Android app asks over in the Play store (see the "Permissions" tab). Permissions alone are a bad judge of an APK's potential for harm. In this case, personally, I would say the risk of an unknown source far outweighs the app's permission requests.

As a general rule, I don't trust any "freeware" or "shareware" site that has not specifically been recommended to me by someone I know and trust, and because these sites aren't my thing I can't either recommend or condemn this specific example. I can answer part of your question, though, and say an emphatic yes, unscrupulous people can inject malware into APKs. Installing an APK from an unknown source is generally a very bad idea.

The permissions you mention, though, are actually the same that the legit Facebook for Android app asks over in the Play store (see the "Permissions" tab). Permissions alone are a bad judge of an APK's potential for harm. In this case, personally, I would say the risk of an unknown source far outweighs the app's permission requests.