Three different APK file sizes for the same version/build app?

Question

I'm getting three different APK file sizes for supposedly the same version/build app:

• Version 1 from Evozi: 22.485.694 bytes

• Version 2 from Apkpure: 22.766.408 bytes

• Version 3 from Aptoide: 18.641.648 bytes

Why?

Which file is the original one and which two are fakes? Could you please confirm that the Evozi downloader is trying to "slip" you a APK version (here: 2.7.2) different from the Google Play store link that you provided (here: 2.7.3) or that both Apkpure and Aptoide are claiming publishing more recent publishing dates (here: 08-09-2021 and 14-09-2021) than the original (06-09-2021)? Why is this happening?

UPDATE 1: As per request, I've extracted all APKs. The results are even more concerning:

• Version 1 from Evozi: 957 Files, 51 Folders, 24.757.075 bytes

• Version 2 from Apkpure: 819 Files, 21 Folders, 25.118.159 bytes

• Version 3 from Aptoide: 4319 Files, 101 Folders, 31.704.315 bytes

...4319 files?!

UPDATE 2: As suggested, I used apksigner to take a look at the certificates inside the APKs:

Version 1 from Evozi: 957 Files, 51 Folders, 24.757.075 bytes

C:\Users\...\Desktop>java -jar apksigner.jar verify --verbose --print-certs com.starfinanz.mobile.android.dkbpushtan_30044_apps.evozi.com.apk
Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): false
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1
Signer #1 certificate DN: CN=Niels Mathea, OU=IT Betrieb Bank, O=DKB Service GmbH, L=Potsdam, ST=Brandenburg, C=DE
Signer #1 certificate SHA-256 digest: e5067dca4553173a1dd76352a8287b293960119689244ac58d0552703efe4268
Signer #1 certificate SHA-1 digest: b4199718eaa0e676755af77419fb59abf7fece00
Signer #1 certificate MD5 digest: 0a566744818c6fb89f4c900a1502cf1c
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048
Signer #1 public key SHA-256 digest: d878ba65ddcd7bbd0d9fd284f0bc61762c7ecb83ecb6c58c8c138939fb661f7f
Signer #1 public key SHA-1 digest: dbf739ed124f07181b3cdd1867bdd0eb63da3d71
Signer #1 public key MD5 digest: 94fcb9a87a8ec48eed706456a93ab0cd
WARNING: META-INF/androidx.customview_customview.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
[...]

Version 2 from Apkpure: 819 Files, 21 Folders, 25.118.159 bytes

C:\Users\...\Desktop>java -jar apksigner.jar verify --verbose --print-certs "DKB TAN2go_v2.7.3_apkpure.com.apk"
Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): false
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1
Signer #1 certificate DN: CN=Niels Mathea, OU=IT Betrieb Bank, O=DKB Service GmbH, L=Potsdam, ST=Brandenburg, C=DE
Signer #1 certificate SHA-256 digest: e5067dca4553173a1dd76352a8287b293960119689244ac58d0552703efe4268
Signer #1 certificate SHA-1 digest: b4199718eaa0e676755af77419fb59abf7fece00
Signer #1 certificate MD5 digest: 0a566744818c6fb89f4c900a1502cf1c
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048
Signer #1 public key SHA-256 digest: d878ba65ddcd7bbd0d9fd284f0bc61762c7ecb83ecb6c58c8c138939fb661f7f
Signer #1 public key SHA-1 digest: dbf739ed124f07181b3cdd1867bdd0eb63da3d71
Signer #1 public key MD5 digest: 94fcb9a87a8ec48eed706456a93ab0cd
WARNING: META-INF/androidx.customview_customview.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
[...]

Version 3 from Aptoide: 777 Files, 21 Folders, 25.059.540 bytes

C:\Users\EPI-SMLM\Desktop>java -jar apksigner.jar verify --verbose --print-certs  com-starfinanz-mobile-android-dkbpushtan-30049-59302957-c297d2d2df90587173f6f8b78fce939d.apk
Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): false
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1
Signer #1 certificate DN: CN=Niels Mathea, OU=IT Betrieb Bank, O=DKB Service GmbH, L=Potsdam, ST=Brandenburg, C=DE
Signer #1 certificate SHA-256 digest: e5067dca4553173a1dd76352a8287b293960119689244ac58d0552703efe4268
Signer #1 certificate SHA-1 digest: b4199718eaa0e676755af77419fb59abf7fece00
Signer #1 certificate MD5 digest: 0a566744818c6fb89f4c900a1502cf1c
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048
Signer #1 public key SHA-256 digest: d878ba65ddcd7bbd0d9fd284f0bc61762c7ecb83ecb6c58c8c138939fb661f7f
Signer #1 public key SHA-1 digest: dbf739ed124f07181b3cdd1867bdd0eb63da3d71
Signer #1 public key MD5 digest: 94fcb9a87a8ec48eed706456a93ab0cd
WARNING: META-INF/androidx.customview_customview.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
[...]

There is a long list of warnings coming with each APK. Also, as indicated in the comments, Aptoide provided the wrong APK - file size and number of contained files/folders have been updated.

Anyone know what to make of this output?

Answer 1

If you have multiple APK files from different untrusted sources it is wise to question their authenticity. You already performed the basic steps for doing so, especially checking their cryptographic signatures using apksigner is the most important one.

From the apksigner output the most important part is the certificate SHA-256 digest. APKs that have the same certificate SHA-256 hash are guaranteed to come from the same developer (assuming the keys has not ben lost/stolen, or the developer has sold the project to a different developer).

In your case the versions from Evozi and Apkpure have the same hash but the one from Aptoide is totally different, even the certificate DN is totally different. The reason for that I will explain at the end of this answer, first focus on Evozi and Apkpure.

Evozi and Apkpure

You know that both versions come from the same developer, but the authenticity of that developer is still unknown. As there is no directory where you can look-up Android developer certificate hashes we have to improvise. So we end up for the certificate SHA-256 and SHA-1 hash (SHA-1 is no longer the best for security but it still costs several thousand dollar and a lot of time to break it) on popular search engines like Google. If you do so you will find plenty of entries for the SHA-1 hash that all belong to download site or threads about the DKB app. And the posts are not all new but go back e.g. to 2017, so the chance is high that both APKs from Evozi and Apkpure are genuine.

But then the question remains why are they different?

You have to know that there are several reasons why they are different.

Different internal version?

Android apps have two version numbers: the versionName (a string with arbitrary content) that is displayed to the user and one internal versionCode number that is a plain integer number which is increasing at least by one with every new version (no commas, dots, and so on are allowed). To check the internal versionCode we have to look into the decoded AndroidManifest.xml of each APK. On a PC I prefer Jadx for doing so.

Evozi version:

android:versionCode="30044" android:versionName="2.7.2"

ApkPure version:

android:versionCode="30049" android:versionName="2.7.3"

As you can see both APKs have a different internal and external version as both version values are different.

A lot APK download sites to not gather APK files on their own, instead they rely on user uploads. Also APK files don't contain a release date, therefore those site use the upload date to them as date they display. So the date shown on Evozi and ApkPure is usually days or even weeks after the official release date.

But it would have been possible that only versionCode differs and versionName stays the same. In such a case there would be two possibilities:

1. Multiple versions had been released without changing the public version number, e.g. because there was a minor bug that had been fixed in the newer version, and the developer decided that this change was too small for a new version number.

2. The Android eco system is very fragmented. Different Android versions and Android hardware with very different hardware is used (e.g. screen size and density). Originally Android APKs were designed to include everything for every hardware configuration but that increased the app size and consumed storage and internet traffic that was partially unnecessary. So Google introduced multiple features to address that problem. Starting from the possibility to provide different APKs for different device types or model up to the newest system that the developer uploads an app bundle and Google generates the final APK file(s) individually for each device model.

Aptoide

Aptoide in difference to other sites which provides APK files for download is not a download site, instead it is an App store. This means the download they provide on their web site are not the app you have searched for. Instead it is the Aptoide app store app. This explains the different signature, certificate DN and the totally different content of the downloaded APK file.

But the Aptoide APK file you have downloaded is not just the general store app, it is a special version that contains the meta data of the app you wanted to download. Once you have installed this Aptoide app store app an dialog opens and asks if you want to download and install the linked "DKB-TAN2go" app.