[BUG] Invalid CEN header (encrypted entry)

APKtool fails to open a valid android package (which can be installed). The APK seems packed and encrypted. aapt/aapt2/android package installer correctly parses it. Unzip, apktool and other analysis tools fail to open it.

Information

1. Apktool Version (apktool -version) - 2.12.0
2. Operating System (Mac, Linux, Windows) - Linux
3. APK From? (Playstore, ROM, Other) - Malware from web
4. Java Version (java --version) - openjdk 11.0.29 2025-10-21

Stacktrace/Logcat

Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
I: Using Apktool 2.12.0-dirty on new_chrome_v7.1.3.apk with 4 threads
Exception in thread "main" brut.androlib.exceptions.AndrolibException: brut.directory.DirectoryException: java.util.zip.ZipException: invalid CEN header (encrypted entry)
	at brut.androlib.meta.ApkInfo.hasSources(ApkInfo.java:271)
	at brut.androlib.ApkDecoder.decodeSources(ApkDecoder.java:111)
	at brut.androlib.ApkDecoder.decode(ApkDecoder.java:83)
	at brut.apktool.Main.cmdDecode(Main.java:524)
	at brut.apktool.Main.main(Main.java:333)
Caused by: brut.directory.DirectoryException: java.util.zip.ZipException: invalid CEN header (encrypted entry)
	at brut.directory.ZipRODirectory.<init>(ZipRODirectory.java:54)
	at brut.directory.ZipRODirectory.<init>(ZipRODirectory.java:38)
	at brut.directory.ExtFile.getDirectory(ExtFile.java:51)
	at brut.androlib.meta.ApkInfo.hasSources(ApkInfo.java:269)
	... 4 more
Caused by: java.util.zip.ZipException: invalid CEN header (encrypted entry)
	at java.base/java.util.zip.ZipFile$Source.zerror(ZipFile.java:1776)
	at java.base/java.util.zip.ZipFile$Source.initCEN(ZipFile.java:1726)
	at java.base/java.util.zip.ZipFile$Source.<init>(ZipFile.java:1470)
	at java.base/java.util.zip.ZipFile$Source.get(ZipFile.java:1433)
	at java.base/java.util.zip.ZipFile$CleanableResource.<init>(ZipFile.java:743)
	at java.base/java.util.zip.ZipFile$CleanableResource.get(ZipFile.java:860)
	at java.base/java.util.zip.ZipFile.<init>(ZipFile.java:258)
	at java.base/java.util.zip.ZipFile.<init>(ZipFile.java:187)
	at java.base/java.util.zip.ZipFile.<init>(ZipFile.java:201)
	at brut.directory.ZipRODirectory.<init>(ZipRODirectory.java:52)
	... 7 more

Steps to Reproduce

1. apktool d malware.apk
2. apktool crashes

Frameworks

If this APK is from an OEM ROM (Samsung, HTC, LG). Please attach framework files (.apks that live in /system/framework or /system/priv-app)

APK

malware.zip

If this APK can be freely shared, please upload/attach a link to it.

Questions to ask before submission

1. Have you tried apktool d, apktool b without changing anything? - yes
2. If you are trying to install a modified apk, did you resign it? no
3. Are you using the latest apktool version? almost