tokens: Figure 9 : Malware secretly adds malicious resources to the DEX file Now , after the alteration of the original application , Android ’ s package manager will think that this is an update for the application signed by the same certificate , but in reality , it will execute the malicious DEX file .