File scan report
Verdict Safe
Is rkr.
Zero detections across 74 engines despite direct-IP contacts that match Google and Cloudflare infrastructure.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Treat as safe for installation; re-scan after broader distribution if additional engine detections appear.
Good practice2 tips
We found nothing harmful in this file.
Install it only from Google Play or the developer's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
2 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No engine flagged the APK. The only suspicious signal is a rule-based noting direct-IP connections without DNS, but those IPs belong to legitimate Google and Cloudflare ranges. No sandbox malice, no files it created, and no external-intel hits support a clean assessment.
The complete absence of malicious detections from 74 engines, including 17 major antivirus engines, outweighs the single rule-based trigger. No complete contacted-host reputation result was available, and the file is a rare APK with no prior history or corroborating intel. No complete contacted-host reputation result was available.
What We Detected
74 engines scanned the APK; none returned a malicious or suspicious result. The only non-benign observation is one of our behaviour rules noting eight direct-IP connections and zero DNS lookups.
Threat Behavior
The contacted IPs resolve to Google and Cloudflare infrastructure, services commonly used by legitimate Android applications for data, updates, or CDN content. No sandbox execution produced malicious verdicts, no children were dropped, and no persistence or a control server indicators were recorded.
What To Do Now
The file can be installed and executed with low risk. Monitor for unusual battery or data usage typical of any new keyboard app, and keep device OS and security updates current.
Where this verdict could be wrong3 caveats
- Direct-IP a control server behaviour rule matched, but the IPs belong to Google infrastructure (142.251.157.119, 173.194.*) and Cloudflare (172.67.151.52), which benign apps legitimately contact.
- Zero malicious sandbox verdicts and zero files it created reduce the weight of the heuristic.
- No major antivirus engines detections despite 66 engines reporting — strong negative signal against malware.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/65 engines flagged malicious
- IPs belong to Google/Cloudflare infrastructure
- no sandbox malice or files it created
- rare and prevalence (single submission)
- direct-IP connections without DNS
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 3sandbox rule tags
- 0spawned processes
- 8network contacts
- 0filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
3MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
- T1406
- T1573
Observed activity
Network contacts
88 hosts, listed as 8 addresses. Links show the host and path only.
- IP address
142.251.157.119 - IP address
173.194.194.94 - IP address
172.67.151.52 - IP address
172.217.118.4 - IP address
173.194.193.113 - IP address
173.194.206.147
Show all 8 entries for network contacts
- IP address
173.194.195.113 - IP address
172.217.115.4
Chapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jul 22, 2026, 10:25 PM UTC
- SHA-256
19af64501bbe196dcf68d3d9e95f64938489555f342b1748c53d02a0fe48527e- SHA-1
48c03c9860339ec256ee7501e5c95eb76260d652- MD5
2717f94c047baae41914867548af236a
About this file
rkr.simplekeyboard.inputmethod_146.apk is an Android file of 620.7 kB.
- Type and size
- Android · 620.7 kB
- Signer
- Not applicable
- First seen
- Jul 22, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 65 engines flagged this file
9 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-236 engines0flagged
- Low-trust12 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudNo result
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxClean
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightClean
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is rkr.simplekeyboard.inputmethod_146.apk safe?
What is rkr.simplekeyboard.inputmethod_146.apk?
How many antivirus engines detected rkr.simplekeyboard.inputmethod_146.apk?
What is the SHA-256 hash of rkr.simplekeyboard.inputmethod_146.apk?
Is it safe to install rkr.simplekeyboard.inputmethod_146.apk?
How up to date is this analysis of rkr.simplekeyboard.inputmethod_146.apk?
Community
Member reviews and reports for this exact file hash.