File scan report
Verdict Suspicious
Is X-
This Android media-player app is flagged by 4 of the 57 antivirus engines that checked it, all as unwanted, riskware or ad-library software, with no malware family named.
Read the whole reasonShow less
Why Suspicious? 4 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link or a stranger, delete the APK file.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete the APK file. If you need the app, get it from Google Play instead.
If you already installed it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumMobile malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from AndroidFind the bad app and clean your phone. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
4 of 57 flagged
- Flagged 4
- No detection 53
- No result 18
- Code signing Not applicable
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Four of the 57 antivirus engines that checked it flag this app, and every label points to an unwanted program, a test-key signature or a bundled ad library rather than malware. Most major engines found nothing, and the app has been widely submitted since it was first seen on Apr 15, 2024. Treat it as a possibly unwanted app rather than as malware.
Only one major antivirus engine, Sophos, flags the file, and it labels the app a potentially unwanted application. The other detections describe test-key signing, an advertising library and an unwanted player. Thirteen major antivirus engines reported the app clean. The file has been submitted by 134 sources since it was first seen on Apr 15, 2024. It has no public malware-database listings or malware-specific rule matches. Our sandbox summary shows only permission and device checks that are common in legitimate apps, and no high-risk techniques.
What We Detected
4 of the 57 antivirus engines that checked it flagged this Android package. Sophos labels it a potentially unwanted application. BitDefenderFalx calls it riskware signed with a test key. Symantec flags a generic ad library, and AhnLab labels it an unwanted player. None of these labels names a malware family, and 13 major antivirus engines reported the app clean.
Threat Behavior
The combined sandbox summary recorded only techniques common in legitimate apps, such as device and location checks. It shows no high-risk techniques and no injection. No complete reputation result is available for all contacted hosts. The one host we checked had no malicious record.
What To Do Now
Install apps only from official stores or the developer's own channel. If you do not trust where this copy came from, uninstall it. Keep your mobile security protection enabled and watch for unwanted ads or unusual permission requests.
Where this verdict could be wrong1 caveat
- Four engines, one of them major, flag the app as unwanted or risky. If the bundled ad library behaves aggressively, the app could be more intrusive than a typical media player.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 13 major antivirus engines reported the app clean
- Submitted by 134 sources since it was first seen on Apr 15, 2024
- No matches in public malware databases or malware-specific rules
- No high-risk techniques were observed when it ran
- Several engines label the app a potentially unwanted program
- The app is signed with a public test key instead of a developer certificate
- An ad library is bundled in the app
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 5sandbox rule tags
- 0spawned processes
- 10network contacts
- 0filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Note: Checked which security software was installed on the test computer.
Note: Connected to 10 servers during the test run.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 3: FileSeen in the test run
X-IBO-PRO.apk
232892dd36a2d3873d0e6dc47f42fc87faf42a569ec30523dae6ef7a99be0768
Uploaded file
- 2
Network
Hosts contacted
- Evidence 2 of 3: Contacted hostSeen in the test run
198.54.120.71
Contacted during the test run.
Test run - Evidence 3 of 3: Contacted hostSeen in the test run
142.251.143.170
Contacted during the test run.
Test run - +1 more recorded observation
3 facts from the test run. See the full activity list.
Includes 5 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
4 of the 57 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 4
- Sophos (major engine)Android Xgen PUA (PUA)
- AhnLab-V3PUP/Android.LivePlayer.1250848
- BitDefenderFalxAndroid.Riskware.TestKey.rA
- SymantecMobileInsightAdLibrary:Generisk
File fingerprint
- Last analyzed
- May 25, 2026, 10:36 PM UTC
- SHA-256
232892dd36a2d3873d0e6dc47f42fc87faf42a569ec30523dae6ef7a99be0768- SHA-1
f0b3c1078344f3ba32baebc634e8cd6e026293af- MD5
9d43c43d14b6ae676f0985125a3ca916
About this file
X-IBO-PRO.apk is an Android file of 21.6 MB.
- Type and size
- Android · 21.6 MB
- Signer
- Not applicable
- First seen
- Apr 15, 2024On VirusTotal.
- Submitted by
- 134 distinct sources
First scanned Updated
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is X-IBO-PRO.apk safe, or is it malware?
What is X-IBO-PRO.apk?
How many antivirus engines detected X-IBO-PRO.apk?
What should I do if I already installed X-IBO-PRO.apk?
What is the SHA-256 hash of X-IBO-PRO.apk?
How up to date is this analysis of X-IBO-PRO.apk?
Community
Member reviews and reports for this exact file hash.