File scan report
Verdict Suspicious
Is X-
This Android media-player app is flagged by 4 of the 57 antivirus engines that checked it, all as unwanted, riskware or ad-library software, with no malware family named.
Read the whole reasonShow less
Why Suspicious? 4 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link or a stranger, delete the APK file.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete the APK file. If you need the app, get it from Google Play instead.
If you already installed it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumMobile malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from AndroidFind the bad app and clean your phone. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
4 of 57 flagged
- Flagged 4
- No detection 53
- No result 18
- Code signing Not applicable
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Four of the 57 antivirus engines that checked it flag this app, and every label points to an unwanted program, a test-key signature or a bundled ad library rather than malware. Most major engines found nothing, and the app has been widely submitted since it was first seen on Apr 15, 2024. Treat it as a possibly unwanted app rather than as malware.
Only one major antivirus engine, Sophos, flags the file, and it labels the app a potentially unwanted application. The other detections describe test-key signing, an advertising library and an unwanted player. Thirteen major antivirus engines reported the app clean. The file has been submitted by 134 sources since it was first seen on Apr 15, 2024. It has no public malware-database listings or malware-specific rule matches. Our sandbox summary shows only permission and device checks that are common in legitimate apps, and no high-risk techniques.
What We Detected
4 of the 57 antivirus engines that checked it flagged this Android package. Sophos labels it a potentially unwanted application. BitDefenderFalx calls it riskware signed with a test key. Symantec flags a generic ad library, and AhnLab labels it an unwanted player. None of these labels names a malware family, and 13 major antivirus engines reported the app clean.
Threat Behavior
The combined sandbox summary recorded only techniques common in legitimate apps, such as device and location checks. It shows no high-risk techniques and no injection. No complete reputation result is available for all contacted hosts. The one host we checked had no malicious record.
What To Do Now
Install apps only from official stores or the developer's own channel. If you do not trust where this copy came from, uninstall it. Keep your mobile security protection enabled and watch for unwanted ads or unusual permission requests.
Where this verdict could be wrong1 caveat
- Four engines, one of them major, flag the app as unwanted or risky. If the bundled ad library behaves aggressively, the app could be more intrusive than a typical media player.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 13 major antivirus engines reported the app clean
- Submitted by 134 sources since it was first seen on Apr 15, 2024
- No matches in public malware databases or malware-specific rules
- No high-risk techniques were observed when it ran
- Several engines label the app a potentially unwanted program
- The app is signed with a public test key instead of a developer certificate
- An ad library is bundled in the app
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 5sandbox rule tags
- 0spawned processes
- 10network contacts
- 0filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Note: Checked which security software was installed on the test computer.
Note: Connected to 10 servers during the test run.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 3: FileSeen in the test run
X-IBO-PRO.apk
232892dd36a2d3873d0e6dc47f42fc87faf42a569ec30523dae6ef7a99be0768
Uploaded file
- 2
Network
Hosts contacted
- Evidence 2 of 3: Contacted hostSeen in the test run
198.54.120.71
Contacted during the test run.
Test run - Evidence 3 of 3: Contacted hostSeen in the test run
142.251.143.170
Contacted during the test run.
Test run - +1 more recorded observation
3 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
5MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1409
- T1421
- T1426
- T1430
- T1518.001· Checks your AV
Observed activity
Network contacts
1010 hosts, listed as 9 addresses, 1 link. Links show the host and path only.
- IP address
198.54.120.71 - IP address
142.251.143.170 - IP address
142.251.143.132 - IP address
142.251.143.131 - IP address
142.251.143.106 - IP address
142.251.143.138
Show all 10 entries for network contacts
- IP address
142.251.143.142 - IP address
142.251.143.202 - IP address
142.251.143.164 - URL
http://connectivitycheck.gstatic.com/generate_204
Chapter 04
Technical details
4 of the 57 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 4
- Sophos (major engine)Android Xgen PUA (PUA)
- AhnLab-V3PUP/Android.LivePlayer.1250848
- BitDefenderFalxAndroid.Riskware.TestKey.rA
- SymantecMobileInsightAdLibrary:Generisk
File fingerprint
- Last analyzed
- May 25, 2026, 10:36 PM UTC
- SHA-256
232892dd36a2d3873d0e6dc47f42fc87faf42a569ec30523dae6ef7a99be0768- SHA-1
f0b3c1078344f3ba32baebc634e8cd6e026293af- MD5
9d43c43d14b6ae676f0985125a3ca916
About this file
X-IBO-PRO.apk is an Android file of 21.6 MB.
- Type and size
- Android · 21.6 MB
- Signer
- Not applicable
- First seen
- Apr 15, 2024On VirusTotal.
- Submitted by
- 134 distinct sources
First scanned Updated
Antivirus consensus
4 of 57 engines flagged this file
18 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-114 engines1flagged
- Tier-232 engines2flagged
- Low-trust11 engines1flagged
View all 75 engine results
- AhnLab-V3Malicious: PUP/Android.LivePlayer.1250848
- BitDefenderFalxMalicious: Android.Riskware.TestKey.rA
- SophosMalicious: Android Xgen PUA (PUA)
- SymantecMobileInsightMalicious: AdLibrary:Generisk
- AcronisClean
- AlibabaClean
- alibabacloudNo result
- ALYacNo result
- Antiy-AVLClean
- APEXNo result
- ArcabitNo result
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebNo result
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetNo result
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaNo result
- RisingClean
- SangforNo result
- SentinelOneNo result
- SkyhighNo result
- SUPERAntiSpywareClean
- SymantecClean
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallNo result
- TrustlookClean
- VaristClean
- VBA32No result
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is X-IBO-PRO.apk safe, or is it malware?
What is X-IBO-PRO.apk?
How many antivirus engines detected X-IBO-PRO.apk?
What should I do if I already installed X-IBO-PRO.apk?
What is the SHA-256 hash of X-IBO-PRO.apk?
How up to date is this analysis of X-IBO-PRO.apk?
Community
Member reviews and reports for this exact file hash.