Is ibisPaint-X-v14.1.2-mod-GameDVA.com.apk safe?
Four tier-1 engines identify obfuscation or trojan traits in this modified Android package, but no strong family consensus or runtime evidence is available.
The modified Android package drew 13 detections from 75 engines, including four tier-1 products that consistently point to obfuscation or trojan-like packaging. Because there is no completed sandbox observation, no complete host-reputation check, and no strong named-family consensus, the evidence supports caution rather than a definitive family attribution.
44d1ef54753acf69c9…18bc7f893a37bbRecommended next actions
Before installing
Do not install it until the source and publisher can be verified independently.
If you already installed it
Stop using it, scan the device, and watch for unexpected behavior or security alerts. Get a fresh copy from Google Play or the developer's official store.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The modified Android package drew 13 detections from 75 engines, including four tier-1 products that consistently point to obfuscation or trojan-like packaging. Because there is no completed sandbox observation, no complete host-reputation check, and no strong named-family consensus, the evidence supports caution rather than a definitive family attribution.
Thirteen of 75 engines flagged the APK, and four tier-1 engines independently reported obfuscation or trojan characteristics. Their labels broadly agree on concealed or repackaged code, although the formal tier-1 family consensus is not strong. The filename presents the package as a third-party modification, which increases supply-chain and repackaging risk. No completed runtime analysis is available, so the file's actual actions after installation cannot be assessed. Contacted-host reputation was not checked or saved, and external intelligence supplied no corroborating repository or YARA matches. Several reputable engines remained silent, leaving some possibility that aggressive packing or modification triggered part of the detection set.
What We Detected
13 of 75 antivirus engines flagged this Android package. Four tier-1 engines contributed detections: DrWeb reported Tool.Obfuscator.TrashCode.1, Fortinet reported Android/Obfus.RX!tr, Ikarus reported Trojan.AndroidOS.Obfus, and Symantec reported Trojan.Obfuse!ATN. Other engines described the package as riskware, PUA, PUP, or generically trojan-like.
Threat Behavior
The detection pattern primarily indicates obfuscation, packing, or repackaging rather than one established malware family. The filename identifies the APK as a modified edition distributed through a third-party source, which creates additional tampering risk. No sandbox run completed, so no runtime behavior was observed, and no complete contacted-host reputation result is available.
What To Do Now
Avoid installing this modified package. Obtain ibisPaint X through its official app-store listing or the developer's official distribution channel, keep Android security protections enabled, and remove the APK if it came from an untrusted download site.
Where this verdict could be wrong3 caveats
- 10 tier-1 engines reported no detection, including BitDefender, ESET-NOD32, Emsisoft, and F-Secure.
- externalIntel.malwareBazaar.hit=false and externalIntel.yaraify.ruleCount=0 provide no independent external-intelligence corroboration.
- Trustlook and AhnLab-V3 use PUA/PUP labels, while BitDefenderFalx calls it riskware, indicating that some detections may concern modification or packing rather than a confirmed trojan payload.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 10 tier-1 engines reported no detection
- No strong tier-1 family consensus
- externalIntel.malwareBazaar.hit=false
- externalIntel.yaraify.ruleCount=0
- No malicious dropped child was reported
- 13/75 antivirus detections
- Four tier-1 engines report obfuscation or trojan traits
- Filename identifies a modified third-party APK
- Obfuscation may conceal altered application code
- No completed sandbox observation
- No complete contacted-host reputation check
Do not install this modified APK; replace it with the official store version. If already installed, uninstall it, review its granted permissions, scan the device, and keep endpoint protection enabled.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete13 of 75 engines flagged the file.
Sandbox
PartialRuntime data is present, but no completed sandbox environment is recorded.
Network
Not runNo contacted-host reputation check is recorded.
No timestamp recordedYARA
CompleteRule evaluation completed with no recorded matches.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime behavior was not available
The report does not treat a missing runtime observation as a clean result.
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 0rule hits recorded
- 13 / 75engines flagged
- 64sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
13 of 75 antivirus engines flagged the file, including AhnLab-V3 and Alibaba.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 02
The hash has been submitted 66 times from 64 sources.
ProvenanceDerivedSourceSaved report factsObserved at
Detection sources at a glance
Category: pua
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
YARA rules
No matchesThe rule pass completed without a saved public match.
13 of 75 engines flagged this file
View all 75 engine results
PE structure
Not applicablePE structure analysis applies to Windows executable formats, not this file type.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- ibisPaint-X-v14.1.2-mod-GameDVA.com.apk
- Format
- Android
- Code signing
- Not applicable to this file type
- Size
- 112.4 MB
- Last analyzed
- Oct 6, 2026, 11:20 AM UTC
44d1ef54753acf69c9e254e43ac5c409791b27d70725d6caf518bc7f893a37bbSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
We couldn't fully clear this file. Treat it with caution.
- Recovery step 01
Don't install it unless you're certain it came from a source you trust.
- Recovery step 02
Check where you got it — an unexpected attachment or a random download link is a red flag.
- Recovery step 03
If its origin cannot be confirmed, delete this app and use a fresh copy from a trusted source. Get a fresh copy from Google Play or the developer's official store.
- Recovery step 04
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is ibisPaint-X-v14.1.2-mod-GameDVA.com.apk safe, or is it malware?
What is ibisPaint-X-v14.1.2-mod-GameDVA.com.apk?
How many antivirus engines detected ibisPaint-X-v14.1.2-mod-GameDVA.com.apk?
What should I do if I already installed ibisPaint-X-v14.1.2-mod-GameDVA.com.apk?
How do I remove ibisPaint-X-v14.1.2-mod-GameDVA.com.apk?
What kind of malware is ibisPaint-X-v14.1.2-mod-GameDVA.com.apk?
What is the SHA-256 hash of ibisPaint-X-v14.1.2-mod-GameDVA.com.apk?
How up to date is this analysis of ibisPaint-X-v14.1.2-mod-GameDVA.com.apk?
Community
Member reviews and reports for this exact file hash.