File scan report
Verdict Safe
Is cineplus1.
This Android movie-streaming app was flagged by none of the 58 antivirus engines that checked it, and its sandbox runs showed no high-risk techniques or malicious network contacts.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
No malware was found. Sideload this unofficial streaming app only from a source you trust, keep Play Protect on, and decline any permissions that seem unnecessary.
Good practice2 tips
We found nothing harmful in this file.
Install it only from Google Play or the developer's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 58 flagged
- Flagged 0
- No detection 58
- No result 16
- Code signing Not applicable
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
In two sandbox runs it only fetched movie metadata and posters and contacted streaming sites, with no high-risk behaviour. It is an unofficial streaming app, so install it with care.
None of the 58 antivirus engines that checked it flagged the APK, and 12 major antivirus engines that analysed it reported it clean. The two sandbox runs mapped only techniques common in legitimate apps, such as network communication and device discovery, with no injection or other high-risk activity. None of the 32 hosts we cross-checked was known to be malicious or suspicious, and no public malware database or malware-specific rule matched. The app is obfuscated and its internal package name does not match its branding, which is typical of unofficial streaming apps sideloaded outside the Play Store. It has been seen by 162 submitters over about three months.
What We Detected
None of the 58 antivirus engines that checked it flagged this Android package. Leading engines including BitDefender, ESET, Microsoft, Avira and Dr.Web reported it clean, and no public malware database or malware-specific rule matched it. One dropped file matches a known-software reference entry.
Threat Behavior
In two sandbox runs the app requested movie information and poster images from a public film database, loaded content from streaming sites and used Cloudflare and Firebase services. All observed techniques are common in legitimate apps, and no contacted host is known to be malicious. The code is obfuscated, it checks for debugging environments, and its internal package name refers to a travel app. These traits are common in unofficial streaming apps but are not malicious on their own.
What To Do Now
If you trust where you got it, the app shows no signs of malware. Unofficial streaming apps often carry aggressive ads and copyright risks. Keep Google Play Protect enabled and review the permissions the app requests.
Where this verdict could be wrong2 caveats
- The app is tagged as obfuscated, uses reflection and checks for a debugging environment, and its internal package name refers to a travel-booking app rather than a movie app; these traits are common in unofficial streaming apps but can also hide unwanted behaviour.
- The app contacts unofficial streaming sites, which may carry copyright or advertising risks unrelated to malware.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 58 antivirus engines that checked it flagged the file.
- Two sandbox runs showed no high-risk techniques.
- None of the contacted hosts is known to be malicious or suspicious.
- No public malware database or malware-specific rule matched it.
- The app's code is obfuscated and checks for debugging environments.
- Its internal package name does not match the movie app's branding.
- It loads content from unofficial streaming sites.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 12sandbox rule tags
- 0spawned processes
- 32network contacts
- 4filesystem & mutex artifacts
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
12MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
- T1095· Custom network
- T1105· Network file transfer
- T1406
- T1409
- T1421
- T1422
- T1424
- T1426
- T1429
- T1430
- T1573
Observed activity
Network contacts
3232 hosts, listed as 11 domains, 20 addresses, 18 links. Links show the host and path only.
- Domain
firebase-settings.crashlytics.com - Domain
cocobay.icu - Domain
api.themoviedb.org - Domain
raw.githubusercontent.com - Domain
tap4movie.tv - Domain
stun.cloudflare.com
Show all 49 entries for network contacts
- Domain
primesrc.me - Domain
peliplayhd.com - Domain
telepisodes.org - Domain
challenges.cloudflare.com - Domain
brunhild.challenges.cloudflare.com - IP address
142.250.31.94 - IP address
172.67.162.47 - IP address
3.170.19.97 - IP address
185.199.108.133 - IP address
142.251.157.119 - IP address
173.194.194.94 - IP address
104.21.64.137 - IP address
173.194.193.138 - IP address
173.194.206.106 - IP address
172.217.112.4 - IP address
74.125.202.94 - IP address
172.217.114.4 - IP address
185.199.110.133 - IP address
3.170.103.81 - IP address
74.125.202.138 - IP address
104.26.4.102 - IP address
104.21.45.240 - IP address
185.178.208.135 - IP address
104.21.41.113 - IP address
64.31.3.237 - URL
http://image.tmdb.org/t/p/w342/xsrkiXg8EuNNtbPtbmvCxg95gK7.jpg - URL
http://image.tmdb.org/t/p/w342/7V0Ebks0GgpKvQ7QbLAIdX5dos4.jpg - URL
http://image.tmdb.org/t/p/w342/gMYZZvnkVNTqSVnVCphWbPXwWwb.jpg - URL
http://image.tmdb.org/t/p/w342/jruaZAm1KjkFRhgRcdF8tqakhpH.jpg - URL
http://image.tmdb.org/t/p/w342/dB4EDhre2dsC2kxYDavyKWqLQwi.jpg - URL
http://image.tmdb.org/t/p/w342/2HKBc5UiFw8JrruHq8S1Y7TnlW0.jpg - URL
http://image.tmdb.org/t/p/w342/nUXjSyXAQZhOf32e6lkLX6C6Rf3.jpg - URL
http://image.tmdb.org/t/p/w342/gLKOYIMyKlUHW0SVdskhgf9C0yy.jpg - URL
http://image.tmdb.org/t/p/w342/oWUGSadxC9vQPOCeHDDVfDezmQC.jpg - URL
http://image.tmdb.org/t/p/w342/6nNxw6SsbEtSpktVEGdoYDqPH7C.jpg - URL
http://image.tmdb.org/t/p/w342/owhkU6KRqdXoUQpjV8uyZGPtX58.jpg - URL
http://image.tmdb.org/t/p/w342/f9U0oTlvLlqbww2Gm5j8Lhf1r9W.jpg - URL
http://image.tmdb.org/t/p/w342/pRtJagIxpfODzzb0T0NAvZSzErC.jpg - URL
http://image.tmdb.org/t/p/w342/vQ8v5bMQtEdmEvVwNos5dkKxyK7.jpg - URL
http://image.tmdb.org/t/p/w342/luKNvVTizD4O46XjTJ5Hlj2EuHt.jpg - URL
http://image.tmdb.org/t/p/w342/g8Af8gOu7bZlvjoQ7St9WolzaI9.jpg - URL
http://image.tmdb.org/t/p/w342/44ixm38SHC5HAbuaD7Mq2dakWk9.jpg - URL
http://image.tmdb.org/t/p/w342/b8VtW6IEIyEWYdnJHx8bG8RdAak.jpg
Files
4Files the file created, changed or deleted.
- Written
/data/user/0/com.booking.okrtravel/cache/journal.tmp - Written
/data/user/0/com.booking.okrtravel/shared_prefs/com.booking.okrtravel_preferences.xml - Written
/data/user/0/com.booking.okrtravel/cache/journal - Deleted
/data/user/0/com.booking.okrtravel/shared_prefs/com.booking.okrtravel_preferences.xml.bak
Files this sample writes at runtime
This file drops 2 children at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 3325d2a819fdd8062c2c…57c793Cleantrust 85known-software reference set · not scanned here
- c9e1b010d7a564d9f8cb…507b5eNot checkedno saved verdict
Chapter 04
Technical details
None of the 58 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 18, 2026, 5:09 PM UTC
- SHA-256
4cc1ef6cca4194f4880681a09b834a986464e853c17d48ae3bf62eaabcfea859- SHA-1
492f54ce1d3e7bc75dbca42163585263adedf7e0- MD5
1c7ff764f16aaf55a51f1f741b070a3f
About this file
cineplus1.0.4.apk is an Android file of 14.8 MB.
- Type and size
- Android · 14.8 MB
- Signer
- Not applicable
- First seen
- Jul 15, 2026On VirusTotal.
- Submitted by
- 162 distinct sources
First scanned Updated
Antivirus consensus
0 of 58 engines flagged this file
16 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-112 engines0flagged
- Tier-235 engines0flagged
- Low-trust11 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudNo result
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastNo result
- Avast-MobileClean
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxClean
- BkavNo result
- CAT-QuickHealNo result
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightClean
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrellixENSNo result
- TrendMicroNo result
- TrendMicro-HouseCallNo result
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is cineplus1.0.4.apk safe?
What is cineplus1.0.4.apk?
How many antivirus engines detected cineplus1.0.4.apk?
What is the SHA-256 hash of cineplus1.0.4.apk?
Is it safe to install cineplus1.0.4.apk?
How up to date is this analysis of cineplus1.0.4.apk?
Community
Member reviews and reports for this exact file hash.