File scan report
Verdict Safe
Is app.
An Apple-style installer package that none of the 60 antivirus engines that checked it flagged, circulated by 97 sources since September 2024 with no malware-database or rule…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
The scan record is clean and the file has circulated widely for two years without a detection, so it can be used if it came from a source you trust. Keep your protection enabled and, if the origin is unclear, confirm the developer signature in macOS before installing.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 60 flagged
- Flagged 0
- No detection 60
- No result 15
- Code signing Not applicable
- Test run Not run
- First seen 2y ago
Chapter 02
Why we think so
0 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 60 antivirus engines that checked it flagged this installation package, including the major ones, and it has no entry in public malware databases and no matching malware-specific rules. It has been submitted by 97 distinct sources since it first appeared on Sep 28, 2024 without a single detection. The package contents themselves were not opened or executed here, so treat it as clean by detection record only.
The detection record is completely empty: no engine in any trust tier returned a detection, and the majority of the engines returned a result rather than failing on the file type. Nothing else in the evidence points the other way — no public malware-database listing, no community malware rule, no brand or naming conflicts, and no prior reports judged wrong by staff. The file has also had a long exposure window: submitted by 97 distinct sources since Sep 28, 2024, which is a lot of opportunity for a detection to appear if the package were known-bad. The gaps are that no sandbox run and no content inspection exist, and installation packages for Apple systems are analysed less thoroughly by antivirus engines than Windows executables, so the clean result reflects the file as scanned rather than a verified inventory of what it installs. Weighing a two-year, roughly hundred-source submission history with zero detections against those coverage limits, the balance supports a benign reading.
What We Detected
Nothing. Across 75 antivirus engines, none returned a detection — not the 17 major antivirus engines that produced a result, and not the remaining reporting engines. The product is an installation package (a .pkg by name), 23 MB in size, and the engines returned no malware family, no potentially unwanted software label and no generic suspicion for it.
Supporting Context
The package has a long history: it was first seen on Sep 28, 2024 and has been submitted 103 times by 97 distinct sources. In two years of circulation it has not picked up a single engine detection, has no entry in public malware-sample databases, and no malware-specific community rule matched its content. No naming or branding conflict was found, and there is no prior review indicating that an earlier assessment of this file was mistaken.
What We Could Not Check
No execution record and no inspection of the package contents were available for this analysis, and the file carries no publisher signature we could verify. Many antivirus engines treat Apple installation packages more shallowly than Windows executables, so a clean scan does not amount to an audit of everything the installer would place on a machine. If you did not obtain this package from the software maker or another source you already trust, it is worth confirming the developer signature in macOS before you install it.
What To Do Now
Keep your antivirus and system protection enabled and install the package only if it came from a source you trust. If macOS shows an unidentified developer warning and you cannot confirm where the file came from, wait until you can verify its publisher before continuing.
Where this verdict could be wrong3 caveats
- No sandbox run and no byte-level inspection were available, so what the installer would actually put on a Mac was never examined — the engines' silence covers the package file, not necessarily everything it installs.
- Apple-style installation packages are handled less deeply by many antivirus engines than Windows executables, so zero detections is weaker evidence here than it would be for a PE file.
- No publisher signature or signer history could be checked for this package, so its origin was not independently confirmed.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No engine among the 75 reported a detection, including 17 major antivirus engines that produced a result for the file.
- Submitted by 97 distinct sources since Sep 28, 2024 with no detection appearing in that time.
- No entry in public malware-sample databases and no matching malware-specific community rules.
- No engines labelled it as a potentially unwanted program, a hacking tool or any named malware family.
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
None of the 60 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 5, 2026, 10:41 PM UTC
- SHA-256
529a33a55722c2488c9b190da6eb6132997903c3253091e576538785d3c937bb- SHA-1
ad3bd8602ac833f2eaf54a4b28cf632c741147c8- MD5
321b4cdd9ceea0ebbccfd61cc2a38b13
About this file
app.pkg is an unknown file of 23.1 MB.
- Type and size
- unknown · 23.1 MB
- Signer
- Not applicable
- First seen
- Sep 28, 2024On VirusTotal.
- Submitted by
- 97 distinct sources
First scanned
Antivirus consensus
0 of 60 engines flagged this file
15 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-232 engines0flagged
- Low-trust11 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is app.pkg safe?
What is app.pkg?
How many antivirus engines detected app.pkg?
What is the SHA-256 hash of app.pkg?
Is it safe to install app.pkg?
How up to date is this analysis of app.pkg?
Community
Member reviews and reports for this exact file hash.