Is Material Capsule v15.8 (Premium).apk safe?
Only 2 of 74 engines identify this APK as repacked Android riskware, but its modified-premium presentation and incomplete runtime coverage warrant caution.
Two of 74 engines flag the APK as a PUP or repacked riskware, while all 17 reporting tier-1 engines remain silent. This weak detection pattern may be a false positive, but the apparent premium modification, obfuscation, and lack of completed runtime and host-reputation checks make installation inadvisable unless obtained from the official developer.
84e53b456f99d878b1…f4bfabca23a323Recommended next actions
Before installing
Do not install it until the source and publisher can be verified independently.
If you already installed it
Stop using it, scan the device, and watch for unexpected behavior or security alerts. Get a fresh copy from Google Play or the developer's official store.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
Two of 74 engines flag the APK as a PUP or repacked riskware, while all 17 reporting tier-1 engines remain silent. This weak detection pattern may be a false positive, but the apparent premium modification, obfuscation, and lack of completed runtime and host-reputation checks make installation inadvisable unless obtained from the official developer.
The detection count is low: 2 of 74 engines flag the sample, and none of the 17 reporting tier-1 engines identify malware. Both detections describe Android PUP or repack riskware rather than a destructive or credential-stealing family. However, the filename suggests a premium-modified package, and the file carries obfuscation and reflection tags, which are concerning for an unofficial APK. No completed sandbox observation is available because behaviour.sandboxCount is zero, and contactedHosts is null, so the ten listed no complete contacted-host reputation result was available or hostile. The inspected child was not identified as malicious, while external intelligence and prior similar-file decisions provide no corroboration. Overall, the evidence favors a possible repack or unwanted modification rather than confirmed malware, but the source and integrity remain uncertain.
What We Detected
Two of 74 antivirus engines flagged the APK. BitDefenderFalx identified Android.Riskware.Repack.aBWX, while AhnLab-V3 reported PUP/Android.Moda.1297228. None of the 17 reporting tier-1 engines detected it, and there is no tier-1 family consensus.
Threat Behavior
The package is tagged as obfuscated and uses reflection, but these static characteristics can occur in both legitimate and modified Android applications. Three ambient MITRE techniques were listed, with no offensive-only techniques. Because behaviour.sandboxCount=0, there is no completed runtime observation; additionally, contactedHosts=null means the reputation of the ten listed IP addresses was not fully checked. One dropped child was inspected without a malicious finding, although its individual status remains unknown.
What To Do Now
Avoid installing premium-modified APKs from unofficial distribution sites. Obtain the application from the official developer or a trusted app store, compare its hash or signing certificate with an official release where possible, and keep Android security protections enabled.
Where this verdict could be wrong3 caveats
- The filename includes “Premium,” while the detections specifically identify PUP/riskware and a repack; unofficial modified APKs can contain unwanted changes despite broad tier-1 silence.
- MalwareTips.Synth.DirectIpC2 fired for 10 external IP addresses, but behaviour.sandboxCount=0 and contactedHosts=null prevent reliable attribution or reputation assessment.
- YARAify and MalwareBazaar coverage was skipped, so the absence of hits from those services is not affirmative evidence.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- All 17 reporting tier-1 engines were undetected.
- Only 2 of 74 engines reported a detection.
- No offensive-only MITRE techniques were identified.
- droppedChildren.hasMaliciousChild=false.
- The file has 222 submitters and 249 submissions, indicating broad visibility.
- Two engines label the APK as PUP or repacked Android riskware.
- The filename suggests an unofficial premium-modified package.
- Static tags include obfuscation, reflection, and embedded ELF content.
- Ten direct IP contacts are listed without a complete host-reputation result.
- No completed sandbox runtime observation is available.
- The inspected dropped child has an unknown individual verdict.
Do not install this modified-premium APK unless its origin and integrity can be verified against an official release. Prefer the developer's official store channel and keep device protection enabled.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete2 of 74 engines flagged the file.
Sandbox
PartialRuntime data is present, but no completed sandbox environment is recorded.
Network
Partial10 runtime contacts were observed without a completed reputation cross-check.
YARA
Complete1 signature or behavior rule matched.
External intel
PartialIndependent reference checks were attempted but are incomplete.
Behavior
Plain-English impact first, then the observed runtime evidence.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
Material Capsule v15.8 (Premium).apk
84e53b456f99d878b168ef4fef2fa0a093ac271b73a77fa8a1f4bfabca23a323
01Uploaded file
Files
Created or changed
- Dropped fileDerived
109f56eb6eba3250c034fce31dc5771c4a273a9fa059326a1405072c62f4e984
No child-file verdict was available.
02Dropped-file analysis
Network
Hosts contacted
- Contacted hostObserved
142.251.154.119
Contact observed during runtime.
03Isolated runtime analysis - Contacted hostObserved
173.194.194.94
Contact observed during runtime.
04Isolated runtime analysis - +1 more recorded observation in Analyst mode
4 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
Runtime behavior was not available
The report does not treat a missing runtime observation as a clean result.
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache.
- 109f56eb6eba3250c034…f4e984Never scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 1rule hit recorded
- 2 / 74engines flagged
- 222sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
2 of 74 antivirus engines flagged the file, including AhnLab-V3 and BitDefenderFalx.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 02
The hash has been submitted 249 times from 222 sources.
ProvenanceDerivedSourceSaved report factsObserved at - 03
Scanned file: Material Capsule v15.8 (Premium).apk — 84e53b456f99d878b168ef4fef2fa0a093ac271b73a77fa8a1f4bfabca23a323
ProvenanceObservedSourceUploaded fileObserved at - 04
Dropped file: 109f56eb6eba3250c034fce31dc5771c4a273a9fa059326a1405072c62f4e984 — No child-file verdict was available.
ProvenanceDerivedSourceDropped-file analysisObserved at - 05
Contacted host: 142.251.154.119 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Contacted host: 173.194.194.94 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: pua
Available reference checks returned no match, but at least one source was unavailable. This is not a clean result.
Signatures and behavior heuristics
Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.
The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence142.251.154.119 · 173.194.194.94 · 104.21.64.137
2 of 74 engines flagged this file
View all 74 engine results
PE structure
Not applicablePE structure analysis applies to Windows executable formats, not this file type.
How widely this file has been seen
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Fingerprint and provenance
- File name
- Material Capsule v15.8 (Premium).apk
- Format
- Android
- Code signing
- Not applicable to this file type
- Size
- 29.2 MB
- Last analyzed
- Sep 15, 2026, 11:25 AM UTC
84e53b456f99d878b168ef4fef2fa0a093ac271b73a77fa8a1f4bfabca23a323Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
We couldn't fully clear this file. Treat it with caution.
- Recovery step 01
Don't install it unless you're certain it came from a source you trust.
- Recovery step 02
Check where you got it — an unexpected attachment or a random download link is a red flag.
- Recovery step 03
If its origin cannot be confirmed, delete this app and use a fresh copy from a trusted source. Get a fresh copy from Google Play or the developer's official store.
- Recovery step 04
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is Material Capsule v15.8 (Premium).apk safe, or is it malware?
What is Material Capsule v15.8 (Premium).apk?
How many antivirus engines detected Material Capsule v15.8 (Premium).apk?
I already downloaded and installed Material Capsule v15.8 (Premium).apk — what should I do?
How do I remove Material Capsule v15.8 (Premium).apk?
What kind of malware is Material Capsule v15.8 (Premium).apk?
What is the SHA-256 hash of Material Capsule v15.8 (Premium).apk?
How up to date is this analysis of Material Capsule v15.8 (Premium).apk?
Community
Member reviews and reports for this exact file hash.