Safe
Android APK with zero malicious detections from 17 tier-1 engines; contacted hosts are legitimate CDN/API infrastructure.
acbc74de88d6d3b2b9…4306ac5538The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file shows a clean engine consensus: zero malicious detections across 66 engines, with 17 tier-1 vendors reporting undetected. No tier-1 family consensus exists. The DirectIpC2 heuristic flagged direct-IP contact to CDNs, a pattern common in mobile apps that embed hardcoded endpoints for performance. The contacted hosts (AWS, Cloudflare, Google) are benign infrastructure, and the URLs are public APIs (tmdb.org, Amazon CRL). No malicious sandbox verdicts, no malicious dropped children, and no malicious contacted hosts in our cache. The file's medium prevalence (4 submitters, 6 submissions) and brand-new age (0 days) are consistent with legitimate app distribution, not early-stage malware.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines: 0/66 malicious; tier1Malicious=0; tier1ReportedClean=17 (Avast, Kaspersky, Microsoft, BitDefender, ESET-NOD32, Fortinet, F-Secure, Ikarus, Emsisoft, GData, Avira, AVG, DrWeb all undetected)
Contacted IPs: 3.170.19.97, 104.21.15.107, 172.67.162.47, 216.239.36.223 (AWS, Cloudflare, Google infrastructure); contacted URLs: tmdb.org image endpoints + Amazon CRL (legitimate public APIs)
triggeredHeuristics: MalwareTips.Synth.DirectIpC2 fired (medium) — direct-IP contact to CDNs is common in mobile apps; no malicious sandbox verdict, no malicious contacted hosts in our cache
prevalence.classification=medium (4 submitters, 6 submissions); file age=0 days; unsigned Android APK; no brand mismatch detected
behaviour: 1 offensive MITRE (T1571) + 7 ambient techniques; no malicious dropped children, no persistence indicators, no registry/mutex abuse
- Zero malicious detections across 66 engines; 17 tier-1 vendors all undetected
- Contacted hosts are legitimate public infrastructure (AWS, Cloudflare, Google CDNs)
- Contacted URLs are public APIs (tmdb.org, Amazon CRL) — no C2 beaconing
- No malicious sandbox verdicts, no malicious dropped children, no persistence indicators
- Medium prevalence (4 submitters, 6 submissions) — consistent with legitimate app distribution
- DirectIpC2 heuristic fired — direct-IP contact to external hosts (but hosts are legitimate CDN/cloud infrastructure)
- File is brand-new (0 days) — limited historical data
- Unsigned Android APK — no publisher verification available
- Contacted 15 external IPs — but all resolve to benign AWS, Cloudflare, Google infrastructure
This file is safe to use. The tier-1 engine consensus, benign contacted infrastructure, and absence of malicious behaviour all support a clean classification. The DirectIpC2 heuristic fired due to a common mobile-app pattern (hardcoded CDN endpoints), not malicious C2 activity.
YARA + heuristic rules that fired
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
Sample contacted 20 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence3.170.19.97 · 3.170.19.106 · 104.21.15.107
0 detections across 74 engines
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- 1.0.0cni.apk
- Size
- 14.52 MB
- MIME type
- (unknown)
- Detected type
- Android
- SHA-256
- acbc74de88d6d3b2b9656b1f0867d3a2d30efcdb61461a898de1944306ac5538
- MD5
- feaa0c1c81e3292306c44c46d1b0e96a
- SHA-1
- a095b83b17bf8b5f5cc95e658df61c09e339e8c3
- First seen (VT)
- 6/17/2026, 11:37:01 AM
- Last analysis (VT)
- 6/17/2026, 11:37:01 AM
- First scan (MalwareTips)
- 6/17/2026, 5:50:36 PM
- Last scan (MalwareTips)
- 6/17/2026, 5:50:36 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.