File scan report
Verdict Safe
Is com.
None of the 65 antivirus engines that checked it flagged this 61 MB Instagram package, and the observed network contacts stayed on Instagram and Google infrastructure throughout.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
No action is needed for this file; treat it as a normal build of the Instagram app. Keep device protection enabled and prefer installing apps from the official store so the publisher's identity can be verified.
Good practice2 tips
We found nothing harmful in this file.
Install it only from Google Play or the developer's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 4y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No engine flagged this Android package, including all 18 major ones, and two runtime runs showed nothing hostile. The app talked only to Instagram devices and a standard Google connectivity check, wrote its preferences under the Instagram package folder, and none of the 23 contacted hosts has a bad reputation with us. It looks like a genuine mirrored build of the Instagram app.
The engine result is uniformly clean: none of the 65 antivirus engines that checked it flagged the file, and every one of the 18 major antivirus engines that analysed it returned no detection. Observation from the test run backs this up — two separate runs produced no malicious verdict, no high-risk behaviour mappings, and no injected processes. Network activity was confined to Instagram's own devices and Google's standard connectivity probe, which is what this app is expected to contact. All 23 distinct contacted hosts were checked against our reputation data and none carried a malicious or suspicious report. The only weak spots are low crowd-sourced coverage and the absence of any cryptographic proof of publisher identity for this build, neither of which contradicts the clean result.
What We Detected
This is a large Android package (about 61 MB) that describes itself as the Instagram application, carrying a version number and the package identity of the official app. None of the 65 antivirus engines that checked it flagged it, and the 18 major antivirus engines among them — including BitDefender, Kaspersky, ESET, Fortinet, GData and Avira — all reported it clean. Reference databases returned no listings and no community malware rules matched.
The format tags attached to the file are the ordinary ones large Android apps pick up: bundled native libraries and reflection-based code. Nothing in the detection data turned those into a finding.
Threat Behavior
Two runtime runs were recorded and neither produced a malicious verdict. No high-risk techniques were mapped, no processes were injected into, no persistence or scheduled-task behaviour was noted. The app wrote its preferences and cached policy files under its own package directory, which is standard application housekeeping.
Network traffic stayed on Instagram-controlled devices and a standard Google connectivity probe used by Android apps to detect captive portals. All 23 distinct hosts contacted were cross-checked against our reputation records: none is known to be malicious or suspicious.
What To Do Now
Nothing about this file calls for action; it can be treated as a normal build of the application. Keep your device protection and Play Protect enabled, and prefer installing apps from the official store where the publisher identity is verified, since a mirrored copy such as this one cannot be cryptographically tied back to the developer. If the app ever asks for unusual permissions or asks you to disable device protection, treat that as a warning sign.
Where this verdict could be wrong3 caveats
- The package has only two independent submissions behind it, so the reassuring picture rests on the engines and our own observation rather than on a large user base.
- Android packages routinely carry native libraries and reflection code, and the file's generic format tags list exactly those, so a scanner blind spot cannot be entirely excluded even at zero detections.
- No valid signature was checked against a known publisher identity for this build, so the link between these bytes and the official application rests on behaviour and naming rather than cryptographic proof.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 65 antivirus engines that checked it flagged the file, and all 18 major antivirus engines that analysed it reported it clean.
- Two runtime runs recorded no malicious verdict, no high-risk behaviour techniques and no injected processes.
- Network activity was limited to Instagram devices and Google's standard connectivity check, with no unknown destinations.
- All 23 contacted hosts were checked against our reputation data and none is known to be malicious or suspicious.
- The app's own preference files were written under the Instagram package directory, matching what the file claims to be.
- The package comes from a third-party mirror rather than an official store, so the build was not verified through the developer's own distribution channel.
- Only two independent submissions are recorded for this exact copy, so there is little crowd-sourced history behind it either way.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 13sandbox rule tags
- 0spawned processes
- 23network contacts
- 4filesystem & mutex artifacts
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
13MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
- T1406
- T1409
- T1421
- T1424
- T1426
- T1429
- T1430
- T1447
- T1472
- T1507
- T1571· Unusual port
- T1573
Observed activity
Network contacts
2323 hosts, listed as 7 domains, 16 addresses, 1 link. Links show the host and path only.
- Domain
z-p42-instagram.c10r.instagram.com - Domain
graph.instagram.com - Domain
b.i.instagram.com - Domain
i.instagram.com - Domain
instagram.c10r.instagram.com - Domain
geo-p42.instagram.com
Show all 24 entries for network contacts
- Domain
play.googleapis.com - IP address
157.240.241.63 - IP address
31.13.71.174 - IP address
66.102.1.188 - IP address
142.250.153.188 - IP address
142.250.141.188 - IP address
142.250.200.3 - IP address
142.250.187.206 - IP address
172.217.169.78 - IP address
142.250.200.14 - IP address
173.194.202.188 - IP address
142.251.5.188 - IP address
172.217.169.42 - IP address
142.250.187.196 - IP address
172.217.16.234 - IP address
142.250.187.202 - IP address
142.250.200.36 - URL
http://play.googleapis.com/generate_204
Files
4Files the file created, changed or deleted.
- Written
/data/data/com.instagram.android/files/single/AuthHeaderPrefs - Written
/data/user/0/com.instagram.android/app_light_prefs/com.instagram.android/ig_pigeon_sampling_policy_v2_0.5639142330197291002.tmp - Written
/data/user/0/com.instagram.android/shared_prefs/last_django_tier_pref.xml - Deleted
/data/user/0/com.instagram.android/shared_prefs/last_django_tier_pref.xml.bak
Chapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 6, 2026, 6:06 AM UTC
- SHA-256
d05a615709fa8f1a5e13bc70902dcbf7f177e9d34685e618761c965c71bb510e- SHA-1
b31a7496f647c7bd1f1b3e2ab427cfe45d9f3ec8- MD5
c5f37947930cc9fc35fa92b9465ac9ab
About this file
com.instagram.android_257.1.0.16.110-[number]_minAPI23(x86_64)(nodpi)_apkmirror.com.apk is an Android file of 61.4 MB.
- Type and size
- Android · 61.4 MB
- Signer
- Not applicable
- First seen
- Oct 18, 2022On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 65 engines flagged this file
10 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-237 engines0flagged
- Low-trust10 engines0flagged
View all 75 engine results
- AcronisClean
- Ad-AwareClean
- AhnLab-V3Clean
- AlibabaClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxClean
- BitDefenderThetaClean
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- ComodoClean
- CrowdStrikeNo result
- CybereasonNo result
- CylanceNo result
- CynetNo result
- CyrenClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GridinsoftClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MAXClean
- MaxSecureClean
- McAfeeClean
- McAfee-GW-EditionClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightClean
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this file safe?
What is this file?
How many antivirus engines detected this file?
What is the SHA-256 hash of this file?
Is it safe to install this file?
How up to date is this analysis of this file?
Community
Member reviews and reports for this exact file hash.