File scan report
Verdict Safe
Is com.
No antivirus engine flagged this long-circulating Android app, while its completed sandbox run and fully covered host-reputation check found no hostile evidence.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
The APK can be used if obtained from a trusted source, but review its permissions and monitor data use because of its analytics and telephony-related capabilities. Keep device security protections enabled.
Good practice2 tips
We found nothing harmful in this file.
Install it only from Google Play or the developer's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 67 flagged
- Flagged 0
- No detection 67
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 11y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 67 antivirus engines that checked it flagged the APK, including all 17 major antivirus engines that returned results. It has circulated broadly since 2015, and the completed observation from the test run found no high-risk behavior; all 34 distinct observed network contacts were covered by the host check without a hostile match.
The strongest evidence is the complete absence of detections: none of the 67 antivirus engines that checked it flagged the APK, and 17 major antivirus engines returned no detection. It has also accumulated 641 submissions from 528 sources since 2015, which is consistent with established commodity software rather than a newly introduced payload. One completed sandbox run produced no malicious verdict and mapped no offensive technique. The host-reputation cross-check covered all 34 distinct observed domains, IP addresses, and URLs without a malicious or suspicious match. Obfuscation, reflection, telephony capabilities, and an unsupported community concern warrant ordinary privacy caution, but they do not outweigh the consistent antivirus, runtime, prevalence, and network-reputation evidence.
What We Detected
None of the 67 antivirus engines that checked it flagged this Android package. All 17 major antivirus engines that returned results reported no detection, and no malware family or unwanted-app label was assigned. The package has been submitted 641 times by 528 sources and has been known since 2015.
Threat Behavior
One completed sandbox run recorded no malicious verdict and no high-risk offensive technique. The application contacted Umeng analytics infrastructure and Google service devices. The host-reputation check covered all 34 distinct observed domains, IP addresses, and URLs, finding no known-malicious or known-suspicious host. No persistence indicators were recorded, and no file it created was identified as malicious.
What To Do Now
Install only if the APK came from a source you trust and its requested Android permissions fit a photo-viewing application. Because the package uses obfuscation, reflection, native code, telephony-related capabilities, and analytics services, review its permissions and network usage if privacy is a concern. Keep Android security protections enabled.
Where this verdict could be wrong3 caveats
- The APK is tagged for obfuscation, reflection, runtime modules, telephony access, and embedded native code; these capabilities merit permission review even though no engine or evidence from the test run ties them to malware.
- One uncorroborated community report alleges unusually high network usage and possible photo uploads, but it has no votes and the observed run did not establish such exfiltration.
- One dropped file has no saved verdict, so its status remains unverified rather than confirmed benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 67 antivirus engines that checked it flagged the APK, including the 17 major antivirus engines that returned results.
- A completed sandbox run found no high-risk technique and issued no malicious verdict.
- All 34 distinct observed network contacts received host-reputation coverage, with no malicious or suspicious matches.
- The app has circulated since 2015 across 528 submitters and 641 submissions.
- No malware-specific research rule, known malware-repository match, or malicious file it created was found.
- The package uses obfuscation, reflection, runtime modules, native code, and telephony-related capabilities, which reduce transparency and justify permission review.
- A community report alleges unusually high data usage and possible photo transmission, but the claim is uncorroborated.
- One dropped file lacks a saved assessment, leaving that artifact without complete coverage.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 0spawned processes
- 34network contacts
- 22filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
- T1095· Custom network
- T1406
- T1409
- T1421
- T1426
- T1447
- T1507
- T1573
Observed activity
Network contacts
3434 hosts, listed as 14 domains, 20 addresses, 3 links. Links show the host and path only.
- Domain
alog.umeng.com - Domain
alog.umeng.co - Domain
alog-g.umeng.com - Domain
alog.umeng.com.gds.alibabadns.com - Domain
www.googleapis.com - Domain
android.googleapis.com
Show all 37 entries for network contacts
- Domain
instantmessaging-pa.googleapis.com - Domain
www.gstatic.com - Domain
geller-pa.googleapis.com - Domain
gmscompliance-pa.googleapis.com - Domain
firebaseinstallations.googleapis.com - Domain
connectivitycheck.gstatic.com - Domain
infinitedata-pa.googleapis.com - Domain
clientservices.googleapis.com - IP address
106.11.250.137 - IP address
106.11.250.74 - IP address
140.205.252.16 - IP address
203.119.128.15 - IP address
203.119.128.90 - IP address
203.119.128.99 - IP address
203.119.128.92 - IP address
203.119.128.34 - IP address
203.119.128.118 - IP address
203.119.128.27 - IP address
203.119.129.77 - IP address
106.11.84.6 - IP address
203.119.211.237 - IP address
172.253.120.188 - IP address
106.11.86.70 - IP address
8.211.36.31 - IP address
8.211.35.113 - IP address
172.253.122.188 - IP address
108.177.119.99 - IP address
142.251.31.113 - URL
http://alog.umeng.com/app_logs - URL
http://alog.umeng.co/app_logs - URL
http://connectivitycheck.gstatic.com/generate_204
Files
22Files the file created, changed or deleted.
- Written
/data/data/com.alensw.PicFolder/shared_prefs/com.alensw.PicFolder_preferences.xml - Written
/data/data/com.alensw.PicFolder/shared_prefs/umeng_general_config.xml - Written
/data/data/com.alensw.PicFolder/files/umeng_it.cache - Written
/storage/emulated/0/Android/data/com.alensw.PicFolder/folder_cache - Written
/storage/emulated/0/Android/data/com.alensw.PicFolder/cache/others_3 - Written
/data/data/com.alensw.PicFolder/files/.um/um_cache_1451530995051.env
Show all 22 entries for files
- Written
/data/user/0/com.alensw.PicFolder/shared_prefs/mobclick_agent_online_setting_com.alensw.PicFolder.xml - Written
/data/user/0/com.alensw.PicFolder/files/.imprint - Written
/data/user/0/com.alensw.PicFolder/shared_prefs/umeng_general_config.xml - Written
/data/user/0/com.alensw.PicFolder/files/umeng_it.cache - Deleted
/data/data/com.alensw.PicFolder/shared_prefs/com.alensw.PicFolder_preferences.xml.bak - Deleted
/data/data/com.alensw.PicFolder/shared_prefs/umeng_general_config.xml.bak - Deleted
/storage/emulated/0/Android/data/com.alensw.PicFolder/folder_cache - Deleted
/data/data/com.alensw.PicFolder/files/mobclick_agent_header_com.alensw.PicFolder - Deleted
/data/data/com.alensw.PicFolder/files/mobclick_agent_cached_com.alensw.PicFolder159 - Deleted
/storage/emulated/0/Android/data/com.alensw.PicFolder/cache/others_3 - Deleted
/data/data/com.alensw.PicFolder/shared_prefs/com.alensw.PicFolder_preferences.xml - Deleted
/data/data/com.alensw.PicFolder/shared_prefs/umeng_general_config.xml - Deleted
/data/data/com.alensw.PicFolder/shared_prefs/mobclick_agent_online_setting_com.alensw.PicFolder.xml.bak - Deleted
/data/data/com.alensw.PicFolder/files/accounts.bin - Deleted
/data/user/0/com.alensw.PicFolder/shared_prefs/mobclick_agent_online_setting_com.alensw.PicFolder.xml.bak - Deleted
/data/user/0/com.alensw.PicFolder/shared_prefs/umeng_general_config.xml.bak
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 5277d455bff687ce8749…8823dfNot checkedno saved verdict
Chapter 04
Technical details
None of the 67 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 14, 2026, 7:38 AM UTC
- SHA-256
e40907a528a6d6eed43aa2ceebaa5b3f99d8bf5484dedd2e762e5f1b1f182e9b- SHA-1
d8efb2339485b670be5555e6027f0eebe5cf5dd1- MD5
abdd8eedc39d4cbe6eeb6452fd3e04ce
About this file
com.alensw.PicFolder-4.5.2-159-minAPI5.apk is an Android file of 1.1 MB.
- Type and size
- Android · 1.1 MB
- Signer
- Not applicable
- First seen
- Jun 19, 2015On VirusTotal.
- Submitted by
- 528 distinct sources
First scanned
Antivirus consensus
0 of 67 engines flagged this file
9 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-237 engines0flagged
- Low-trust12 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudNo result
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxClean
- BkavNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightClean
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is com.alensw.PicFolder-4.5.2-159-minAPI5.apk safe?
What is com.alensw.PicFolder-4.5.2-159-minAPI5.apk?
How many antivirus engines detected com.alensw.PicFolder-4.5.2-159-minAPI5.apk?
What is the SHA-256 hash of com.alensw.PicFolder-4.5.2-159-minAPI5.apk?
Is it safe to install com.alensw.PicFolder-4.5.2-159-minAPI5.apk?
How up to date is this analysis of com.alensw.PicFolder-4.5.2-159-minAPI5.apk?
Community
Member reviews and reports for this exact file hash.