Search the hash before uploading
Compute the APK's SHA-256 locally and search for an existing report first. This can avoid submitting a confidential build merely to discover that the exact file was already analyzed. Do not use a report for a different version or similarly named package as evidence about your file.
sha256sum app-release.apk
Record the full hash and analysis timestamp in your review. If the report is old, engine definitions and the surrounding intelligence may have changed; a current result still is not a safety guarantee.
Read detections by meaning
Review which engines flagged the sample, their labels, the file's signing identity and any behavioral or relationship information available. Engine labels differ and are not independent scientific measurements. One specific, well-supported finding can matter more than several vague labels; a false positive is also possible.
Write an evidence statement such as “engine X reports category Y for hash Z; the cause remains unconfirmed,” rather than “three engines prove it is a virus.” That wording keeps a preliminary signal separate from a conclusion.
Understand the sharing model
VirusTotal's own description states that reports are shared with its community and submitted file content may be shared with qualified customers and partners. Do not upload internal builds, unreleased product code or customer data without permission and an appropriate handling agreement.
An API key does not by itself make a public submission private. Check the actual service and contract being used.
Investigate a possible false positive
For your own release, retain the reproducible build, signing information, dependency changes and the smallest safe sample demonstrating the issue. Contact the detecting provider through its published process. Do not remove genuine protections or repeatedly rename the package to evade a detection.
Complement the report
APKLint can help inspect manifest flags, permissions and embedded SDK indicators. Compare those observations with the VirusTotal report and the intended app behavior. Neither tool can establish the complete behavior of a server-controlled feature or prove that a third-party application's future updates will remain safe.
Sources and further reading
- VirusTotal: How it works
- VirusTotal sharing and submission model
- OWASP: Mobile Application Security Testing Guide
Reference review: 22 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
