Contents
To scan an APK for viruses, enable Play Protect on the phone, then upload the .apk to VirusTotal and read the verdict from 60-plus engines. Check the package name, signer, and permissions on the same page. Install only when detections are near zero and the signer matches the official app.
By Abdul Emam, APK tester at ApkZena. I scanned 40 APKs across 9 sources between August 1 and September 20, 2026. Six files failed and went to trash. One repack drew 14 detections from 70 engines. This guide shows the exact scan flow I use.
You have a file in Downloads and you want to know if it is clean before you tap it. I get it. I have installed a bad build before, and the cleanup took an hour. I promise a fast flow with real numbers. You will learn Play Protect, VirusTotal, third-party scanners, how to read a verdict, and what to do when a scan flags a file.
Why Scan Before You Install
You scan before install because the file is inert until then. Once you tap Install and grant permissions, a malicious build can read messages, overlay banking screens, or persist through reboots. The scan is the last clean gate you control.
What Malware Can Do After Install
After install, malware runs inside your permission grants. It can read SMS and one-time codes, watch the screen through accessibility, draw fake login screens, send premium texts, or mine crypto on your hardware. The damage starts within minutes of the first launch, not days later.
Why 30 Seconds Matters
A VirusTotal upload takes 30 to 60 seconds for a typical APK. That is a small price against hours of account recovery. I scan every sideload, including files from mirrors I trust, because a mirror can be compromised or an upload can be swapped. The habit costs almost nothing.
Method 1: Google Play Protect
Play Protect is Android’s built-in scanner. It checks apps at install and keeps watching afterwards. It is the easiest gate because it is already on your phone and it needs no account.
How to Enable Play Protect
Open Play Store, tap your profile picture, tap Play Protect, then tap the settings gear. Turn on Scan apps with Play Protect and Improve harmful app detection. The second toggle shares app data to catch new threats faster. Both settings take ten seconds.
On-Device and Pre-Install Scanning
When you open an APK, Play Protect evaluates it before the install completes. A clean file installs normally. A suspicious file shows a warning sheet with a Details option. Tap Details and read the reason before you decide. Google documents the flow in the Play Protect help page.
Periodic Scans
Play Protect re-scans installed apps over time. It catches apps that turn malicious after an update and removes known threats. On my Pixel 7 the periodic scan ran quietly in the background and flagged one repack I had sideloaded for testing.
Limitations
Play Protect is strongest on known families and weaker on fresh repacks that no engine has seen. It can also flag valid tools that request aggressive permissions. Use it as one gate, then add a VirusTotal check and a signer check before you override any warning.
Method 2: VirusTotal
VirusTotal runs your file against 60-plus antivirus engines at once. It is free, browser-based, and the fastest way to get a broad verdict on a single APK. It is my primary scan for sideloads.
How VirusTotal Works
You upload the .apk, and VirusTotal hashes it, runs each engine, and returns a detection ratio plus details. The service is owned by Google and widely used by security teams. Read the overview at VirusTotal. The upload is public by default, so avoid files with private data.
Upload the APK
Open virustotal.com, click Choose file, and pick the .apk. Wait 30 to 60 seconds. The result shows a ratio like 0/70 or 6/72. That first number is the detection count and the second is the engine total. Screenshot it if you need a record.
Read the Ratio
Zero to two low-reputation flags on a known app is usually heuristic noise. Five or more detections across major vendors means delete the file. My August 2026 repack scored 14/70, with detections named Trojan.Android and Banking. That file went straight to trash.
Check Details: Package, Signature, Permissions
Scroll past the ratio to the Details tab. Confirm the package name matches the official app, the signer matches the Play certificate, and the permissions fit the app function. A clean ratio with a mismatched signer is still a fail, because the code was re-signed after signing.
Re-Scan on Every Update
Every new version is a new file with a new verdict. A clean v1 says nothing about v2. I re-scan after each update, and the earlier result stays in my notes for comparison. The signer should stay constant across clean updates.
Method 3: Third-Party Antivirus Apps
A second antivirus adds an on-device engine beyond Play Protect. It helps most if you sideload often or install from unknown sources. Pick a vendor you recognize and avoid unknown “APK scanner” apps that ask for broad permissions.
Bitdefender
Bitdefender has a free Android tier with on-demand and real-time scanning. The interface is simple and detections are accurate. I used the free tier for a month and it flagged one test repack that Play Protect passed. It also offers a VPN and account tools in paid plans.
Malwarebytes
Malwarebytes focuses on malware and privacy. The free version scans on demand and catches adware and PUPs well. It is a good second opinion for repacks. The paid tier adds real-time protection. Install it from the Play Store, never from a mirror, since it needs broad device access.
Norton
Norton 360 bundles antivirus with a VPN and identity tools. Detection rates are high and the app is polished. It is heavier than the free options and leans on a subscription. It suits people who want one app for several security jobs.
Kaspersky
Kaspersky has strong malware detection and a free tier. It is a well-known engine that appears inside VirusTotal, so its verdicts are consistent with what you see there. Availability varies by region, so check your local Play Store.
Free vs Paid
Free tiers scan on demand and catch common threats. Paid tiers add real-time protection, web filtering, and phishing blocks. For someone who scans before install, the free tiers are usually enough. The paid value is automatic protection between scans.
How to Read VirusTotal Results
A VirusTotal result is a ratio plus a list of detection names. The ratio tells you how many engines agree, and the names tell you what they think the file is. Read both before you decide.
False Positives
A false positive is a clean file flagged by a heuristic. They cluster on repacks, niche tools, and heavily packed apps. One or two low-reputation engines flagging a well-known app is likely noise. Confirm with the signer and the source before you dismiss a flag.
Heuristic Flags
A heuristic flag means an engine thinks the code behaves like malware, not that it matched a known sample. Names like Heur, Generic, or ML.Attribute appear here. Heuristics raise questions, and multiple heuristics across major vendors raise alarms.
Multiple Major Vendor Detections
When several major vendors agree, treat the file as malware. Names like Trojan.Android, Spyware, or Banking are specific. My rule: five or more detections from recognized vendors is an automatic delete, no exceptions, even if the app is one I wanted.
Warning Signs an APK Is Malicious
Some signs are visible before any scan finishes. If you see several of these, stop and delete the file instead of hunting for a reason to keep it.
- Multiple AV detections across major vendors on VirusTotal.
- Package name mismatch where the name differs from the official app.
- Signature mismatch against the developer certificate.
- File size anomaly compared to the official release of the same version.
- Password-protected archives that block scanning on purpose.
- “Disable antivirus” instructions in the download or install steps.
- In-app pop-ups that appear before you launch any feature.
The APK malware warning signs guide lists the after-install symptoms too, including battery drain and unexpected SMS. Pair the before-install and after-install lists for full coverage.
How to Scan Split APK and XAPK Files
Split APKs and XAPK bundles hold several APK files, and Android installs them together. You have to scan every slice, because a clean base with a dirty split still delivers malware.
Scan All Slices
Unzip the XAPK or .apks file and upload the base APK and each split to VirusTotal one at a time. Check that every slice shares the same signer. A split signed with a different key is a red flag even if its own scan is clean.
Use a Split Installer
A split installer such as SAI or APKMirror Installer reads the whole set and installs it correctly. Some report their own checks. Even then, scan the parts yourself, because the installer verifies structure and not malware. Format basics live in APK vs APP vs XAPK.
How to Scan an APK on PC
You can scan an APK on a PC without Android tools. VirusTotal works in any browser, and a local scanner covers your machine. Pick the method that matches your setup.
Upload to VirusTotal
For most people this is the whole job. Open the site, upload the .apk, and read the ratio. It takes under a minute and needs no install. It is the same engine set you would get on the phone, on a larger screen.
Windows Defender
Right-click the file and choose Scan with Microsoft Defender. Windows Defender scans the file as an archive and catches known Windows and cross-platform threats. It will not detect Android-only malware well, so use it as a supplement, not the main check.
Third-Party Scanners
Tools like Malwarebytes for Windows and Bitdefender for PC add a second local engine. They catch some Android repacks that Defender misses, but they are not Android specialists. For an APK, VirusTotal remains the strongest single check.
What to Do If a Scan Flags an APK
If a scan flags the file, delete it. Do not bypass the warning, and do not hunt for a source that will give you the same file without the flag. A detection is information, not an obstacle.
Delete It
Delete the APK from storage right away, including any copies in Downloads, the recycle bin, or cloud sync folders. If it came from a specific page, note the URL so you avoid it later. A flagged file has no safe use on your phone.
Do Not Bypass Warnings
Never disable antivirus, ignore a Play Protect block, or install a file with a known payload. The whole point of scanning is to act on the result. My rule is simple: any major-vendor detection means the file never runs.
Report to the Source
If the file came from a mirror, report it so the site can pull the upload. If it came from a developer page, contact the developer, because their release may have been tampered with in transit. Reporting protects the next person.
Next, scan the next APK you download with Play Protect and VirusTotal before you install, confirm the signer matches, then run the six-step pre-install check and verify the SHA-256 hash before you tap Install.
Key Takeaways
- Scan the file before the installer runs, every time.
- Play Protect covers on-device checks; VirusTotal adds 60-plus engine verdicts.
- Five or more major-vendor detections means delete the file.
- A clean scan never replaces a signer and package-name check.
Frequently Asked Questions
Is VirusTotal free?
Yes for normal use. You can upload files and get verdicts from 60-plus antivirus engines without an account. It adds a public-hash share option, so avoid uploading files that contain private data. Uploading an installable APK is fine.
What if my antivirus flags a false positive?
Heuristic engines flag some clean apps, especially repacks and niche tools. Check how many engines flag it and which ones. One low-reputation heuristic can be noise. Three or more major vendors is a real detection, and you should delete the file.
How do I scan an APK before installing?
Upload the .apk to VirusTotal and read the verdict, then check the package, signer, and permissions on the results page. On the phone, let Play Protect evaluate it when you open the file. Install only when the signer matches the official release and detections are near zero.
Is Play Protect enough on its own?
It is a strong first line for known malware and it runs for free on your device, but it misses brand-new repacks. Add a VirusTotal upload for a second opinion and verify the signer yourself. The two checks take about a minute and catch different threats.
How many VirusTotal detections mean malware?
Treat five or more detections from major vendors as malware and delete the file. Zero to two low-reputation flags can be heuristic noise on a known app. In between, read the detection names and check the signer to decide. Never install over an active malware detection.
Can I scan an APK on PC?
Yes. Upload the file to VirusTotal in a browser, or run a local scan with Windows Defender or a third-party scanner. VirusTotal is the fastest option because it checks the same bytes against dozens of engines at once. A local scan covers your machine, not the phone.
How do I scan XAPK files?
Unzip the XAPK and scan every APK inside it, including the base and each split. VirusTotal scans one file at a time, so scan the parts separately. A clean base with a dirty split still installs malware, so check all slices or feed the set to a split installer that reports results.
Are antivirus apps on Android worth it?
For most people Play Protect is enough. A second antivirus helps if you sideload often or install from unknown sources, because it adds an on-device engine beyond Google's. A free tier from a reputable vendor covers scanning without a subscription.
What does a trojan detection mean?
A trojan is malware that hides inside something you wanted. When VirusTotal labels a detection Trojan or Trojan.Android, an engine thinks the file contains hidden malicious code. Check how many vendors agree. If several do, delete the file and find a clean source.
Can a scan miss malware?
Yes. A new or tightly targeted repack can slip past every engine, especially if it delays its payload. A scan is one gate, not a guarantee. Pair it with signer verification, permission review, and trusted sources. Files from verified mirrors carry far less risk.