Direct answer
No single check proves a file is safe. Combine them: trust the source, scan the file on VirusTotal, compare its signing certificate with a known-good version, review the permissions it declares, and watch how it behaves after installation.
1. Judge the source
- Developer's own site or a reputable store: lower risk.
- Mirror sites with many ads and redirects: higher risk.
- Files shared in chat groups: highest risk.
2. Scan on VirusTotal
Upload the APK at virustotal.com. It runs the file through dozens of antivirus engines. One or two minor detections can be false positives; several detections of trojans or spyware are a clear no.
3. Check the signature
Every APK is signed by its developer. Tools such as APK Analyzer or the VirusTotal report show the SHA-256 certificate fingerprint. If the fingerprint differs from a version you trusted before, the file was signed by someone else.
4. Review declared permissions
A video app does not need SMS, contacts, call logs, accessibility services or device-admin rights. Declared permissions are visible in the VirusTotal "Details" tab before you install.
5. Watch the behaviour
If you see any of these, uninstall the app and run a Play Protect scan.
- Pop-up ads outside the app.
- New apps appearing that you did not install.
- Battery or data use spiking.
- The app hiding its icon.
FAQ
Is a clean VirusTotal scan a guarantee?
No. New malware may not be detected yet. It is one check among several.