False Positive? Android.Riskware.Repack.rPNRO detected only by BitDefenderFalx on VirusTotal

Question

Hello Bitdefender Team,

I'm an independent Android developer, and one of my applications is being detected as Android.Riskware.Repack.rPNRO by BitDefenderFalx on VirusTotal.

The APK is signed with my own release keystore and is built directly from my source code. It is also published on Google Play and is currently under review for the Samsung Galaxy Store.

VirusTotal reports that only BitDefenderFalx detects the APK as Android.Riskware.Repack.rPNRO, while the other antivirus engines do not report it as malicious.

Could you please help me understand:

* What exactly triggers the Android.Riskware.Repack.rPNRO detection?
* Is this a heuristic/ML detection or does it indicate that the APK appears to be repackaged?
* Are there common coding patterns, libraries, or APK characteristics that can cause this detection?
* Is there anything I can change in my build process to avoid this detection?
* If this is a false positive, what is the recommended process for having the detection reviewed and removed?

I'm happy to provide the VirusTotal report, APK, SHA-256 hash, or any additional information needed for your analysis.

Thank you for your assistance.

MartyKay · Answer

What would be great is a function to exclude threats of which I'm 100% certain (like Testkey.) it aren't threats at all because I let Claude built apps and sign with a test key. With AI great thing have come and as a disabled person I finally have help to do such things using my tab because sitting for 15 to 30 minutes destroys my back so my bed became my workingspace. I can exclude folders, files but why not apps? I've always thought it's a function greatly missed within Bitdefender for Android and I guess I'm not the only one. I understand it will "manipulate" the security framework but knowing I'm the source hence trusted, why no app whitelisting function?

Firefox, Android 16, Samsung Galaxy Tab 11 Ultra, One UI 8.5, Sec Update 5 July '26

Alexandru_BD · Answer

Hi,

You're most welcome.

You can submit samples to Bitdefender Labs directly using the form available at the link below:

https://www.bitdefender.com/consumer/support/answer/29358/

MjApps · Answer

Thank you for your reply

I am still encountering the same temporary false positive when submitting updates for my other applications. Even for the same app from Google play.

Could you please provide an appropriate email address or another private communication channel where I can share the additional information required for your review?

I would also appreciate any recommendations on how to avoid this temporary detection for future releases signed with the same developer account and certificate.

Thank you for your assistance.