Malware Analysis About this suspicious apk file

[Allego]

Hello. What are your thoughts about this apk file? It's a modded FB lite app and Kaspersky detects it as not-a-virus:HEUR:RiskTool.AndroidOS.Dnotua.adhu(Confirmed it's a correct detection when I emailed them). I would like to know why because the modder still insisting that it's clean but I doubt it. I already decompiled it but I don't know where to look for. Thanks.