File scan report
Verdict Safe
Is Notepad.
All 71 antivirus engines that checked it were free of detections, including 17 major contributors, and the executable carries a verified Microsoft Corporation signature.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Microsoft Corporation
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The strongest evidence is the complete absence of detections across 75 antivirus engines, including all 17 major contributors. The executable is signed with a verified Microsoft Corporation certificate, and the publisher matches the curated trusted-publisher record. Five signer-matched historical samples also received favorable decisions, reinforcing the publisher evidence. One completed sandbox reported no offensive techniques or malicious assessment, although it contacted 162.159.36.2 and no complete host-reputation cross-check is available. Seven YARA rules matched, but the supplied names describe broad injection, debugger-checking, TLS-callback, and compiler patterns rather than a coherent malware family. On balance, the signature, engine results, and historical signer evidence outweigh those nonspecific counter-signals.
What We Detected
The executable produced 0 detections among 75 antivirus engines, with all 17 major contributors reporting no detection. Its digital signature is verified to Microsoft Corporation, and the recognised-publisher check confirms the publisher match. Five previous signer-matched samples also received favorable decisions.
Threat Behavior
One completed sandbox recorded no offensive MITRE techniques and no malicious sandbox assessment. It did contact the IP address 162.159.36.2, but contactedHosts is unavailable, so there is no complete reputation result for that contact. Seven community YARA rules matched, including CP_Script_Inject_Detector and several debugger or compiler-pattern rules; these are meaningful cautions but do not establish a named malware family by themselves.
What To Do Now
Use the file only if it came from Microsoft, Windows Update, or another trusted distribution channel. Keep security software enabled, and verify the Microsoft signature in the file properties if the download source is uncertain.
Where this verdict could be wrong3 caveats
- A count of 7 matching community YARA rules provides researcher-rule corroboration, but the supplied rules do not identify a consistent malware family.
- One of our behaviour rules recorded contact with 162.159.36.2; the missing contacted-host reputation result means its reputation was not completely cross-checked.
- signing.signerStats records 1 malicious result among 18 Microsoft Corporation samples, so the signer history is strongly favorable but not perfect.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/71 antivirus engines detected malware or suspicious content.
- All 17 major contributors reported no detection.
- Verified Microsoft Corporation digital signature.
- Five of five signer-matched historical samples received favorable decisions.
- No offensive techniques or malicious sandbox assessment were recorded.
- Seven community YARA rules matched broad capability or structural patterns.
- The sandbox contacted 162.159.36.2 directly.
- No complete reputation cross-check is available for the contacted IP.
- The file has only medium observed prevalence.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 1sandbox rule tag
- 1spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
1MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
Observed activity
Processes started
1Programs the file ran, with their command lines.
software.exe"C:\Users\user\Desktop\software.exe"
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
162.159.36.2
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Microsoft Corporation.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 11, 2026, 6:37 AM UTC
- SHA-256
03745e9e21684c0e6d9fdc50d91caa0935f4baf50f626c11987ab7d6991d58d1- SHA-1
5540dce5c0f50c31510ca8069e3fe19858aa4634- MD5
1d7737fdd7693bb05229e164c5b45c2b
About this file
Notepad.exe is a Win32 EXE file of 3.3 MB.
- Type and size
- Win32 EXE · 3.3 MB
- Signer
- Microsoft CorporationValid code signature.
- First seen
- Aug 13, 2026On VirusTotal.
- Submitted by
- 19 distinct sources
- Packer
- None detected
- Entropy
- 7.52 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.
Showing the 5 saved rule names of 7 matched.
- CP_Script_Inject_Detectorgeneric
- DebuggerCheck__APIgeneric
- DebuggerCheck__QueryInfogeneric
- golang_bin_JCorn_CSC846generic
- pe_detect_tls_callbacksgeneric
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is Notepad.exe safe?
What is Notepad.exe?
How many antivirus engines detected Notepad.exe?
Is Notepad.exe digitally signed?
What is the SHA-256 hash of Notepad.exe?
Is it safe to run Notepad.exe?
How up to date is this analysis of Notepad.exe?
Community
Member reviews and reports for this exact file hash.