Threat LensFile scan report

Is (unnamed file) safe?

18/100

Safety rating

High risk

Verdict

Malicious

Five high-trust engines identify trojan-like content in this new RAR archive, reinforced by defense-impairment and anti-analysis behavior during execution.

Nine of 75 engines flagged this newly observed RAR archive, including five high-trust detections naming GenKryptik, Evo, and DLL-hijacking trojan patterns. Runtime analysis also observed T1562.001 defense impairment and anti-analysis activity, although its overall sandbox label was clean and the extracted children remain unclassified.

Do not open this file

Quarantine the archive and do not open it outside an isolated analysis environment. Keep security protection enabled and perform a full system scan if the archive or its extracted executable has already run.

Read the full analysis

Saved file evidenceAntivirus consensus

9of 75 flagged

Flagged 9No detection 66

Digital specimen(unnamed file)09550fde36cdbec5b6…2b954035f39344

Size15.1 MB

Code signingNot applicable

SandboxRuntime complete

First seenToday

Evidence2 priority signals

9 of 75 antivirus engines flagged the file, including Avast and AVG.

Before opening

Do not open it. Delete this file from the device, then empty the Recycle Bin or Trash.

If you already opened it

Close it. If it opened links, requested credentials, or triggered unexpected behavior, disconnect from the internet and run a full device scan.

Chapter 02

Intelligence

The saved assessment, checked against the scan evidence and recorded coverage.

Analyst conclusion

Where this verdict could be wrong4 caveats

The sole completed sandbox labeled the run clean, so runtime analysis did not independently produce a malware verdict.
Eleven tier-1 engines reported no detection, including BitDefender, Microsoft, Fortinet, and Emsisoft.
droppedChildren.hasMaliciousChild=false, although all five child verdicts are unknown and therefore do not establish that the extracted payloads are benign.
externalIntel.yaraify.ruleCount=0 and externalIntel.malwareBazaar.hit=false provide no researcher or repository corroboration.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Recommended action

Scan transparency

Coverage & freshness

4 of 5 complete

Complete means the check returned a usable result. It does not mean the file is safe.

Antivirus
Complete
9 of 75 engines flagged the file.
Updated Oct 5, 2026, 3:28 AM UTC
Sandbox
Complete
1 isolated runtime environment contributed observations.
Updated Oct 5, 2026, 4:01 AM UTC
Network
Partial
3 of 11 contacted hosts were cross-checked; coverage is incomplete.
Updated Oct 5, 2026, 4:01 AM UTC
YARA
Complete
Rule evaluation completed with no recorded matches.
Updated Oct 5, 2026, 4:01 AM UTC
External intel
Complete
3 of 3 independent reference sources completed.
Updated Oct 5, 2026, 4:01 AM UTC

Chapter 03

Behavior

Plain-English impact first, then the observed runtime evidence.

Runtime flight recorder

Capture complete

1isolated sandbox run
9MITRE ATT&CK techniques
9spawned processes
12network contacts
16filesystem & mutex artifacts

What this file does

Observed actions and their security significance

High concern: Attempted to impair or bypass security controls.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Removed execution artefacts or logs, which can conceal activity.
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Note: Reads your Windows user-account details.
Note: Collects details about your system.

These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.

Threat context

How trojans work

A trojan disguises itself as something useful or harmless to trick you into running it. Once open, it does its real job in the background — anything from stealing data to opening a back door or downloading more malware.

Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.

Recorded behavior

Attack story

Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.

ObservedDerived

Input file

The submitted object

FileObserved
Scanned file
09550fde36cdbec5b660fbccf678b8d7a4e3c6816da6bda5a62b954035f39344
01Uploaded file

Processes

Runtime execution

ProcessObserved
Observed process
"C:\Users\<USER>\AppData\Local\Temp\?????????????????_???????_??????????????_????_docx.z.exe"
02Isolated runtime analysis
ProcessObserved
Observed process
"C:\Users\<USER>\AppData\Local\Temp\is-6N2AT.tmp\?????????????????_???????_??????????????_????_docx.z.tmp" /SL5="$200EC,19005095,119296,C:\Users\<USER>\AppData\Local\Temp\?????????????????_???????_??????????????_????_docx.z.exe"
03Isolated runtime analysis
+1 more recorded observation in Analyst mode

Files

Created or changed

Written fileObserved
x17e6_docx.z.tmp
C:\Users\<USER>\AppData\Local\Temp\is-6N2AT.tmp\\x1794\x17d2\x179a\x1780\x17b6\x179f\x178a\x17c6\x17a1\x17be\x1784\x1790\x17d2\x1793\x17b6\x1780\x17cb_\x179a\x178a\x17d2\x178b\x1794\x17b6\x179b_\x178f\x17b6\x1798\x179c\x17c1\x1793\x1787\x17d2\x179a\x17be\x179f\x179a\x17be\x179f_\x17e2\x17e0\x17e2\x17e6_docx.z.tmp
04Isolated runtime analysis
Written fileObserved
Programs
C:\Users\user\AppData\Local\Programs
05Isolated runtime analysis
+1 more recorded observation in Analyst mode

Network

Hosts contacted

Contacted hostDerived
www.ssl.com
Saved reputation verdict: suspicious.
06Contacted-host cross-check
Contacted hostObserved
atm.teams.mira.tm.svc.cloud.microsoft
Contact observed during runtime.
07Isolated runtime analysis
+1 more recorded observation in Analyst mode

7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

VT: CLEAN·clean

MITRE ATT&CK

Adversary techniques mapped to the MITRE ATT&CK framework.

T1027· Obfuscated codeT1033· Reads user infoT1036T1047T1070· Covers its tracksT1071· Application protocolT1082· System reconT1497· Sandbox evasionT1562.001· Disables security

Spawned processes

$(unnamed)

"C:\Users\<USER>\AppData\Local\Temp\?????????????????_???????_??????????????_????_docx.z.exe"

$(unnamed)

"C:\Users\<USER>\AppData\Local\Temp\is-6N2AT.tmp\?????????????????_???????_??????????????_????_docx.z.tmp" /SL5="$200EC,19005095,119296,C:\Users\<USER>\AppData\Local\Temp\?????????????????_???????_??????????????_????_docx.z.exe"

$(unnamed)

C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\download.rar"

$(unnamed)

C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\w4ymvx0h.25u" "C:\Users\user\Desktop\download.rar"

$(unnamed)

C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

$(unnamed)

C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\w4ymvx0h.25u\?????????????????_???????_??????????????_????_docx.z.exe"

$(unnamed)

C:\Users\user\AppData\Local\Temp\w4ymvx0h.25u\?????????????????_???????_??????????????_????_docx.z.exe

$(unnamed)

"C:\Users\user\AppData\Local\Temp\is-O0K50.tmp\?????????????????_???????_??????????????_????_docx.z.tmp" /SL5="$10472,19005095,119296,C:\Users\user\AppData\Local\Temp\w4ymvx0h.25u\?????????????????_???????_??????????????_????_docx.z.exe"

+1 more processes captured.

Network activity

Domains2

www.ssl.com
atm.teams.mira.tm.svc.cloud.microsoft

IP addresses8

1.0.0.1
223.5.5.5
223.6.6.6
3.222.168.199
9.9.9.9
1.1.1.1
142.250.69.163
65.75.210.175

URLs2

http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
http://connectivitycheck.gstatic.com/generate_204

Persistence

Registry keys set2

HKEY_CURRENT_USER\Software\Microsoft\RestartManager
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000

Filesystem & mutexes

Files written14

C:\Users\<USER>\AppData\Local\Temp\is-6N2AT.tmp\\x1794\x17d2\x179a\x1780\x17b6\x179f\x178a\x17c6\x17a1\x17be\x1784\x1790\x17d2\x1793\x17b6\x1780\x17cb_\x179a\x178a\x17d2\x178b\x1794\x17b6\x179b_\x178f\x17b6\x1798\x179c\x17c1\x1793\x1787\x17d2\x179a\x17be\x179f\x179a\x17be\x179f_\x17e2\x17e0\x17e2\x17e6_docx.z.tmp
C:\Users\user\AppData\Local\Programs
C:\Users\user\AppData\Local\Programs\Common
C:\Users\user\AppData\Local\Temp\is-0RC1V.tmp
C:\Users\user\AppData\Local\Temp\is-0RC1V.tmp\_isetup

+9 more

Mutexes created2

\Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000

Dropped payload

Files this sample writes at runtime

This file drops 5 children at runtime. None are currently flagged malicious in our cache.

5 unseen

cf0018affdd0b7921f92…4aa839Never scanned
never seen before
a7b828236be8728f9b3c…ce6cf6Never scanned
never seen before
388a796580234efc95f3…136f95Never scanned
never seen before
9884e9d1b4f8a873ccbd…360d87Never scanned
never seen before
92ddd04e78fea80cb0db…b4ae9cNever scanned
never seen before

Network activity

Servers this file contacts

This file contacts 1 host we've flagged suspicious in our own URL scanner.

1 suspicious3 checked

www.ssl.comsuspicious
risk 31last scanned Jun 9, 2026view host report

Cross-referenced with our URL scanner cache. Click any host to see its report.

Chapter 04

Detection & Forensics

Consensus, attribution, signatures, code structure, prevalence, and identity.

RecordedObserved or authoritative facts

DerivedEvidence-backed analyst inferences

0rule hits recorded
9 / 75engines flagged
1sources in submission history

Evidence provenance

Why these facts are shown

Each statement identifies whether it was directly recorded or derived from saved scan facts.

01
9 of 75 antivirus engines flagged the file, including Avast and AVG.
Verdict inputView chapter
ProvenanceObserved
SourceAntivirus analysis
Observed atOct 5, 2026, 3:28 AM UTC
02
The hash has been submitted 1 time from 1 source.
View chapter
ProvenanceDerived
SourceSaved report facts
Observed atOct 5, 2026, 4:01 AM UTC
03
Scanned file: Scanned file — 09550fde36cdbec5b660fbccf678b8d7a4e3c6816da6bda5a62b954035f39344
View chapter
ProvenanceObserved
SourceUploaded file
Observed atOct 5, 2026, 4:01 AM UTC
04
Observed process — "C:\Users\<USER>\AppData\Local\Temp\?????????????????_???????_??????????????_????_docx.z.exe"
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atOct 5, 2026, 4:01 AM UTC
05
Observed process — "C:\Users\<USER>\AppData\Local\Temp\is-6N2AT.tmp\?????????????????_???????_??????????????_????_docx.z.tmp" /SL5="$200EC,19005095,119296,C:\Users\<USER>\AppData\Local\Temp\?????????????????_???????_??????????????_????_docx.z.exe"
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atOct 5, 2026, 4:01 AM UTC
06
File written: x17e6_docx.z.tmp — C:\Users\<USER>\AppData\Local\Temp\is-6N2AT.tmp\\x1794\x17d2\x179a\x1780\x17b6\x179f\x178a\x17c6\x17a1\x17be\x1784\x1790\x17d2\x1793\x17b6\x1780\x17cb_\x179a\x178a\x17d2\x178b\x1794\x17b6\x179b_\x178f\x17b6\x1798\x179c\x17c1\x1793\x1787\x17d2\x179a\x17be\x179f\x179a\x17be\x179f_\x17e2\x17e0\x17e2\x17e6_docx.z.tmp
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atOct 5, 2026, 4:01 AM UTC
07
File written: Programs — C:\Users\user\AppData\Local\Programs
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atOct 5, 2026, 4:01 AM UTC
08
Contacted host: www.ssl.com — Saved reputation verdict: suspicious.
View chapter
ProvenanceDerived
SourceContacted-host cross-check
Observed atJun 9, 2026, 2:10 AM UTC
09
Contacted host: atm.teams.mira.tm.svc.cloud.microsoft — Contact observed during runtime.
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atOct 5, 2026, 4:01 AM UTC

Evidence map

Detection sources at a glance

4 completed · 0 unavailable

Antivirus

Threat match

9/75 flagged

Malware samples

No match

no match

Researcher rules

No match

no match

Reference software

No match

no match

Threat attribution

GenKryptik

Category: generic-trojan

External intelligence

No researcher-database hits

MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.

YARA rules

No matches

The rule pass completed without a saved public match.

Antivirus consensus

9 of 75 engines flagged this file

9 malicious0 suspicious66 not flagged

Tier-117 engines

6flagged

Tier-241 engines

1flagged

Low-trust17 engines

2flagged

Avastmalicious

Win64:Evo-gen [Trj]

AVGmalicious

Win64:Evo-gen [Trj]

Aviramalicious

TR/W64.Evo

Cynetmalicious

Malicious (score: 99)

DeepInstinctmalicious

MALICIOUS

ESET-NOD32malicious

Win64/GenKryptik.HUYT trojan

F-Securemalicious

Trojan.TR/W64.Evo

Kasperskymalicious

HEUR:Trojan.Win64.DllHijack.gen

Risingmalicious

Trojan.Kryptik/x64!1.14867 (CLASSIC)

View all 75 engine results

AvastDET

AVGDET

AviraDET

CynetDET

DeepInstinctDET

ESET-NOD32DET

F-SecureDET

KasperskyDET

RisingDET

AcronisOK

AhnLab-V3OK

Alibabatyp

alibabacloudOK

ALYacOK

Antiy-AVLOK

APEXtyp

ArcabitOK

Avast-Mobiletyp

BitDefenderOK

BitDefenderFalxtyp

BkavOK

CAT-QuickHealOK

ClamAVOK

CMCOK

CrowdStrikeOK

CTXOK

Cylancetyp

DrWebOK

Elastictyp

EmsisoftOK

FortinetOK

GDataOK

GoogleOK

GridinsoftOK

huorongOK

IkarusOK

JiangminOK

K7AntiVirusOK

K7GWOK

KingsoftOK

LionicOK

MalwarebytesOK

MaxSecureOK

McAfeeDOK

MicrosoftOK

MicroWorld-eScanOK

NANO-AntivirusOK

Paloaltotyp

PandaOK

SangforOK

SentinelOneOK

SkyhighOK

SophosOK

SUPERAntiSpywareOK

SymantecOK

SymantecMobileInsighttyp

TACHYONOK

tehtristyp

TencentOK

Trapminetyp

TrellixENSOK

TrendMicroOK

TrendMicro-HouseCallOK

Trustlooktyp

VaristOK

VBA32OK

VIPREOK

VirITOK

ViRobotOK

WebrootOK

XcitiumOK

YandexOK

ZillyaOK

ZoneAlarmOK

ZonerOK

PE structure

Not applicable

PE structure analysis applies to Windows executable formats, not this file type.

Prevalence

How widely this file has been seen

Barely seen in the wild and first surfaced recently. 9 antivirus detections make that low prevalence materially relevant, but rarity alone is not proof of malware.

Rare & new

Unique uploaders

Very few people have ever uploaded this — rare.

Total submissions

Includes repeat uploads by the same source.

First seen

0d ago

Oct 5, 2026

Prevalence quadrant

here

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

File identity

Fingerprint and provenance

File name: (unnamed file)
Format: RAR
Code signing: Not applicable to this file type
Size: 15.1 MB
Last analyzed: Oct 5, 2026, 4:01 AM UTC

SHA-256

09550fde36cdbec5b660fbccf678b8d7a4e3c6816da6bda5a62b954035f39344

Chapter 05

Safety & FAQ

Complete recovery guidance and answers for the next decision.

What to do now

This file is dangerous. Treat it as harmful and remove it.

Recovery step 01
Don't open this file. Delete this file from the device, then empty the Recycle Bin or Trash.
Recovery step 02
If you already opened it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
Recovery step 03
If you typed any passwords while it was open, change them from a device you trust.
Recovery step 04
Get a fresh copy from the original trusted source and verify its exact hash when possible.

Safety FAQ

Direct answers grounded in the saved verdict and evidence in this report.

8 evidence-based answers

Is this file malware?

Evidence-based answer

Yes — this file is malicious. Do not open it. Delete this file from the device, then empty the Recycle Bin or Trash. 9 of 75 antivirus engines flag it (family: GenKryptik). It behaves as a trojan — malware disguised as something harmless to trick you into running it. If you've already opened it, see the removal and recovery steps below.

What is this file?

Evidence-based answer

this file is a file, about 15.1 MB. Our analysis identifies it as malicious (family: GenKryptik) — a trojan — malware disguised as something harmless to trick you into running it. Because a file's name and icon can be faked, the safest way to identify it is by its cryptographic hash (below), not its filename.

How many antivirus engines detected this file?

Evidence-based answer

9 of 75 antivirus engines flagged this file, 9 of them as outright malicious. The raw count alone does not establish safety or danger; we also weigh which engines flagged it and corroborating behavior, identity, reputation, and rule evidence. The malicious verdict comes from the complete saved evidence, not from this antivirus count by itself.

I already downloaded and opened this file — what should I do?

Evidence-based answer

Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.

How do I remove this file?

Evidence-based answer

To remove this file: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete this file from the device, then empty the Recycle Bin or Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.

What kind of malware is this file?

Evidence-based answer

this file is classified as a trojan — malware disguised as something harmless to trick you into running it. Engines attribute it to the GenKryptik family. Knowing the family matters because it tells you the likely impact — data theft, remote control, file encryption, or unwanted ads — and guides the cleanup.

What is the SHA-256 hash of this file?

Evidence-based answer

The SHA-256 hash of this file is 09550fde36cdbec5b660fbccf678b8d7a4e3c6816da6bda5a62b954035f39344, and its MD5 is f849231d023c278df09017427a8fa2e4. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

How up to date is this analysis of this file?

Evidence-based answer

This report reflects the scan run on October 5, 2026. Because a file's hash never changes, the identity of this file is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is (unnamed file) safe?

Five high-trust engines identify trojan-like content in this new RAR archive, reinforced by defense-impairment and anti-analysis behavior during execution.

Recommended next actions

Before opening

If you already opened it

What We Detected

Threat Behavior

What To Do Now

Coverage & freshness

Antivirus

Sandbox

Network

YARA

External intel

Runtime flight recorder

What this file does

Threat context

Attack story

Scanned file

Observed process

Observed process

x17e6_docx.z.tmp

Programs

www.ssl.com

atm.teams.mira.tm.svc.cloud.microsoft

Why these facts are shown

Detection sources at a glance

YARA rules

PE structure

Fingerprint and provenance

What to do now