File scan report
Verdict Safe
Is bcdboot.
None of the 71 antivirus engines that checked it flagged this 64-bit Windows boot-configuration tool, and five sandbox runs recorded no high-risk behaviour, network contacts or…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
No action is needed if this file came from Windows or official Microsoft media. Prefer the built-in system copy over versions downloaded from other sites.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 12d ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The combined sandbox verdict was clean, with no injection, no network contacts and no persistence. The file is not packed. It carries no embedded signature and is rarely submitted, so it is best obtained from Windows itself.
The combined sandbox verdict was clean. The runs showed only techniques common in legitimate software, with no process injection, network contacts or persistence. Static structure is ordinary: entropy is moderate, no packer was found, and the section layout matches a normally built 64-bit Windows binary. Reference databases and community rule sets returned no matches. The main limitations are the missing embedded signature and the small number of submitters since it was first seen on Oct 13, 2026.
What We Detected
None of the 71 antivirus engines that checked it flagged this 64-bit executable, and all major antivirus engines reported it clean. Malware sample databases and community rule sets returned no matches. The file is unpacked, with moderate entropy and a conventional section layout.
Threat Behavior
The combined sandbox verdict was clean. The sample launched only its own process with a few command-line switches. It made no network contacts, injected into no other process and set up no persistence. The techniques recorded are ones common in legitimate software. No contacted-host reputation result is available, but no contacts were observed.
What To Do Now
No action is needed if this copy came from a Windows installation or Microsoft media. The file has no embedded signature, so avoid copies of system tools downloaded from third-party sites. Use the version built into Windows where possible.
Where this verdict could be wrong1 caveat
- The file carries no embedded signature and has only a few submitters since it was first seen on Oct 13, 2026. A copy of a Windows system tool obtained outside Windows itself cannot be confirmed as the genuine Microsoft file from this evidence alone.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged it, including all major antivirus engines
- The combined sandbox verdict was clean with no injection, persistence or network contacts
- Not packed; moderate entropy and an ordinary section layout
- No matches in malware sample databases or community rule sets
- No embedded code signature on a file named after a Windows system tool
- Few submitters since it was first seen on Oct 13, 2026
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 20sandbox rule tags
- 4spawned processes
- 0network contacts
- 1filesystem & mutex artifacts
Includes the sandbox verdicts, 20 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 23, 2026, 4:56 PM UTC
- SHA-256
11810a37e5a10f67c448bae41b7463cb56d6ca7a0d9b83e555cb76e80c2bdd93- SHA-1
884f4c0130705a6c2cd9f225acae52d2a215da49- MD5
3d03e952a28839e5bcf429e6f5f2de6f
About this file
bcdboot.exe says it is Bcdboot utility (Microsoft® Windows® Operating System), 311.3 kB.
- Claims to be
- Bcdboot utility (Microsoft® Windows® Operating System)From the file's own version information, written by whoever built it.
- Original name
- bcdboot.exeMatches the shared file name.
- Type and size
- Win32 EXE · 311.3 kB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 13, 2026On VirusTotal.
- Submitted by
- 4 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.05 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is bcdboot.exe safe?
What is bcdboot.exe?
How many antivirus engines detected bcdboot.exe?
What is the SHA-256 hash of bcdboot.exe?
Is it safe to run bcdboot.exe?
How up to date is this analysis of bcdboot.exe?
Community
Member reviews and reports for this exact file hash.