File scan report
Verdict Safe
Is Terraria Server. exe safe? Yes, no threats found.
Single less reliable engine flag on a 12-year-old unsigned Terraria server binary with no major support.
Strong evidence · Widely seen for a long time, and nothing harmful found.
The sample presents low risk; retain existing antivirus protection and download future Terraria server binaries only from the official site.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 70 flagged
- Flagged 1
- No detection 69
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 14y ago
Chapter 02
Why we think so
0 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
74 engines scanned the file; only Bkav flagged it with a generic label. The sample is unsigned, shows no sandbox malice, and has been submitted by 110 sources since 2012.
The single detection originates from a less reliable engine and no major antivirus engines agrees. The file is unsigned, yet its prevalence classification of widely seen and long established and first-seen date in 2012 indicate long-standing legitimate distribution. Sandbox execution produced no malicious verdict and files it created are clean. The triggered rule notes that direct-IP traffic can occur in legitimate software, and contacted-host reputation data is unavailable.
What We Detected
One less reliable engine (Bkav) returned the generic label W32.AIDetectMalware.CS; the remaining 73 engines reported clean. No major antivirus engines raised an alert.
Threat Behavior
The executable is unsigned. Sandbox analysis recorded typical Windows Error Reporting activity and three Microsoft IP addresses with no domain names. No malicious programs it started or dropped files were observed.
What To Do Now
Keep Windows Defender and other security software enabled. The file can be executed if obtained from the official Terraria server distribution channel; otherwise obtain a fresh copy from the vendor site.
Where this verdict could be wrong1 caveat
- The missing contacted-host reputation result means no complete host-reputation cross-check available for the three observed IPs
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- widely seen and long established prevalence with 110 unique sources since 2012
- no major detections
- sandbox verdict clean
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 1spawned processes
- 1network contact
- 27filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1082· System recon
- T1083· Scans your files
- T1222
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1562.001· Disables security
- T1564.003· Hides artifacts
Observed activity
Processes started
1Programs the file ran, with their command lines.
12f33fcc95b4f7234c8e6d41563139671c529172b0809c91d9c18f9b9c41d9ec.exe%SAMPLEPATH%\12f33fcc95b4f7234c8e6d41563139671c529172b0809c91d9c18f9b9c41d9ec.exe
Network contacts
11 host, listed as 1 address. Links show the host and path only.
- IP address
13.107.4.52
Files
24Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER43F9.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER43F9.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4775.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4775.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER489F.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER489F.tmp.xml
Show all 24 entries for files
- Written
C:\Users\user\AppData\Local\DBG - Written
\Device\ConDrv - Written
\Device\ConDrv\\Connect - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE270.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE34C.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C1.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C2.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E2.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F4.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F3.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F5.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER43F9.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER43F9.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4775.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4775.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER489F.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER489F.tmp.xml
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6688\Sessions\1\BaseNamedObjects\Global\AmiProviderMutex_InventoryApplicationFile\Sessions\1\BaseNamedObjects\Global\425e9dd4-8229-4737-bb29-431b4dd32b99
Sandbox background — not the file
4The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\SysWOW64\WerFault.exe - VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM host
20.99.184.37 - VM host
131.253.33.203
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 3 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 41661342b509c6ef2208…268ab2Not checkedno saved verdict
- 9d3e5c19776ca245baf7…c418dfNot checkedno saved verdict
- 547fc3d658eb3143774a…68e29bNot checkedno saved verdict
Chapter 04
Technical details
1 of the 70 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- BkavW32.AIDetectMalware.CS
File fingerprint
- Last analyzed
- Sep 6, 2026, 6:50 AM UTC
- SHA-256
12f33fcc95b4f7234c8e6d41563139671c529172b0809c91d9c18f9b9c41d9ec- SHA-1
238fd2c499513b6ec0c65e6d17cf719f5ba0c7ef- MD5
45f656011809e31316d33412d36f5a2d
About this file
TerrariaServer.exe is a Win32 EXE file of 1.8 MB.
- Type and size
- Win32 EXE · 1.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jan 18, 2012On VirusTotal.
- Submitted by
- 110 distinct sources
- Packer
- None detected
- Entropy
- 5.55 of 8
First scanned
Antivirus consensus
1 of 70 engines flagged this file
4 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust16 engines1flagged
View all 74 engine results
- BkavMalicious: W32.AIDetectMalware.CS
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BitDefenderThetaClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- MalwarebytesClean
- MAXClean
- MaxSecureClean
- McAfeeClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is TerrariaServer.exe safe?
What is TerrariaServer.exe?
How many antivirus engines detected TerrariaServer.exe?
What is the SHA-256 hash of TerrariaServer.exe?
Is it safe to run TerrariaServer.exe?
How up to date is this analysis of TerrariaServer.exe?
Community
Member reviews and reports for this exact file hash.