File scan report
Verdict Safe
Is Hexy. exe safe? Yes, no threats found.
Two less reliable engines flagged an unsigned 13-year-old PE with no major detections or sandbox hits.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
The evidence supports treating the file as safe; continue normal operation with protection left on.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 72 flagged
- Flagged 2
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 14y ago
Chapter 02
Why we think so
0 points against it and 2 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only two less reliable engines reported malicious on this 2012-era unsigned executable. All 17 major antivirus engines stayed silent and no sandbox or external-intel hits exist.
The detection pattern matches the classic less reliable-only false-positive shape: 2 engines flagged it as malicious, no major antivirus engines flagged it, only less reliable engines flagged it. The file is unsigned, yet its medium prevalence and 5225-day history without major or sandbox corroboration weigh against malice. External-intel sources returned zero hits, and no similar-hash verdicts contradict the safe assessment.
What We Detected
Two less reliable engines (APEX, Trapmine) produced generic malicious labels; all 17 major antivirus engines remained silent. The PE is unsigned and carries no code-signing history.
Threat Behavior
No sandbox execution data is available. no complete contacted-host reputation result was available, files it created, or external-intel matches were recorded. The file shows only MITRE techniques common in legitimate software typical of many legitimate executables.
What To Do Now
Keep security software enabled. The less reliable detections alone do not justify blocking; the file can be allowed unless additional context suggests otherwise.
- medium prevalence over 13 years
- no sandbox or external-intel malicious hits
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 3sandbox rule tags
- 0spawned processes
- 0network contacts
- 8filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
3MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1083· Scans your files
Observed activity
Mutexes
8Named locks a program uses so only one copy runs; malware families often reuse them.
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 8 entries for mutexes
MSCTF.Shared.MUTEX.EBHMSCTF.Shared.MUTEX.AAG
Chapter 04
Technical details
2 of the 72 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- APEXMalicious
- Trapminemalicious.high.ml.score
File fingerprint
- Last analyzed
- Sep 6, 2026, 10:06 PM UTC
- SHA-256
1705859e7df1d05ddb1c7e599e31d808499f55c16e9d5d2cfdbf4faa56d13255- SHA-1
156f15064772793ea25cd5c4c578fc100da5d9a0- MD5
49707c9ea6a3300baeb355f56ff0fd6c
About this file
Hexy.exe is a Win32 EXE file of 225.3 kB.
- Type and size
- Win32 EXE · 225.3 kB
- Signer
- UnsignedNo code signature.
- First seen
- May 17, 2012On VirusTotal.
- Submitted by
- 17 distinct sources
- Packer
- None detected
- Entropy
- 6.20 of 8
First scanned
Antivirus consensus
2 of 72 engines flagged this file
4 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust18 engines2flagged
View all 76 engine results
- APEXMalicious: Malicious
- TrapmineMalicious: malicious.high.ml.score
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Hexy.exe safe?
What is Hexy.exe?
How many antivirus engines detected Hexy.exe?
What is the SHA-256 hash of Hexy.exe?
Is it safe to run Hexy.exe?
How up to date is this analysis of Hexy.exe?
Community
Member reviews and reports for this exact file hash.