File scan report
Verdict Safe
Is Dolphin.
No antivirus engine flagged this broadly submitted executable, and the completed sandbox run was clean despite uncorroborated injection and archiving technique mappings.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 18d ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 70 antivirus engines that checked it flagged the executable, including the major antivirus engines, and its completed sandbox run returned clean. The file is unsigned and received and mappings, but no injection target, malicious child, family attribution, or malware-specific research rule corroborates those mappings.
None of the 70 antivirus engines that checked it flagged the file, and no independent or major detection identified a malware family. One completed sandbox run returned clean and recorded no contacted domains, dropped files, persistence indicators, or injected target processes. The and mappings remain noteworthy, but the saved evidence does not establish the injection method, target, or harmful intent. Distribution across 133 sources and 141 submissions in five days supports common software rather than an isolated payload. The unsigned status and short history reduce assurance, and no complete contacted-host reputation result is available, but the overall evidence favors benign software.
What We Detected
None of the 70 antivirus engines that checked it flagged Dolphin.exe, including the major antivirus engines, and no engine supplied a threat-family label. The file has also appeared through 133 sources across 141 submissions, indicating broad recent distribution rather than a single isolated upload.
Threat Behavior
One completed sandbox run returned clean. It mapped T1055 (Process Injection) and T1560 (Archive Collected Data), but recorded no injected target process, dropped files, persistence indicators, or sample-attributed network contacts. These technique mappings warrant awareness but do not, without corroboration, establish harmful activity. A complete contacted-host reputation cross-check was not available.
What To Do Now
Obtain the executable from its official distribution channel and verify its hash where the publisher provides one. Keep security software enabled, and use additional isolation before execution if the download source or expected application identity is uncertain.
Where this verdict could be wrong3 caveats
- The executable is unsigned, so there is no verified publisher identity.
- The sandbox mapped process injection and archive collected data; these capabilities can be abused even though the run produced no malicious verdict or identified injection target.
- The file was first observed on Oct 8, 2026, leaving limited long-term reputation history.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it flagged the file.
- All 17 major antivirus engines that returned results were silent.
- The completed sandbox run returned clean and identified no injected target process.
- The file has been submitted 141 times by 133 sources.
- No malware-specific research rule, known malicious child, or external family attribution was found.
- The executable is unsigned, so its publisher cannot be authenticated.
- The sandbox mapped possible process injection and data archiving capabilities.
- Only five days of observation history are available.
- No complete reputation cross-check of contacted hosts is available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 8sandbox rule tags
- 3spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
8MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1036
- T1055· Process injection
- T1056· Keylogging
- T1071· Application protocol
- T1553
- T1553.002
- T1560
Observed activity
Processes started
3Programs the file ran, with their command lines.
Dolphin.exe"C:\Users\user\Desktop\Dolphin.exe" -installDolphin.exe"C:\Users\user\Desktop\Dolphin.exe" /installDolphin.exe"C:\Users\user\Desktop\Dolphin.exe" /load
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 13, 2026, 2:11 AM UTC
- SHA-256
17b01a8629d865378a45e58d5fcebf9dcc3f7919c719130a4ffdd1ca2b27b635- SHA-1
6a5f1ecc2ba44e930f0f74ea7dfb862ec0c4d874- MD5
ad70b165a643f9797ab46d43ea3de72f
About this file
Dolphin.exe is a Win32 EXE file of 22.7 MB.
- Type and size
- Win32 EXE · 22.7 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 8, 2026On VirusTotal.
- Submitted by
- 133 distinct sources
- Packer
- None detected
- Entropy
- 6.19 of 8
First scanned
Antivirus consensus
0 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Dolphin.exe safe?
What is Dolphin.exe?
How many antivirus engines detected Dolphin.exe?
What is the SHA-256 hash of Dolphin.exe?
Is it safe to run Dolphin.exe?
How up to date is this analysis of Dolphin.exe?
Community
Member reviews and reports for this exact file hash.