File scan report
Verdict Safe
Is dot
Widely submitted .NET Framework installer with zero engine detections and an NSRL reference entry.
Strong evidence · Widely seen for a long time, and nothing harmful found.
The evidence supports treating the file as a benign, widely distributed .NET Framework installer; no further action is required beyond obtaining it from official sources.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 15y ago
Chapter 02
Why we think so
0 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Zero of the 71 antivirus engines that checked it flagged the file. The sample matches a known .NET Framework redistributable that has been submitted by over 2300 sources since 2011 and carries an NSRL reference. No malicious files it created, sandbox verdicts, or major detections are present.
The file is an unsigned Win32 EXE named dotNetFx40_Full_x86_x64.exe that has existed in the wild for 5567 days and carries a reputation score of 40. All 75 reporting engines returned clean results, including 17 major antivirus engines. External intelligence shows an NSRL hit with no known-malicious flag. Sandbox execution produced only techniques common in legitimate software and no malicious verdict. Although the sample contacted 19 direct IPs, the rule-based rule itself notes that such traffic occurs in legitimate installers and requires host-reputation correlation, which is unavailable because contactedHosts is null.
What We Detected
75 engines scanned the sample; none returned a malicious or suspicious result. The file is unsigned and contains no code-signing certificate. Sandbox analysis recorded nine MITRE techniques common in legitimate software and wrote several temporary files, but produced no malicious verdict and no malicious files it created.
Threat Behavior
No offensive techniques, persistence mechanisms, or a control server indicators were observed. The single triggered rule notes that direct-IP traffic can occur in legitimate installers and must be correlated with host reputation; that correlation is unavailable because the host-reputation check was not completed.
What To Do Now
The file matches the expected profile of the Microsoft .NET Framework 4.0 redistributable. Keep security software enabled and obtain official installers only from Microsoft’s download center.
Where this verdict could be wrong1 caveat
- The missing contacted-host reputation result means host-reputation cross-check was not completed; cannot assert clean network behaviour.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/71 engines malicious
- widely seen and long established prevalence with 2302 submitters
- NSRL reference entry, no known-malicious flag
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 4spawned processes
- 2network contacts
- 36filesystem & mutex artifacts
Includes 9 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 6, 2026, 6:47 AM UTC
- SHA-256
1a1e67809c73cec352fa6a2cc86aa8d09fb41c1d39db5ca8a75f8575f1acaf10- SHA-1
baf9e75b0a3a587510173037dd43226a737364d5- MD5
acac0eba1a5c5151185ec55d67d4c5cf
About this file
dotNetFx40_Full_x86_x64.exe is a Win32 EXE file of 1.6 MB.
- Type and size
- Win32 EXE · 1.6 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 10, 2011On VirusTotal.
- Submitted by
- 2,302 distinct sources
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is dotNetFx40_Full_x86_x64.exe safe?
What is dotNetFx40_Full_x86_x64.exe?
How many antivirus engines detected dotNetFx40_Full_x86_x64.exe?
What is the SHA-256 hash of dotNetFx40_Full_x86_x64.exe?
Is it safe to run dotNetFx40_Full_x86_x64.exe?
How up to date is this analysis of dotNetFx40_Full_x86_x64.exe?
Community
Member reviews and reports for this exact file hash.