Safe
Two low-trust engines flagged this archive with generic heuristics; tier-1 engines silent, sandbox clean, no malicious children.
1b7d0a41c0f0e6c68e…23c5424c3bThe verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file exhibits a classic low-trust-only false-positive pattern: 2 of 68 engines flagged it, both from low-trust tiers, with generic heuristic labels and no tier-1 consensus. Sandbox execution revealed no malicious verdict, no malicious dropped children, and no contact with known-malicious hosts. The presence of offensive MITRE techniques (T1485, T1486, T1562.001) in the behaviour profile is offset by the absence of actual malicious sandbox activity and the clean child-file verdicts. The filename 'Aimbot v4.1.2' is consistent with a gaming cheat tool, which explains both the adversarial naming and the high submission volume (1,298 submissions from 1,187 sources over 191 days). No external-intelligence sources (YARA, CIRCL, MalwareBazaar) corroborated the detections. The combination of low-trust-only flagging, clean sandbox, high prevalence, and absence of malicious children strongly indicates this is a benign or grey-area tool rather than malware.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines: 2/68 malicious, both low-trust tier (Bkav, SentinelOne); tier1Malicious=0; onlyLowTrustFlagging=true
behaviour.hasMaliciousSandboxVerdict=false; droppedChildren.hasMaliciousChild=false (10/10 children unknown, none malicious)
prevalence.classification='common_old' (1187 submitters, 1298 submissions over 191 days)
externalIntel: yaraify.ruleCount=0, CIRCL.hit=false, MalwareBazaar.hit=false
signing.verified=false, unsigned; no signer history; triggeredHeuristics=[] (no rules fired)
- All 16 tier-1 engines reported undetected
- Sandbox analysis issued no malicious verdict
- All 10 dropped children have unknown verdicts; none flagged malicious
- No malicious hosts contacted
- High prevalence (1,298 submissions) without corresponding malware reports
- Filename 'Aimbot' suggests gaming cheat tool (grey-area software)
- Offensive MITRE techniques present in sandbox (T1485, T1486, T1562.001)
- Unsigned file with no signer history
- Long-sleep and debug-environment-detection tags suggest anti-analysis behaviour
This file is likely a benign or grey-area gaming tool flagged by low-trust heuristic engines. If you obtained it from a trusted source and intend to use it for gaming, it is safe to proceed. If you are uncertain about its origin, verify the download source and consider running it in an isolated environment before full deployment.
1 contradiction resolved by the scoring engine
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\Users\<USER>\AppData\Local\Temp\_MEI55042\VCRUNTIME140.dll
- C:\Users\<USER>\AppData\Local\Temp\_MEI55042\VCRUNTIME140_1.dll
- C:\Users\<USER>\AppData\Local\Temp\_MEI55042\_asyncio.pyd
- C:\Users\<USER>\AppData\Local\Temp\_MEI55042\_bz2.pyd
- C:\Users\<USER>\AppData\Local\Temp\_MEI55042\_cffi_backend.cp313-win_amd64.pyd
- C:\Users\<USER>\AppData\Local\Temp\_MEI55042\base_library.zip
- C:\Users\<USER>\AppData\Local\Temp\_MEI55042\clr_loader\ffi\dlls\amd64\ClrLoader.dll
- C:\Users\<USER>\AppData\Local\Temp\_MEI55042\clr_loader\ffi\dlls\amd64
- C:\Users\<USER>\AppData\Local\Temp\_MEI55042\clr_loader\ffi\dlls\x86\ClrLoader.dll
- C:\Users\<USER>\AppData\Local\Temp\_MEI55042\clr_loader\ffi\dlls\x86
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- 965f199679afa9b31d53…f12771Never scannednever seen before
- 6a99bc0128e0c7d6cbbf…cbc6c8Never scannednever seen before
- 3b75c4cf714e7e8092f4…32000eNever scannednever seen before
- ab2d0f9637b9209bafb0…7c67a5Never scannednever seen before
- eff52743773eb550fcc6…7b280aNever scannednever seen before
- ccfffddcd3defb8d8990…5f27d7Never scannednever seen before
- ceebae7b8927a3227e53…2f1508Never scannednever seen before
- 37fedcffbf73c4eb9f05…d28e0bNever scannednever seen before
- 18c35ba9b4c29652269f…dbfbc9Never scannednever seen before
- 22c58840705c50a68093…19ac40Never scannednever seen before
2 detections across 75 engines
How often this file shows up in the wild
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- Aimbot v4.1.2.zip
- Size
- 11.56 MB
- MIME type
- (unknown)
- Detected type
- ZIP
- SHA-256
- 1b7d0a41c0f0e6c68eed5d81e26d01eef9bd2b675dc8347d9c8db623c5424c3b
- MD5
- ee9789bf2d552cfe99bb3d9b4f477566
- SHA-1
- f3f1cbe489d8699e5dc28b8f83ae0cee5b6f8e40
- First seen (VT)
- 12/6/2025, 10:55:25 PM
- Last analysis (VT)
- 6/11/2026, 10:09:53 AM
- First scan (MalwareTips)
- 6/15/2026, 9:09:29 PM
- Last scan (MalwareTips)
- 6/15/2026, 9:09:29 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.