File scan report
Verdict Malicious
Is PCW.
An unsigned Windows executable packed with UPX and flagged by 10 of the 70 antivirus engines that checked it, three of them high-reputation ones naming trojan behaviour, with…
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already ran it, follow the steps below.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't run it
Don't run this file. Delete it, then empty the Recycle Bin.
If you already ran it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
If you typed passwords on the device after running it, change them from another device you trust.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
10 of 70 flagged
- Flagged 10
- No detection 60
- No result 5
- Code signing Unsigned
- Test run Partial
- First seen 4mo ago
Chapter 02
Why we think so
6 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Ten of the 70 antivirus engines that checked it flag this executable, including three well-regarded ones that label it a trojan, and the file is a UPX-packed, unsigned binary with nearly maximum code entropy. No publisher identity, reference-database listing or observation from the test run is available, so the detections rest on static rules over packed code. Treat it as untrusted and do not run it.
The binary is a 64-bit Windows executable that was never code-signed, so there is no publisher to vouch for it, and its code is compressed with UPX to the point where the main section sits at maximum entropy. That combination is common in droppers and loaders, which compress their payload so static scanners struggle to read it. The antivirus analysis reflects that: 10 of the 70 antivirus engines that checked it flag the file, and the flags come from several independent, high-reputation products rather than a single noisy one. Those products use broad names, so no specific malware family can be attributed, and the internal names such as Artemis or Tedy point at generic trojan buckets rather than a defined family. Nothing else corroborates or clears the file: no reference database lists this exact sample, our behaviour rules had no completed run to examine, and the file was submitted by only four sources since Jun 12, 2026. With an unsigned, packed executable carrying multiple independent trojan detections and no sign of legitimate circulation, the evidence supports treating it as dangerous rather than merely doubtful.
What We Detected
This is a 64-bit Windows executable of about 1.2 MB. It is not digitally signed, and the antivirus analysis shows its code compressed with the UPX packer: the main packed section sits at an entropy of about 8.0, which is effectively the ceiling for readable data and means almost nothing of the original code is visible without unpacking it first.
Ten of the 70 antivirus engines that checked it flag the file. The most notable are Fortinet, which labels it a possible threat, Trellix with a generic Artemis detection, and Trend Micro with a trojan label in its Tedy naming group. Two further engines in the second tier, DeepInstinct and Panda, also report it as malicious. The remaining flags come from less established products, several of which return machine-learning or hash-reputation style verdicts.
Threat Behavior
No engine names a specific malware family; the labels are broad generic buckets, which is what rule-based detection of packed code typically looks like. What we can say concretely is that a packed, unsigned executable that several independent products call a trojan behaves like the delivery layer of a malware chain: it hides its real code behind compression so that static inspection and signature matching are harder, and it gives no publisher or product identity that would explain why it exists.
No execution was observed for this sample, so nothing can be said about what it would do once launched: no network destinations, injected processes, dropped files or persistence actions were recorded. The reputation cross-check for contacted hosts was not completed. No complete contacted-host reputation result was available. The file also has few distinct submitters and was first seen on Jun 12, 2026, which fits a sample passed around privately or bundled with something else rather than a widely distributed product.
What To Do Now
Do not run this file, and do not launch it to see what it does. Keep your antivirus or security software enabled so it can let your antivirus remove the executable, and if it arrived as a mail attachment, an installer you did not request or an unexpected download, delete it and scan the machine it landed on. If it has already been executed, run a full scan and review recent account activity.
Where this verdict could be wrong4 caveats
- None of the engine labels names a specific malware family; they are broad generic buckets, which is characteristic of rule-based detections on packed files rather than a named signature.
- No dynamic run was completed on these bytes, so no malicious action, network contact or dropped file was ever observed.
- The file is also tagged as corrupt, and a malformed packed executable can trip packer-aware rules in several engines at once.
- At the same time, the reference databases and our own behaviour rules give nothing independent either way, so the strongest evidence remains the antivirus verdicts plus the packing.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No reference database holds a listing for this exact sample, and no community scanning rules matched it
- No brand impersonation was detected, and no hidden characters or misleading extension tricks were found in the file's metadata
- No dropped files or injected processes were recorded, though no dynamic run took place to observe them
- Packed with UPX and left unsigned, with the main code section at maximum entropy so its real contents cannot be read without unpacking
- Flagged by 10 of the 70 antivirus engines that checked it, including Fortinet, Trellix and Trend Micro, which label it a trojan
- No publisher, product name or signing history — nothing identifies who built the file or why
- Submitted by only four sources since it was first seen on Jun 12, 2026, so it has no record of normal distribution
- No behaviour observation was completed, so what the packed payload does when launched is unobserved
- The reputation check for the hosts it would contact was not completed, leaving its network behaviour unknown
6 sources checked · 4 complete · 1 partial · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
No completed test run is saved for this file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Chapter 04
Technical details
10 of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 partial · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 10
- Fortinet (major engine)W32/PossibleThreat
- TrellixENS (major engine)Artemis!09DF32240B55
- TrendMicro (major engine)Trojan.Win32.TEDY.TL0101FE26ZY
- TrendMicro-HouseCall (major engine)Trojan.Win32.TEDY.TL0101FE26ZY
- Antiy-AVLTrojan/Win32.Agent
- DeepInstinctMALICIOUS
- MaxSecureTrojan.Malware.627387097.susgen
- McAfeeDti!1E6E8D00C52E
File fingerprint
- Last analyzed
- Nov 5, 2026, 10:44 AM UTC
- SHA-256
1e6e8d00c52efbdae4a91241d26bfee7891e1ed70479a081ccdff03e3c699440- SHA-1
1e96c8499165ee357be4121002efac8890ffa43a- MD5
09df32240b55abc3d68608ee4c7d1943
About this file
PCW.exe is a Win32 EXE file of 1.2 MB.
- Type and size
- Win32 EXE · 1.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 12, 2026On VirusTotal.
- Submitted by
- 4 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- UPX 5.20 (DetectItEasy packer)Packing hides code; legitimate installers use it too.
- Entropy
- 7.95 of 8A code section is highly compressed or encrypted.
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is PCW.exe malware?
What is PCW.exe?
How many antivirus engines detected PCW.exe?
I already downloaded and ran PCW.exe — what should I do?
How do I remove PCW.exe?
What kind of malware is PCW.exe?
What is the SHA-256 hash of PCW.exe?
How up to date is this analysis of PCW.exe?
Community
Member reviews and reports for this exact file hash.