File scan report

Verdict Safe

Analyzed Sep 3, 20261 month ago

Is [number] safe? Yes, no threats found.

Signed by Wondershare, only one less reliable engine flag, no sandbox or host-reputation issues.

Moderate evidence · No engine flags it, but no publisher signature confirms who made it.

Run it as usual if it came from the official source

The evidence supports treating the file as safe; continue normal security hygiene and only download installers from the vendor's official site.

Good practice2 tips

We found nothing harmful in this file.

Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

1 of 70 flagged

Flagged 1
No detection 69
No result 5

File[number]2.8 MBSHA-256 1edafb47de6c…81c993

Code signing Wondershare Technology Group Co.
Test run Completed
First seen 4mo ago

It has a valid digital signature from Wondershare Technology Group Co..

Chapter 02

Why we think so

0 points against it and 5 in its favour, checked against the scan evidence.

Analyst conclusion

The file is a signed Wondershare installer. 74 of the 70 antivirus engines that checked it report clean; the single less reliable detection is generic adware labeling.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

9sandbox rule tags
1spawned processes
9network contacts
17filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

9

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1027· Obfuscated code
T1027.002· Obfuscated code
T1036
T1055· Process injection
T1071· Application protocol
T1082· System recon
T1497· Sandbox evasion
T1560
T1573

Observed activity

Processes started

1

Programs the file ran, with their command lines.

Dr.Fone_Installer.exe"C:\Users\user\Desktop\Dr.Fone_Installer.exe"

Network contacts

9

9 hosts, listed as 7 addresses, 2 links. Links show the host and path only.

IP address47.88.57.97
IP address47.88.25.126
IP address47.89.242.116
IP address47.246.22.196
IP address47.254.30.36
IP address47.254.24.21

Show all 9 entries

IP address163.181.66.211
URLhttp://platform.wondershare.cc/rest/v2/downloader/runtime/
URLhttp://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA%2FgMquETQMxBsUMjhPIsGg%3D

Files

17

Files the file created, changed or deleted.

WrittenC:\Users\Public\Documents\Wondershare\wae.tmp
WrittenC:\Program Files\wae.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\wae_sensors
WrittenC:\Users\Public\Documents\Wondershare\WAE_DOWNTASK_3366.xml
WrittenC:\Users\Public\Documents\Wondershare\drfone_full3360.exe.~P2S
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9C6Q2GAH\index[1].htm

Show all 17 entries

WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2286DCMF\json2[1].js
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2286DCMF\javascript_call_native[1].js
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2286DCMF\en_banner_1[1].png
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0RWV3A2V\en_banner_2[1].png
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0RWV3A2V\jquery-2_1_4.min[1].js
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0RWV3A2V\en_banner_3[1].png
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0RWV3A2V\en_banner_4[1].png
WrittenC:\Users\Public\Documents\Wondershare\
WrittenC:\Users\user\AppData\Local\Temp\Wondershare\
DeletedC:\Users\Public\Documents\Wondershare\wae.tmp
DeletedC:\Program Files\wae.tmp

Sandbox background — not the file

1

The analysis machine's own processes and connections, recorded in every run.

VM host8.8.8.8

Dropped payload

Files this sample writes at runtime

This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.

9 not checked

46060bfc15b5e89764eb…3e2f50Not checked
no saved verdict
dcac1213e16adf41e3e8…b504a6Not checked
no saved verdict
9dd0f1d3cecd1368d46c…9517f0Not checked
no saved verdict
01c839c0a9c47dc57117…764f71Not checked
no saved verdict
8c99eac4860b82685fb2…c0f100Not checked
no saved verdict
421d999b0f4cecd780c9…f7651fNot checked
no saved verdict
7bb14685f20ef4995672…8ac649Not checked
no saved verdict
a9de9b576bec127869de…fe9e82Not checked
no saved verdict
ee074106cf678b0c3974…1f223cNot checked
no saved verdict

Chapter 04

Technical details

1 of the 70 antivirus engines that checked it flags it; signed by Wondershare Technology Group Co..

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete1 of 70 engines flagged it · 5 gave no result · treated as non-decisive DetailsAug 29, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsSep 3, 2026

Contacted hostsMalwareTips URL scannerPartial2 of 9 contacted hosts were cross-checked; coverage is incomplete DetailsSep 3, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsSep 3, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedSep 3, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchSep 3, 2026

Engines that flagged it 1

The Safe verdict weighed these detections and treats them as non-decisive.

VBA32BScope.Adware.Win32.Wondershare

File fingerprint

Last analyzed: Sep 3, 2026, 1:51 PM UTC

SHA-256: 1edafb47de6ce21df7faa174a0849b0a4b2cb666030db83bd3a38f0c2681c993
SHA-1: b0517f6caad97c577b4ea0b607230a346e8f0c7e
MD5: 936bf4d33e72c0376b79e3fb8aeeec96

About this file

[number] is a Win32 EXE file of 2.8 MB.

Type and size: Win32 EXE · 2.8 MB
Signer: Wondershare Technology Group Co.Valid code signature.
First seen: Jun 12, 2026On VirusTotal.
Submitted by: 35 distinct sources
Packer: None detected
Entropy: 7.63 of 8

First scanned Sep 3, 2026

Antivirus consensus

1 of 70 engines flagged this file

1 malicious0 suspicious69 not flagged5 no result

5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-117 engines
0flagged
Tier-236 engines
0flagged
Low-trust17 engines
1flagged

View all 75 engine results

VBA32Malicious: BScope.Adware.Win32.Wondershare
AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusNo result
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 7.63Unpacked

Section entropy6 sections

.text

6.64

.rdata

5.45

.data

4.51

.tls

0.00

.rsrc

7.70

.reloc

6.60

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium

Unique uploaders

35

Moderate upload volume.

Total submissions

37

Includes repeat uploads by the same source.

First seen

5mo ago

Jun 12, 2026

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is [number] safe?

We found nothing harmful in [number]. 1 of the 70 antivirus engines that checked it flags it; after weighing the other evidence we treat that alert as false alarms. It has a valid digital signature from Wondershare Technology Group Co.. Run it only if it came from the developer's own website or an official app store.

What is [number]?

[number] is a Windows program, about 2.8 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Jun 12, 2026.

How many antivirus engines detected [number]?

1 of the 70 antivirus engines that checked it flags [number] (VBA32). We weigh which engines flagged it and what else the scan found, not just the count.

Is [number] digitally signed?

Yes. [number] has a valid digital signature from Wondershare Technology Group Co., which shows the file hasn't been changed since that publisher signed it. Malware is sometimes signed with stolen certificates, so a signature alone isn't proof of safety.

What is the SHA-256 hash of [number]?

The SHA-256 fingerprint of [number] is 1edafb47de6ce21df7faa174a0849b0a4b2cb666030db83bd3a38f0c2681c993, and its MD5 is 936bf4d33e72c0376b79e3fb8aeeec96. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to run [number]?

We found nothing harmful in [number], and its digital signature checks out. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of [number]?

This report reflects the scan on Sep 3, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Is [number] safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

Engines that flagged it 1

File fingerprint

About this file

1 of 70 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is [number] safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Sandbox background — not the file

Engines that flagged it 1

File fingerprint

About this file

Related file reports