File scan report
Verdict Malicious
Is JOAT(DEMOBUILD).
Two major antivirus engines identify Wacatac infostealer; sandbox data confirms anti-analysis behaviour (bcdedit testsigning bypass).
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
Isolate and remove this file immediately. Do not execute it under any circumstances. If already executed, perform a full system scan and reset credentials for sensitive accounts.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't run it
Don't run this file. Delete it, then empty the Recycle Bin.
If you already ran it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
From another device you trust, change the passwords of your important accounts (email and banking first) and turn on two-step verification.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 71 flagged
- Flagged 2
- No detection 69
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 4mo ago
Chapter 02
Why we think so
5 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Microsoft Defender and Symantec both flag this unsigned executable as malicious, with Microsoft naming the Wacatac infostealer family. Sandbox analysis captured process execution of 'bcdedit /set testsigning on', a known anti-analysis technique to disable driver signature enforcement. The combination of major antivirus engine consensus and offensive MITRE techniques indicates genuine malware, not a false positive.
This file exhibits a clear malicious profile: two major antivirus engines (Microsoft Defender, Symantec) independently flagged it, with Microsoft naming Wacatac, a known infostealer family. The file is unsigned and rare (0 days old, 1 submitter), offering no signer legitimacy to contest the detections. Critically, sandbox data shows the executable spawned a process chain executing 'bcdedit /set testsigning on', a well-known anti-analysis and anti-tamper technique used by malware to disable driver signature enforcement and evade security tools. This behaviour aligns with MITRE techniques T1490 (Inhibit System Recovery) and T1562.001 (Disable or Modify Tools), both offensive techniques used exclusively by malware and hacktools. While 69 of 71 engines remain silent and external intelligence (CIRCL, MalwareBazaar, YARA) returned no hits, the major consensus combined with confirmed offensive behaviour in the test run overrides the low detection ratio. The absence of external corroboration likely reflects the sample's newness rather than legitimacy.
What We Detected
Two major antivirus engines flagged this file as malicious. Microsoft Defender identified it as Trojan:Win32/Wacatac.B!ml, a variant of the Wacatac infostealer family known for credential theft and information exfiltration. Symantec independently flagged it with a high-confidence machine-learning detection. The file is unsigned, newly submitted (0 days old), and has no signer history to validate legitimacy.
Threat Behavior
Sandbox analysis captured the executable executing a process chain that invokes bcdedit /set testsigning on, a Windows boot-configuration command used to disable driver signature enforcement. This is a classic anti-analysis and anti-tamper technique employed by malware to evade security tools and kernel-mode protections. The behaviour maps to MITRE ATT&CK techniques T1490 (Inhibit System Recovery) and T1562.001 (Disable or Modify Tools), both offensive techniques used exclusively by malware and penetration-testing tools. No malicious network contact or file drops were recorded in this sandbox run, but the anti-analysis behaviour itself is a strong indicator of malicious intent.
What To Do Now
Do not execute this file. Remove it immediately if present on your system. If you downloaded it, verify the source and check your system for signs of compromise (credential theft, unexpected network connections, persistence mechanisms). Run a full antivirus scan and consider resetting passwords for sensitive accounts if the file executed before detection.
Where this verdict could be wrong3 caveats
- Only 2/71 engines flagged malicious; 69 engines silent. Could reflect a new variant not yet widely detected, or a false positive by two engines. However, both flagging engines are major (Microsoft, Symantec), not less reliable rule-based engines, which strengthens confidence.
- No malicious sandbox verdict explicitly recorded (no sandbox returned a malicious verdict), but the process data itself (bcdedit testsigning) is the malicious artefact — sandbox analysis captured the behaviour even if no formal 'malicious' label was assigned.
- No external YARA rules or CIRCL corroboration. Could indicate the sample is too new or too rare for community researchers to have published rules. Absence of external intel is weak evidence of safety, not strong evidence of malice, but paired with major consensus it does not override the verdict.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No malicious network contact recorded in sandbox (no a control server beacons, no exfiltration domains)
- No files it created or persistence mechanisms detected
- PE structure is clean (no packer, normal entropy, no high-entropy code sections)
- Major antivirus engine consensus: Microsoft Defender + Symantec both flag as malicious
- Named malware family: Wacatac infostealer (credential theft, information exfiltration)
- Anti-analysis behaviour: bcdedit testsigning bypass
- Unsigned executable with no signer history
- Rare, sample (0 days old, 1 submitter) — limited detection history
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 2sandbox rule tags
- 5spawned processes
- 0network contacts
- 1filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
High concern: Deleted backups or recovery data on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How password stealers work
A password stealer runs quietly in the background and copies your private data, such as saved passwords, browser cookies, autofill details and crypto wallets, then sends it to criminals. You usually won't notice anything.
Bottom line:Stolen logins are used to break into your accounts or sold in bulk, so change passwords from another device.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 4: FileSeen in the test run
JOAT(DEMOBUILD).exe
1eea7acbe25fa162f1dd4a1fef0575d53b1d273226280a54b917db4ceace75af
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 4: ProcessSeen in the test run
cmd.exe
C:\Windows\system32\cmd.exe /c bcdedit /set testsigning on
Test run - Evidence 3 of 4: ProcessSeen in the test run
bcdedit
bcdedit /set testsigning on
Test run - +1 more recorded observation
- 1
Files
Created or changed
- Evidence 4 of 4: Written fileSeen in the test run
Connect
\Device\ConDrv\\Connect
Test run
4 facts from the test run. See the full activity list.
Includes 2 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
2 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
- Microsoft (major engine)Trojan:Win32/Wacatac.B!ml
- Symantec (major engine)ML.Attribute.HighConfidence
File fingerprint
- Last analyzed
- Jun 9, 2026, 8:13 PM UTC
- SHA-256
1eea7acbe25fa162f1dd4a1fef0575d53b1d273226280a54b917db4ceace75af- SHA-1
ad0cad4e7a9b352b3931395d2562227f419ef1f6- MD5
14fbd49d28d6a639bc2141eb7a9f2d17
About this file
JOAT(DEMOBUILD).exe is a Win32 EXE file of 3.0 MB.
- Type and size
- Win32 EXE · 3.0 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 9, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 4.95 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is JOAT(DEMOBUILD).exe a virus?
What is JOAT(DEMOBUILD).exe?
How many antivirus engines detected JOAT(DEMOBUILD).exe?
What should I do if I already ran JOAT(DEMOBUILD).exe?
How do I remove JOAT(DEMOBUILD).exe?
What kind of malware is JOAT(DEMOBUILD).exe?
What is the SHA-256 hash of JOAT(DEMOBUILD).exe?
How up to date is this analysis of JOAT(DEMOBUILD).exe?
Community
Member reviews and reports for this exact file hash.