File scan report
Verdict Safe
Is Fish
Three of the 71 antivirus engines that checked it produced generic detections, but broad long-term prevalence, major silence, and completed observations from the test run…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
3 of 71 flagged
- Flagged 3
- No detection 68
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 4y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 3 of the 71 antivirus engines that checked it flagged the executable, and none of the 18 major antivirus engines did so; the labels are generic rather than family-specific. Its 609-source history, combined clean sandbox verdict, fully checked contacts, and lack of corroborating intelligence make false positives the most likely explanation.
The executable drew three generic detections from 75 engines, including one higher-quality secondary engine, but no major antivirus engines identified a threat. It has been submitted by 609 distinct sources and was first seen on Feb 3, 2022, providing a substantial distribution history. The combined sandbox verdict was clean, with no named injection target or other high-risk technique supported by a concrete artefact. Every listed network contact was covered by the reputation check, and none matched a hostile or questionable host. No malware-specific community rule, public sample-database entry, malicious child, packing indicator, or named family corroborates the three detections. The unsigned status and unavailable static examination warrant ordinary caution, but the overall evidence favors generic scanner false positives.
What We Detected
Three of the 71 antivirus engines that checked it flagged the executable. CrowdStrike assigned a generic confidence-based label, while Paloalto and Trapmine returned generic machine-learning labels; none identified a specific malware family, and none of the 18 major antivirus engines flagged it.
Threat Behavior
The combined sandbox verdict was clean. Although a T1055 technique mapping appeared, no target process was recorded, so it does not establish process injection. No high-risk sandbox technique had a supporting artefact, and every listed network contact was checked without a hostile or questionable reputation match.
Supporting Context
The file was first seen on Feb 3, 2022 and has submissions from 609 distinct sources. No malware-specific community rules, public sample-database listing, malicious dropped file, brand conflict, or packing indicator supported the generic engine alerts.
What To Do Now
Keep security software enabled and obtain the executable from its expected source. If its origin or purpose is uncertain, verify its hash with the distributor or run it only in a controlled environment.
Where this verdict could be wrong3 caveats
- Three independent engines flagged the executable, including CrowdStrike, so the detections are not exclusively from less reliable scanners.
- The executable is unsigned, leaving no verified publisher identity to support its provenance.
- Our static analysis was not available, so the file's code and capabilities were not independently examined.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 18 major antivirus engines flagged the file.
- The file has submissions from 609 distinct sources and was first seen on Feb 3, 2022.
- The combined sandbox verdict was clean, with no supported high-risk technique or named injection target.
- All listed network contacts were reputation-checked without a hostile or questionable match.
- No malware-specific rule, public sample-database listing, malicious child, or packing indicator was found.
- Three independent antivirus engines produced generic malicious assessments.
- The executable has no verified publisher signature.
- Our independent static examination of the file bytes was not available.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 7 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 7isolated sandbox runs
- 10sandbox rule tags
- 5spawned processes
- 7network contacts
- 19filesystem & mutex artifacts
What this file did when executed
This file was detonated in 7 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1027.005· Obfuscated code
- T1055· Process injection
- T1056.001· Keylogging
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1129· Loads modules
- T1202
- T1497· Sandbox evasion
Observed activity
Processes started
5Programs the file ran, with their command lines.
file.exe"C:\Users\<USER>\Desktop\file.exe"cmd.exeC:\Windows\system32\cmd.exe /c CLSFishHAXZ v4.2.exe%SAMPLEPATH%\FishHAXZ v4.2.execmd.exeC:\Windows\System32\cmd.exe20ea5b5b8b84af788bf9d306b804128fcd8fa11fd99043c3115619fe0c89c167.exe%SAMPLEPATH%\20ea5b5b8b84af788bf9d306b804128fcd8fa11fd99043c3115619fe0c89c167.exe
Network contacts
77 hosts, listed as 2 domains, 5 addresses. Links show the host and path only.
- Domain
img-prod-cms-rt-microsoft-com.akamaized.net - Domain
arc.msn.com - IP address
23.209.116.9 - IP address
23.40.197.137 - IP address
23.209.116.25 - IP address
104.86.182.40
Show all 7 entries for network contacts
- IP address
23.219.78.196
Files
19Files the file created, changed or deleted.
- Written
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll - Written
C:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - Written
\Device\ConDrv - Written
\Device\ConDrv\\Connect - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER243C.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2517.tmp.csv
Show all 19 entries for files
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2537.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER366D.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER367E.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER368F.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF482.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF493.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF494.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF28D.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF358.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF398.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBF5.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC05.tmp.csv
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Set
HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\A70D59A1-8EAD-4F40-AAAB-FBFC460800A4\FriendlyName
Sandbox background — not the file
22The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google2496_2116318298\bin\updater.exe - VM process
updater.exeC:\Program Files\Google2248_1764010751\bin\updater.exe - VM injection target
C:\Program Files\Google2496_2116318298\bin\updater.exe - VM injection target
C:\Program Files\Google2248_1764010751\bin\updater.exe
Show all 22 entries for sandbox background — not the file
- VM host
www.microsoft.com - VM host
192.168.0.43 - VM host
a83f:8110:0:0:ffff:ffff:ffff:ffff - VM host
13.107.4.50 - VM host
23.216.147.62 - VM host
a83f:8110:0:0:100:0:1800:0 - VM host
20.99.132.105 - VM host
a83f:8110:6219:d901:71a4:4e8e:6219:d901 - VM host
20.99.133.109 - VM host
a83f:8110:ed9:ffff:3053:698e:ed9:ffff - VM host
192.229.211.108 - VM host
20.99.184.37 - VM host
20.99.186.246 - VM host
a83f:8110:0:0:700:700:2800:4000 - VM host
20.99.185.48 - VM host
a83f:8110:61be:81d8:14c4:3415:eee5:572b
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 92f8f9ad13c4a71c260d…b0738eNot checkedno saved verdict
Chapter 04
Technical details
3 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 3
The Safe verdict weighed these detections and treats them as non-decisive.
- CrowdStrikewin/malicious_confidence_60% (W)
- Paloaltogeneric.ml
- Trapminemalicious.moderate.ml.score
File fingerprint
- Last analyzed
- Oct 23, 2026, 4:24 PM UTC
- SHA-256
20ea5b5b8b84af788bf9d306b804128fcd8fa11fd99043c3115619fe0c89c167- SHA-1
c7a8628c712297f2e1cceedd70df31fc9acbbf6e- MD5
c1ce9ad6278ef7dcd7f30608c6729440
About this file
FishHAXZ v4.2.exe is a Win32 EXE file of 203.8 kB.
- Type and size
- Win32 EXE · 203.8 kB
- Signer
- UnsignedNo code signature.
- First seen
- Feb 3, 2022On VirusTotal.
- Submitted by
- 609 distinct sources
- Packer
- None detected
- Entropy
- 5.68 of 8
First scanned
Antivirus consensus
3 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines1flagged
- Low-trust17 engines2flagged
View all 75 engine results
- CrowdStrikeMalicious: win/malicious_confidence_60% (W)
- PaloaltoMalicious: generic.ml
- TrapmineMalicious: malicious.moderate.ml.score
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is FishHAXZ v4.2.exe safe?
What is FishHAXZ v4.2.exe?
How many antivirus engines detected FishHAXZ v4.2.exe?
What is the SHA-256 hash of FishHAXZ v4.2.exe?
Is it safe to run FishHAXZ v4.2.exe?
How up to date is this analysis of FishHAXZ v4.2.exe?
Community
Member reviews and reports for this exact file hash.