File scan report
Verdict Safe
Is Amazing
Only VBA32 flagged the executable, while major antivirus engines and one completed sandbox run supplied no corroborating malware evidence.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 67 flagged
- Flagged 1
- No detection 66
- No result 8
- Code signing Unsigned
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
One of the 67 antivirus engines that checked it flagged the file, and that detection came from the less reliable VBA32 engine with a generic Wacatac label. Major antivirus engines were silent, and one sandbox run observed no offensive behavior, persistence, dropped files, injection, or network activity attributable to the sample.
The detection pattern strongly resembles an isolated false positive: VBA32 alone flagged the sample, while no major antivirus engines did. One completed sandbox run returned a clean result and mapped no offensive techniques. It also observed no process injection, persistence, dropped files, or sample-attributed network contacts. MalwareBazaar and YARAify supplied no corroborating family evidence, and the antivirus analysis found no packing indicators. Confidence is moderated because the executable is unsigned, uncommon, and lacks publisher history; additionally, no complete contacted-host reputation result is available.
What We Detected
Only 1 of the 67 antivirus engines that checked it flagged the executable. The sole alert came from VBA32 and used the generic label “Trojan.Wacatac”; no major antivirus engines reported a detection and no family consensus formed.
Threat Behavior
One completed sandbox run returned a clean result. It observed no offensive techniques, process injection, persistence changes, dropped files, or network contacts attributable to the sample. The antivirus analysis also found no packer or high-entropy code indicator. A complete contacted-host reputation check was not available, although the run recorded no sample-attributed contacts to inspect.
What To Do Now
The evidence supports treating the isolated alert as a likely false positive. Because the executable is unsigned and has limited prevalence, obtain it only from its expected source, keep security software enabled, and verify the SHA-256 before running it.
Where this verdict could be wrong3 caveats
- The executable is unsigned, so no publisher identity or certificate history supports it.
- Only three submitters have supplied this file, limiting reputation evidence.
- VBA32 labeled it “Trojan.Wacatac,” although no other engine corroborated that generic detection.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 67 antivirus engines that checked it flagged the file, and the alert came from a less reliable engine.
- No major antivirus engines reported a detection.
- One completed sandbox run found no offensive behavior, injection, persistence, dropped files, or sample-attributed network activity.
- MalwareBazaar and YARAify supplied no corroborating malware intelligence.
- The antivirus analysis found no packing or high-entropy code indicators.
- The Windows executable is unsigned and has no established publisher history.
- The file has been submitted by only three sources, so its broader reputation is limited.
- VBA32 reported a generic Wacatac trojan detection.
- No complete contacted-host reputation cross-check is available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 3sandbox rule tags
- 1spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
3MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
- T1083· Scans your files
- T1129· Loads modules
Observed activity
Processes started
1Programs the file ran, with their command lines.
AmazingFrog.exe"C:\Users\user\Desktop\AmazingFrog.exe"
Chapter 04
Technical details
1 of the 67 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- VBA32Trojan.Wacatac
File fingerprint
- Last analyzed
- Oct 17, 2026, 7:20 AM UTC
- SHA-256
21bc3dc126aeea14c75c23dead3fbd442f614ff2eadd497bae26314d0b5f02e1- SHA-1
bff7d508d02c56e0ad49dfa276ac0caa93090632- MD5
995de658f1f029a6e306676b50f954cc
About this file
AmazingFrog.exe is a Win32 EXE file of 646.7 kB.
- Type and size
- Win32 EXE · 646.7 kB
- Signer
- UnsignedNo code signature.
- First seen
- Sep 9, 2026On VirusTotal.
- Submitted by
- 3 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 6.31 of 8
First scanned
Antivirus consensus
1 of 67 engines flagged this file
8 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-116 engines0flagged
- Tier-234 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- VBA32Malicious: Trojan.Wacatac
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroNo result
- TrendMicro-HouseCallNo result
- TrustlookNo result
- VaristClean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is AmazingFrog.exe safe?
What is AmazingFrog.exe?
How many antivirus engines detected AmazingFrog.exe?
What is the SHA-256 hash of AmazingFrog.exe?
Is it safe to run AmazingFrog.exe?
How up to date is this analysis of AmazingFrog.exe?
Community
Member reviews and reports for this exact file hash.