MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Safe

Legitimate signed CurseForge installer from Overwolf Ltd with one low-trust AV flag and no supporting tier-1 detections or malicious behavior.

Verified · Overwolf Ltd
Trust score88High trust
MT AI confidence · 82%
CurseForge Windows - Installer.exe
2.7 MB
2322168b25cad7c8cd…9acf590040
Antivirus engines
1 of 75 flagged
Code signing
Signed by Overwolf Ltd
Age
First seen 23 days ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

82%Confidence
High
Reasoning

With zero tier-1 malicious detections and onlyLowTrustFlagging=true from DeepInstinct, this matches a common false positive pattern. The verified Overwolf Ltd signature aligns perfectly with the CurseForge installer filename, despite a low-severity heuristic noting the generic CN. Behavior shows typical installer techniques (T1134 among ambient ones) but nothing malicious in sandboxes or contacts. No external intel, RAG, or drops reinforce safety for this rare_new file.

Key signals · 4

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. DeepInstinct (low_trust) single malicious detection; 17/17 tier1ReportedClean

  2. signing.signer='Overwolf Ltd'; verified=true; filenameAnalysis.hasInstallerHint=true

  3. behaviour.mitreTechniques includes T1134 (offensive) but no malicious sandboxVerdicts or contactedHosts.maliciousHosts

  4. triggeredHeuristics[0].rule='MalwareTips.Synth.SuspiciousSignerCN'; fired=true; severity='low'

Points in its favour
  • Verified Authenticode signature
  • 17/17 tier-1 engines clean; no family consensus
  • Installer-appropriate filename and MITRE profile
  • No malicious behavior, contacts, or drops
  • No external intel or YARAify hits
Points against
  • Single low-trust malicious detection (DeepInstinct)
  • New file (ageDays=0, rare_new prevalence)
  • Signer 'Overwolf Ltd' has no historical stats; generic CN heuristic
  • High overall entropy (7.99) but no packing
What to do

This is a safe, legitimate CurseForge installer. Proceed with installation if downloaded from official Overwolf/CurseForge channels; monitor for unexpected behavior.

Sources disagree

1 contradiction resolved by the scoring engine

Only low-trust / heuristic engines flagged this file
1 engine from the heuristic / generic-AI set flagged it. No tier-1 engine agreed.
Verdict treated these as likely false positives.
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 synthesis
MITRE ATT&CK profile
Defense evasion× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • SuspiciousSignerCN
    T1553.002
    low

    Signed by "Overwolf Ltd" — short generic company CN. Paired with 1 engine hit(s); possible stolen, fraudulent, or reseller-purchased code-signing certificate.

    Evidence
    Overwolf Ltd
Antivirus engine breakdown

1 detection across 75 engines

1 malicious0 suspicious74 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-238 engines
0flag
Mainstream engines with mixed FP rates
Low-trust20 engines
1flag
Heuristic / generic-AI engines (high FP rate)
DeepInstinct
malicious
MALICIOUS
Hash 2322168b25ca… cross-referenced against 75 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked
Section entropy5 sections
.text
6.46
.rdata
5.02
.data
4.15
.ndata
0.00
.rsrc
2.10
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.

Rare & new
Unique uploaders
2
Very few people have ever uploaded this — rare.
Total submissions
2
Includes repeat uploads by the same source.
First seen by VT
23d ago
May 11, 2026
Prevalence quadrant
here
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
5/11/2026, 9:47:03 AM
First seen (MalwareBazaar)
—
Last analysis (VT)
5/11/2026, 9:48:16 AM
Scanned here
5/11/2026, 9:50:20 AM
File name
CurseForge Windows - Installer.exe
Size
2.66 MB
MIME type
application/x-msdownload
Detected type
Win32 EXE
SHA-256
2322168b25cad7c8cd1d5e2c396da72da4cf2d3e3b72423e5bfc799acf590040
MD5
fb6a288aac2548d2c608a3c588d04de8
SHA-1
c02bcd9586251f37f91aa378cc9d359d3b9c69ff
PE imphash
56a78d55f3f7af51443e58e0ce2fb5f6
First seen (VT)
5/11/2026, 9:47:03 AM
Last analysis (VT)
5/11/2026, 9:48:16 AM
First scan (MalwareTips)
5/11/2026, 9:47:59 AM
Last scan (MalwareTips)
5/11/2026, 9:50:20 AM
Code signer
Overwolf Ltdverified
Behavior tags
overlaypeexesigned
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scanned by
JackStaff
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.