File scan report
Verdict Safe
Is Art
None of the 60 antivirus engines that checked it flagged the archive, and one completed sandbox run exposed no offensive behavior, though the new file has limited history.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 60 flagged
- Flagged 0
- No detection 60
- No result 15
- Code signing Not applicable
- Test run Completed
- First seen 14d ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 60 antivirus engines that checked it detected a threat, including the reporting major antivirus engines. One completed sandbox run produced no malicious verdict or high-risk behavior; however, this archive is and its ten extracted children do not yet have saved individual verdicts.
The strongest evidence is the absence of detections across 75 engines, including 15 major antivirus engines that reported no detection. A completed sandbox run produced no malicious verdict, no high-risk MITRE technique, and no sample-attributable network contact. The observed domain and IP were explicitly identified as analysis-environment background traffic. No malware-specific YARA rule, MalwareBazaar match, malicious child verdict, or brand conflict corroborates a threat. Confidence is moderated because the archive was first seen on Oct 12, 2026 and all ten extracted children lack saved individual verdicts.
What We Detected
None of the 60 antivirus engines that checked it flagged the ZIP archive.
Threat Behavior
One completed sandbox run returned no malicious verdict and mapped no high-risk technique. The listed domain and IP were identified as background traffic from the analysis environment rather than activity caused by the archive. Extraction produced files consistent with an Electron-style application package, but all ten recorded files it created still lack saved individual verdicts.
What To Do Now
The evidence does not identify malware in this archive. Because it is and component-level coverage is incomplete, obtain it from the developer's official release channel, keep security software enabled, and rescan the extracted executable before running it.
Where this verdict could be wrong3 caveats
- The archive was first seen on Oct 12, 2026 and has been submitted by two sources, so reputation and prevalence are not yet established.
- Ten extracted files it created lack saved verdicts, leaving incomplete component-level coverage despite no identified malicious child.
- The archive carries anti-analysis-related tags, including detect-debug-environment and long-sleeps, although the observed run mapped no high-risk technique.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 60 antivirus engines that checked it flagged the archive.
- The completed sandbox run produced no malicious verdict or high-risk behavior.
- No malware-specific research rule or known malware-feed match was found.
- No extracted child was identified as malicious.
- The archive was first seen on Oct 12, 2026 and has been submitted by two sources, so it has little established reputation.
- Ten extracted files do not yet have saved individual assessments, leaving incomplete coverage of the archive's contents.
- Metadata includes debugger-detection and long-sleep tags, which can occur in legitimate applications but warrant caution in a package.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 3sandbox rule tags
- 2spawned processes
- 0network contacts
- 17filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
3MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
- T1082· System recon
- T1497· Sandbox evasion
Observed activity
Processes started
2Programs the file ran, with their command lines.
unarchiver.exe"C:\Windows\System32\unarchiver.exe" "C:\Users\user\Desktop\ArtCraft-v0.41.0.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\tdxa4cgl.0kd" "C:\Users\user\Desktop\ArtCraft-v0.41.0.zip"
Files
17Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\System.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\app-64.7z - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\nsis7z.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\7z-out\chrome_100_percent.pak - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\7z-out\chrome_200_percent.pak - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\7z-out\icudtl.dat
Show all 17 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\7z-out\LICENSE.electron.txt - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\7z-out\LICENSES.chromium.html - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\7z-out\locales\af.pak - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\7z-out\locales\am.pak - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\7z-out\locales\ar.pak - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\7z-out\locales\bg.pak - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\7z-out\locales\bn.pak - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\7z-out\locales\ca.pak - Written
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp\7z-out\locales\cs.pak - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsi9982.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsx9992.tmp
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
atm.teams.mira.tm.svc.cloud.microsoft - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- f47d9bf81d7446110421…de5f96Not checkedno saved verdict
- 3eb38ae99653a7dbc724…f2eacaNot checkedno saved verdict
- b7ea8a50bf0e7667da36…4a7fdcNot checkedno saved verdict
- b393f05e8ff919ef0711…adf592Not checkedno saved verdict
- b7805392bfce11118165…aa45fbNot checkedno saved verdict
- fac820a98b746a04ce14…862e32Not checkedno saved verdict
- f5170aa2b388d23bebf9…68defbNot checkedno saved verdict
- 5154e165bd6c2cc0cfbc…80087dNot checkedno saved verdict
- 000ae5775ffa701d57af…aab38dNot checkedno saved verdict
- 57670eae6d1871e648ad…70774aNot checkedno saved verdict
Chapter 04
Technical details
None of the 60 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 15, 2026, 9:23 AM UTC
- SHA-256
23b5b473268b80c52fb912259f7e93f76bc9af04730ea8831e2637a840df2593- SHA-1
91a59aaa24dba057af4410107a4a62ade700ebdd- MD5
0276a98be85daed1244fbfea8c7dcd3b
About this file
ArtCraft-v0.41.0.zip is a ZIP file of 72.6 MB.
- Type and size
- ZIP · 72.6 MB
- Signer
- Not applicable
- First seen
- Oct 12, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 60 engines flagged this file
15 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-116 engines0flagged
- Tier-232 engines0flagged
- Low-trust12 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingNo result
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroNo result
- TrendMicro-HouseCallNo result
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexNo result
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ArtCraft-v0.41.0.zip safe?
What is ArtCraft-v0.41.0.zip?
How many antivirus engines detected ArtCraft-v0.41.0.zip?
What is the SHA-256 hash of ArtCraft-v0.41.0.zip?
Is it safe to open or extract ArtCraft-v0.41.0.zip?
How up to date is this analysis of ArtCraft-v0.41.0.zip?
Community
Member reviews and reports for this exact file hash.
