File scan report
Verdict Safe
Is Blue
No antivirus engine detected the signed Now.gg installer, while broad prevalence and two signer-matched prior samples outweigh unconfirmed sandbox heuristics.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 4
- Code signing Now.gg, INC
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
5 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 70 antivirus engines that checked it were non-detecting, including 17 major antivirus engines, and the installer carries a verified Now.gg signature.
The sample received no malicious or suspicious detections from 74 antivirus engines, with all 17 major participants reporting no detection. Its verified Now.gg signature, 3,199 submissions from 2,560 sources, and two signer-matched prior installer samples support a legitimate commercial distribution pattern. One completed sandbox run produced no malicious verdict, and none of the ten inspected files it created was identified as malicious. Host-reputation coverage was incomplete because only one host was inspected despite several observed IP and URL contacts. On balance, the independent reputation, prevalence, signing, and similarity evidence substantially outweighs the unconfirmed behavioral heuristics.
What We Detected
No malicious or suspicious result was reported by any of the 74 antivirus engines. It is also broadly distributed, with 3,199 submissions from 2,560 sources, while two prior BlueStacksInstaller.exe samples sharing both the import-table fingerprint and signer received favorable assessments.
Threat Behavior
These are notable indicators, but the sandbox did not issue a malicious verdict and the saved evidence does not establish an injection method, credential theft, or destructive action. Ten files it created were inspected without a malicious child finding, although their individual verdicts remain unknown. Several IP contacts and one URL were observed, but only one host received a saved reputation check, so a complete network-reputation result is unavailable.
What To Do Now
Use the installer only if it came directly from the official BlueStacks or Now.gg release channel, and verify that Windows still reports the Now.gg signature as valid. Keep security software enabled and avoid running copies obtained through advertisements, mirrors, or unsolicited links.
Where this verdict could be wrong4 caveats
- One of our behaviour rules fired on T1055, and one of our behaviour rules associated activity with the Windows password store; these runtime indicators warrant caution despite the absence of a malicious sandbox verdict.
- One of our behaviour rules reported direct connections to multiple IP addresses, while the cross-check of 1 host provides incomplete reputation coverage for the observed contacts.
- 2 earlier files from this signer were seen and this signer is not auto-trusted from its history, so the verified Now.gg signature has only a short local history.
- The 10 files it created have unknown individual verdicts even though no dropped file is known to be malicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/70 engines reported a malicious or suspicious detection.
- The code signature for Now.gg is verified.
- The file has 3,199 submissions from 2,560 sources.
- Two signer-matched import-table fingerprint samples previously received safe verdicts.
- Sandbox evidence mapped activity to process injection.
- Direct-IP network traffic was observed.
- Host-reputation coverage was incomplete for the observed contacts.
- The local Now.gg signer history contains only two prior samples.
- Ten files it created lack individual verdicts.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 25sandbox rule tags
- 7spawned processes
- 8network contacts
- 33filesystem & mutex artifacts
Includes 25 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by Now.gg, INC.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 17, 2026, 1:35 PM UTC
- SHA-256
267737b6425f3a473e11b6051f2a95ddab5f8f6d2e6aebd2ff9033fd31d5c145- SHA-1
eee25a5f0545fbb708ccbca093ee00e408523660- MD5
d0df19ad5d5cc93d5397f13dea2ea5fc
About this file
BlueStacksInstaller.exe is a Win32 EXE file of 953.8 kB.
- Type and size
- Win32 EXE · 953.8 kB
- Signer
- Now.gg, INCValid code signature.
- First seen
- Sep 10, 2026On VirusTotal.
- Submitted by
- 2,560 distinct sources
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned Updated
Includes every engine result (74), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is BlueStacksInstaller.exe safe?
What is BlueStacksInstaller.exe?
How many antivirus engines detected BlueStacksInstaller.exe?
Is BlueStacksInstaller.exe digitally signed?
What is the SHA-256 hash of BlueStacksInstaller.exe?
Is it safe to run BlueStacksInstaller.exe?
How up to date is this analysis of BlueStacksInstaller.exe?
Community
Member reviews and reports for this exact file hash.