Threat LensFile scan report

Is vrchat_avatar_scaler.zip safe?

Item: vrchat_avatar_scaler.zip
Rating: 2.5
Author: MalwareTips File Scanner

62/100

Safety rating

Elevated risk

Verdict

Suspicious

Only DrWeb flagged this script archive, but silent BAT/VBS execution and T1562.001 warrant caution despite broad engine silence and no corroborated family.

DrWeb alone flagged the archive among 75 engines, using the generic label SCRIPT.Virus; no engine-family consensus or external intelligence corroborates it. However, sandbox execution involved silent BAT/VBS launchers and T1562.001, while all four extracted children remain unclassified, so the archive should not be trusted without further verification.

Do not open or extract it until verified

Quarantine the archive pending source verification and deeper review of its BAT, VBS, and Python contents. Keep endpoint protection enabled and test only in an isolated environment.

Read the full analysis

Saved file evidenceAntivirus consensus

1of 75 flagged

Flagged 1No detection 74

Digital specimenvrchat_avatar_scaler.zip27158e67e579f28dc9…97ee1eca92fece

Size32.3 KB

Code signingNot applicable

SandboxRuntime complete

First seen3mo ago

Evidence2 priority signals

1 of 75 antivirus engines flagged the file, including DrWeb.

Before opening or extracting

Do not open or extract it until the source can be verified independently.

If you already opened or extracted it

Stop using it, scan the device, and watch for unexpected behavior or security alerts. Get a fresh copy from the original trusted source and verify its exact hash when possible.

Chapter 02

Intelligence

The saved assessment, checked against the scan evidence and recorded coverage.

Analyst conclusion

Where this verdict could be wrong3 caveats

DrWeb, a tier-1 engine, labeled the archive SCRIPT.Virus, so the detection cannot be dismissed as low-trust noise.
The completed sandbox observed T1562.001 and silent BAT/VBS execution, which can indicate defense-evasion behavior despite the absence of a malicious sandbox verdict.
All four extracted children have unknown verdicts, and contactedHosts=null leaves host-reputation coverage unavailable.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Recommended action

Quarantine the archive pending source verification and deeper review of its BAT, VBS, and Python contents. Keep endpoint protection enabled and test only in an isolated environment.

Scan transparency

Coverage & freshness

4 of 5 complete

Complete means the check returned a usable result. It does not mean the file is safe.

Antivirus
Complete
1 of 75 engines flagged the file.
Updated Aug 6, 2026, 4:34 AM UTC
Sandbox
Complete
1 isolated runtime environment contributed observations.
Updated Sep 19, 2026, 9:56 PM UTC
Network
Not run
No contacted-host reputation check is recorded.
No timestamp recorded
YARA
Complete
Rule evaluation completed with no recorded matches.
Updated Sep 19, 2026, 9:56 PM UTC
External intel
Complete
3 of 3 independent reference sources completed.
Updated Sep 19, 2026, 9:56 PM UTC

Chapter 03

Behavior

Plain-English impact first, then the observed runtime evidence.

Runtime flight recorder

Capture complete

1isolated sandbox run
10MITRE ATT&CK techniques
8spawned processes
0network contacts
7filesystem & mutex artifacts

What this file does

Observed actions and their security significance

High concern: Attempted to impair or bypass security controls.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Note: Reads your Windows user-account details.
Note: Collects details about your system.

These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.

Recorded behavior

Attack story

Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.

ObservedDerived

Input file

The submitted object

FileObserved
vrchat_avatar_scaler.zip
27158e67e579f28dc98b8628b988700c97cfad478b5c9e938297ee1eca92fece
01Uploaded file

Processes

Runtime execution

ProcessObserved
Observed process
"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\Install.bat^"
02Isolated runtime analysis
ProcessObserved
Observed process
C:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\Install.bat
03Isolated runtime analysis
+1 more recorded observation in Analyst mode

Files

Created or changed

Written fileObserved
httjkxlb.4lx
C:\Users\user\AppData\Local\Temp\httjkxlb.4lx
04Isolated runtime analysis
Written fileObserved
Install.bat
C:\Users\user\AppData\Local\Temp\httjkxlb.4lx\Install.bat
05Isolated runtime analysis
+1 more recorded observation in Analyst mode

5 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK

Adversary techniques mapped to the MITRE ATT&CK framework.

T1033· Reads user infoT1059· Runs commandsT1064T1071· Application protocolT1082· System reconT1202T1497· Sandbox evasionT1562.001· Disables securityT1564· Hides artifactsT1564.003· Hides artifacts

Spawned processes

$(unnamed)

"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\Install.bat^"

$(unnamed)

C:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\Install.bat

$(unnamed)

"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && C:\Windows\system32\wscript.exe ^"C:\Users\<USER>\AppData\Local\Temp\Launch Scaler (Silent).vbs^"

$(unnamed)

C:\Windows\system32\wscript.exe "C:\Users\<USER>\AppData\Local\Temp\Launch Scaler (Silent).vbs

$(unnamed)

C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\vrchat_avatar_scaler.zip"

$(unnamed)

C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\httjkxlb.4lx" "C:\Users\user\Desktop\vrchat_avatar_scaler.zip"

$(unnamed)

C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

$(unnamed)

C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\httjkxlb.4lx\Install.bat"

Filesystem & mutexes

Files written7

C:\Users\user\AppData\Local\Temp\httjkxlb.4lx
C:\Users\user\AppData\Local\Temp\httjkxlb.4lx\Install.bat
C:\Users\user\AppData\Local\Temp\httjkxlb.4lx\Launch Scaler (Silent).vbs
C:\Users\user\AppData\Local\Temp\httjkxlb.4lx\vrchat_avatar_scaler.pyw
C:\Users\user\AppData\Local\Temp\unarchiver.log

+2 more

Dropped payload

Files this sample writes at runtime

This file drops 4 children at runtime. None are currently flagged malicious in our cache.

4 unseen

62fa0b99c0154813e8fa…7f7327Never scanned
never seen before
6ec2ac54741d7f25e3c5…dc2be6Never scanned
never seen before
34ff653ab63649b5b6fa…f06b07Never scanned
never seen before
b3c3c07454269fbb3cc6…51eea9Never scanned
never seen before

Chapter 04

Detection & Forensics

Consensus, attribution, signatures, code structure, prevalence, and identity.

RecordedObserved or authoritative facts

DerivedEvidence-backed analyst inferences

0rule hits recorded
1 / 75engines flagged
1sources in submission history

Evidence provenance

Why these facts are shown

Each statement identifies whether it was directly recorded or derived from saved scan facts.

01
1 of 75 antivirus engines flagged the file, including DrWeb.
Verdict inputView chapter
ProvenanceObserved
SourceAntivirus analysis
Observed atAug 6, 2026, 4:34 AM UTC
02
The hash has been submitted 1 time from 1 source.
View chapter
ProvenanceDerived
SourceSaved report facts
Observed atSep 19, 2026, 9:56 PM UTC
03
Scanned file: vrchat_avatar_scaler.zip — 27158e67e579f28dc98b8628b988700c97cfad478b5c9e938297ee1eca92fece
View chapter
ProvenanceObserved
SourceUploaded file
Observed atSep 19, 2026, 9:56 PM UTC
04
Observed process — "C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\Install.bat^"
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atSep 19, 2026, 9:56 PM UTC
05
Observed process — C:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\Install.bat
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atSep 19, 2026, 9:56 PM UTC
06
File written: httjkxlb.4lx — C:\Users\user\AppData\Local\Temp\httjkxlb.4lx
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atSep 19, 2026, 9:56 PM UTC
07
File written: Install.bat — C:\Users\user\AppData\Local\Temp\httjkxlb.4lx\Install.bat
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atSep 19, 2026, 9:56 PM UTC

Evidence map

Detection sources at a glance

4 completed · 0 unavailable

Antivirus

Threat match

1/75 flagged

Malware samples

No match

no match

Researcher rules

No match

no match

Reference software

No match

no match

Threat attribution

No specific family attributed

The available sources did not agree on a named threat category.

External intelligence

No researcher-database hits

MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.

YARA rules

No matches

The rule pass completed without a saved public match.

Antivirus consensus

1 of 75 engines flagged this file

1 malicious0 suspicious74 not flagged

Tier-117 engines

1flagged

Tier-241 engines

0flagged

Low-trust17 engines

0flagged

DrWebmalicious

SCRIPT.Virus

View all 75 engine results

DrWebDET

AcronisOK

AhnLab-V3OK

AlibabaOK

alibabacloudOK

ALYacOK

Antiy-AVLOK

APEXtyp

ArcabitOK

AvastOK

Avast-MobileOK

AVGOK

AviraOK

BitDefenderOK

BitDefenderFalxtyp

BkavOK

CAT-QuickHealOK

ClamAVOK

CMCOK

CrowdStrikeOK

CTXOK

Cylancetyp

CynetOK

DeepInstincttyp

Elastictyp

EmsisoftOK

ESET-NOD32OK

F-SecureOK

FortinetOK

GDataOK

GoogleOK

GridinsoftOK

huorongOK

Ikarusfai

JiangminOK

K7AntiVirusOK

K7GWOK

KasperskyOK

KingsoftOK

LionicOK

MalwarebytesOK

MaxSecureOK

McAfeeDOK

MicrosoftOK

MicroWorld-eScanOK

NANO-AntivirusOK

Paloaltotyp

PandaOK

RisingOK

Sangfortim

SentinelOneOK

Skyhightim

SophosOK

SUPERAntiSpywareOK

SymantecOK

SymantecMobileInsighttyp

TACHYONOK

tehtristyp

TencentOK

Trapminetyp

TrellixENSOK

TrendMicroOK

TrendMicro-HouseCallOK

TrustlookOK

VaristOK

VBA32OK

VIPREOK

VirITOK

ViRobotOK

WebrootOK

XcitiumOK

YandexOK

ZillyaOK

ZoneAlarmOK

ZonerOK

PE structure

Not applicable

PE structure analysis applies to Windows executable formats, not this file type.

Prevalence

How widely this file has been seen

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium

Unique uploaders

Very few people have ever uploaded this — rare.

Total submissions

Includes repeat uploads by the same source.

First seen

3mo ago

Jun 23, 2026

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

File identity

Fingerprint and provenance

File name: vrchat_avatar_scaler.zip
Format: ZIP
Code signing: Not applicable to this file type
Size: 32.3 KB
Last analyzed: Sep 19, 2026, 9:56 PM UTC

SHA-256

27158e67e579f28dc98b8628b988700c97cfad478b5c9e938297ee1eca92fece

Chapter 05

Safety & FAQ

Complete recovery guidance and answers for the next decision.

What to do now

We couldn't fully clear this file. Treat it with caution.

Recovery step 01
Don't open or extract it unless you're certain it came from a source you trust.
Recovery step 02
Check where you got it — an unexpected attachment or a random download link is a red flag.
Recovery step 03
If its origin cannot be confirmed, delete this archive and use a fresh copy from a trusted source. Get a fresh copy from the original trusted source and verify its exact hash when possible.
Recovery step 04
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.

Safety FAQ

Direct answers grounded in the saved verdict and evidence in this report.

7 evidence-based answers

Is vrchat_avatar_scaler.zip safe, or is it malware?

Evidence-based answer

vrchat_avatar_scaler.zip is suspicious — treat it as unsafe until you're sure. 1 of 75 antivirus engines flag it; that detection signal contributes to the cautious verdict. Don't open or extract it unless you fully trust where it came from. Get a fresh copy from the original trusted source and verify its exact hash when possible.

What is vrchat_avatar_scaler.zip?

Evidence-based answer

vrchat_avatar_scaler.zip is a compressed archive, about 32 KB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.

How many antivirus engines detected vrchat_avatar_scaler.zip?

Evidence-based answer

1 of 75 antivirus engines flagged vrchat_avatar_scaler.zip, 1 of them as outright malicious. The raw count alone does not establish safety or danger; we also weigh which engines flagged it and corroborating behavior, identity, reputation, and rule evidence.

I already downloaded and opened or extracted vrchat_avatar_scaler.zip — what should I do?

Evidence-based answer

Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.

How do I remove vrchat_avatar_scaler.zip?

Evidence-based answer

To remove vrchat_avatar_scaler.zip: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete this archive from the device, then empty the Recycle Bin or Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.

What is the SHA-256 hash of vrchat_avatar_scaler.zip?

Evidence-based answer

The SHA-256 hash of vrchat_avatar_scaler.zip is 27158e67e579f28dc98b8628b988700c97cfad478b5c9e938297ee1eca92fece, and its MD5 is 01a7cba2428505509be0bed3e91f51c7. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

How up to date is this analysis of vrchat_avatar_scaler.zip?

Evidence-based answer

This report reflects the scan run on September 19, 2026. Because a file's hash never changes, the identity of vrchat_avatar_scaler.zip is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is vrchat_avatar_scaler.zip safe?

Only DrWeb flagged this script archive, but silent BAT/VBS execution and T1562.001 warrant caution despite broad engine silence and no corroborated family.

Recommended next actions

Before opening or extracting

If you already opened or extracted it

What We Detected

Threat Behavior

What To Do Now

Coverage & freshness

Antivirus

Sandbox

Network

YARA

External intel

Runtime flight recorder

What this file does

Attack story

vrchat_avatar_scaler.zip

Observed process

Observed process

httjkxlb.4lx

Install.bat

Why these facts are shown

Detection sources at a glance

YARA rules

PE structure

Fingerprint and provenance

What to do now