File scan report
Verdict Safe
Is Lavander 1.
This ZIP archive, first seen on Apr 27, 2026, was flagged by none of the 65 antivirus engines that checked it and showed no hostile indicators.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
The archive can be used, but download it from the creator's official source and scan any executable or Java file inside before running it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 6mo ago
Chapter 02
Why we think so
0 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Public malware databases and community rule sets had no matches, and the sandbox run only opened and listed the archive with a clean verdict. Around 97 separate sources have submitted it.
None of the 65 antivirus engines that checked it flagged the archive, and every major antivirus engine that returned a result reported it clean. No public malware database or malware-specific rule set lists it. No complete contacted-host reputation result was available. The file has been submitted by about 97 different sources since its first sighting, consistent with a shared game pack rather than a targeted lure. The main limitation is that files inside the archive were not executed, so their behaviour in the test run was not observed.
What We Detected
This ZIP archive, first seen on Apr 27, 2026, was flagged by none of the 65 antivirus engines that checked it, including major antivirus engines such as Kaspersky, ESET, BitDefender and Microsoft. No public malware database or malware-specific rule set lists it.
Threat Behavior
The sandbox run opened the archive in a Linux environment using standard archive tools and returned a clean verdict. No network contacts, process injection or high-risk techniques were recorded. Files inside the archive were listed but not executed, so their own behaviour was not observed.
What To Do Now
The archive appears clean based on the available evidence. Obtain it from the original creator's official page, and scan any executable or Java file inside before running it.
Where this verdict could be wrong2 caveats
- The sandbox only opened and listed the archive, so any program inside was not executed and its behaviour in the test run was not observed.
- Archive contents were not individually examined by our static analysis, so a file inside could carry risk that scanning the archive as a whole did not reveal.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 65 antivirus engines that checked it flagged the file, and all major antivirus engines that analysed it reported it clean
- No listing in public malware databases or malware-specific rule sets
- The sandbox run returned a clean verdict with no network activity or high-risk techniques
- Submitted by about 97 different sources since Apr 27, 2026
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 1 isolated test; no test environment rated what it did as risky.
Test run summary
Capture complete- 1isolated sandbox run
- 4sandbox rule tags
- 4spawned processes
- 0network contacts
- 1filesystem & mutex artifacts
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
4MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1064
- T1518.001· Checks your AV
- T1543.002· Service install
- T1564.001· Hides artifacts
Observed activity
Processes started
4Programs the file ran, with their command lines.
exo-open/usr/bin/exo-open exo-open "/tmp/Lavander 1.21.11.zip"exo-open/usr/bin/exo-open -engrampa/usr/bin/engrampa engrampa "/tmp/Lavander 1.21.11.zip"7z/usr/lib/p7zip/7z l -slt -bd -y -- "/tmp/Lavander 1.21.11.zip"
Files
1Files the file created, changed or deleted.
- Written
/root/.cache/dconf/user
Sandbox background — not the file
6The analysis machine's own processes and connections, recorded in every run.
- VM process
dbus-launch/usr/bin/dbus-launch dbus-launch --autolaunch=a39eb3ed78b7401fb6809ed0c562a5b1 --binary-syntax --close-stderr - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog - VM process
rsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate - VM process
systemctl/usr/bin/systemctl systemctl kill -s HUP rsyslog.service - VM process
gzip/bin/gzip - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/mail.info/var/log/mail.warn/var/log/mail.err/var/log/mail.log/var/log/daemon.log/var/log/kern.log/var/log/auth.log/var/log/user.log/var/log/lpr.log/var/log/cron.log/var/log/debug/var/log/messages
Chapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 24, 2026, 10:03 PM UTC
- SHA-256
273735ee0e96f7712e11413c0e24d2a96de893d229790224dbd3af18829bf3ab- SHA-1
1639e089388e35b3e548856dd4e7b63f95b75cc7- MD5
d5e13aff95692d389266192e25cab210
About this file
Lavander 1.21.11.zip is a ZIP file of 3.5 MB.
- Type and size
- ZIP · 3.5 MB
- Signer
- Not applicable
- First seen
- Apr 27, 2026On VirusTotal.
- Submitted by
- 97 distinct sources
First scanned
Antivirus consensus
0 of 65 engines flagged this file
10 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Lavander 1.21.11.zip safe?
What is Lavander 1.21.11.zip?
How many antivirus engines detected Lavander 1.21.11.zip?
What is the SHA-256 hash of Lavander 1.21.11.zip?
Is it safe to open or extract Lavander 1.21.11.zip?
How up to date is this analysis of Lavander 1.21.11.zip?
Community
Member reviews and reports for this exact file hash.