File scan report

Verdict Malicious

Analyzed Oct 22, 20264 days ago

Is Yz7k7ivGt.exe safe? No, we rate this exact file malicious.

This installer matches the OfferCore bundling downloader.

Strong evidence · Two or more major antivirus engines agree.

Don't run it: it is unwanted software

Delete this installer and get the software you wanted from its official publisher. If it was run, remove any unexpected programs or extensions and run a full scan.

What to do now4 steps

This is unwanted software (adware or a bundled program), not an infection. Remove it and undo any changes it made.

If you haven't installed it

Don't run this file. Delete it, then empty the Recycle Bin.

If you already ran it

Uninstall it and any program you don't recognise that arrived at the same time (Settings > Apps on Windows).
Remove browser extensions you didn't add, and reset your browser's home page, new-tab page and search engine if they changed.
Run a scan with your antivirus to catch anything bundled with it.

If you opened or installed it

Unwanted software is not a full infection, but it should go. These free MalwareTips guides show how to remove it.

Paste this report's link in your topic so helpers can see what was found.

Why we think so

Antivirus results

26 of 71 flagged

Flagged 26
No detection 45
No result 4

FileYz7k7ivGt.exe16.2 MBSHA-256 2c94af235ae6…f9a582

Code signing Infivora
Test run Completed
First seen 4d ago

1 strong detection rule matched this file.

Chapter 02

Why we think so

6 points against it and 2 in its favour, checked against the scan evidence.

Analyst conclusion

Twenty-six of the 71 antivirus engines that checked it flag this file. Five major antivirus engines, including BitDefender, ESET, Microsoft and Symantec, name the OfferCore bundler family. It carries a valid signature from Infivora, but all 11 earlier files from that publisher were flagged. In testing it fetched remote content from a cloud host, which fits an installer that downloads third-party offers.

Where this verdict could be wrong1 caveat

Several major engines (ESET, Microsoft, Kaspersky, Malwarebytes) label it as a potentially unwanted bundler rather than a trojan, and the sandbox runs recorded no malicious verdict, injection or persistence.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 2 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete

2isolated sandbox runs
12sandbox rule tags
4spawned processes
2network contacts
5filesystem & mutex artifacts

What the test run showed

What the file did on a test computer

Confirmed in the test run

Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Note: Read the user name of the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Note: Loaded extra code modules while running.

Sandbox labels we could not confirm (common in safe files too)

Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.

This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.

Threat context

How bundlers and adware work

This is a bundler: a real-looking installer that hides extra software inside. When you run it, it installs things you never asked for, such as ad injectors, browser toolbars or fake 'PC cleaner' apps. The people behind it get paid for every app it installs.

Bottom line:It is not usually built to destroy files, but it slows the PC, floods it with ads and can be hard to remove completely.

Recorded behavior

What happened in the test

Grouped by step. The order is not a timeline.

Seen in the test runWorked out from other results

Input file
The submitted object
1
1. Evidence 1 of 7: FileSeen in the test run
  Yz7k7ivGt.exe
  2c94af235ae600916d8aef1affe66d4d9098e8315f5aad5ea3f3283e67f9a582
  Uploaded file
Processes
What ran
2
1. Evidence 2 of 7: ProcessSeen in the test run
  TrustedInstaller.exe
  C:\Windows\servicing\TrustedInstaller.exe
  Test run
2. Evidence 3 of 7: ProcessSeen in the test run
  file.exe
  "C:\Users\<USER>\Desktop\file.exe"
  Test run
3. +1 more recorded observation
Files
Created or changed
2
1. Evidence 4 of 7: Written fileSeen in the test run
  CBS.log
  C:\Windows\Logs\CBS\CBS.log
  Test run
2. Evidence 5 of 7: Written fileSeen in the test run
  file.tmp
  C:\Users\<USER>\AppData\Local\Temp\is-0P9RC4BNCF.tmp\file.tmp
  Test run
3. +1 more recorded observation
Network
Hosts contacted
2
1. Evidence 6 of 7: Contacted hostSeen in the test run
  d2cxzkcwhivupa.cloudfront.net
  Contacted during the test run.
  Test run
2. Evidence 7 of 7: Contacted hostSeen in the test run
  18.172.167.162
  Contacted during the test run.
  Test run
3. +1 more recorded observation

7 facts from the test run. See the full activity list.

Runtime behaviour

What this file did when executed

This file was detonated in 2 sandboxes and its runtime behaviour was observed.

Techniques observed in the sandbox

12

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1027· Obfuscated code
T1027.002· Obfuscated code
T1033· Reads user info
T1036
T1055· Process injection
T1070· Covers its tracks
T1071· Application protocol
T1082· System recon
T1129· Loads modules
T1553
T1553.002
T1574· Execution hijack

Observed activity

Processes started

4

Programs the file ran, with their command lines.

TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe
file.exe"C:\Users\<USER>\Desktop\file.exe"
file.tmp"C:\Users\<USER>\AppData\Local\Temp\is-0P9RC4BNCF.tmp\file.tmp" /SL5="$5002E,14880881,843264,C:\Users\<USER>\Desktop\file.exe"
2c94af235ae600916d8aef1affe66d4d9098e8315f5aad5ea3f3283e67f9a582.exeC:\Users\<USER>\AppData\Local\Temp\is-QHT3W8GMK0.tmp\2c94af235ae600916d8aef1affe66d4d9098e8315f5aad5ea3f3283e67f9a582.tmp /SL5=$10015A,14880881,843264,C:\Users\<USER>\Downloads\2c94af235ae600916d8aef1affe66d4d9098e8315f5aad5ea3f3283e67f9a582.exe

Network contacts

2

2 hosts, listed as 1 domain, 1 address, 2 links. Links show the host and path only.

Domaind2cxzkcwhivupa.cloudfront.net
IP address18.172.167.162
URLhttps://d2cxzkcwhivupa.cloudfront.net/o
URLhttps://d2cxzkcwhivupa.cloudfront.net/zbd

Files

3

Files the file created, changed or deleted.

WrittenC:\Windows\Logs\CBS\CBS.log
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0P9RC4BNCF.tmp\file.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-QHT3W8GMK0.tmp\2c94af235ae600916d8aef1affe66d4d9098e8315f5aad5ea3f3283e67f9a582.tmp

Mutexes

2

Named locks a program uses so only one copy runs; malware families often reuse them.

Global\WdsSetupLogInit
Global\SetupLog

Sandbox background — not the file

5

The analysis machine's own processes and connections, recorded in every run.

VM processservices.exeC:\Windows\system32\services.exe
VM processsvchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p
VM processsvchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
VM processlsass.exeC:\Windows\system32\lsass.exe

Dropped payload

Files this sample writes at runtime

This file drops 2 children at runtime. None are currently flagged malicious in our cache. 2 have no saved verdict and were not checked; that is missing coverage, not a finding.

2 not checked

2983ccfb9266c95627bf…87e52cNot checked
no saved verdict
dc8c86bf2ce73f88cf48…ecf0f3Not checked
no saved verdict

Chapter 04

Technical details

26 of the 71 antivirus engines that checked it flag it; signed by Infivora.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete26 of 71 engines flagged it · 4 gave no result DetailsOct 22, 2026

Sandbox runVirusTotal sandboxes · CAPE Sandbox, VirusTotal JujuboxComplete2 runs, no sandbox verdict recorded DetailsOct 22, 2026

Contacted hostsMalwareTips URL scannerComplete2 contacted hosts checked DetailsOct 22, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete2 MalwareTips behaviour rules DetailsOct 22, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedOct 22, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchOct 22, 2026

Engines that flagged it 26

BitDefender (major engine)Gen:Variant.Application.Bundler.OfferCore.Cerbu.1
DrWeb (major engine)Trojan.InstallCore.4143
Emsisoft (major engine)Gen:Variant.Application.Bundler.OfferCore.Cerbu.1 (B)
ESET-NOD32 (major engine)Win32/OfferCore.B potentially unwanted application
Fortinet (major engine)W32/Mecha.A!tr
GData (major engine)Gen:Variant.Application.Bundler.OfferCore.Cerbu.1
Ikarus (major engine)Trojan.Win32.OfferCore
Kaspersky (major engine)not-a-virus:HEUR:Downloader.NSIS.LoudOffer.gen

18 more in the full engine list

File fingerprint

Last analyzed: Oct 22, 2026, 10:35 AM UTC

SHA-256: 2c94af235ae600916d8aef1affe66d4d9098e8315f5aad5ea3f3283e67f9a582
SHA-1: 0c93717484151aaa2a80ab5ed3bf88fcf4337fa2
MD5: ae146f9406da1c387dc5f1f7be91605b

About this file

Yz7k7ivGt.exe says it is MECHA MANGA - FZCO, OOO Download Manager (MECHA MANGA - FZCO, OOO), 16.2 MB.

Claims to be: MECHA MANGA - FZCO, OOO Download Manager (MECHA MANGA - FZCO, OOO)From the file's own version information, written by whoever built it.
Type and size: Win32 EXE · 16.2 MB
Signer: InfivoraValid code signature.
First seen: Oct 22, 2026On VirusTotal.
Submitted by: 2 distinct sourcesRarely seen: few people have submitted this exact file.
Packer: .NET Reactor 2.X-3.X (DetectItEasy protector)Packing hides code; legitimate installers use it too.
Entropy: 6.32 of 8

First scanned Oct 22, 2026

Antivirus consensus

26 of 71 engines flagged this file

26 malicious0 suspicious45 not flagged4 no result

4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

The 26 detections come from 19 independent scan engines: several vendors license the same engine, so their results are one vote.

Tier-118 engines
10flagged
12 vendors sharing 10 engines
Tier-236 engines
7flagged
11 vendors sharing 7 engines
Low-trust17 engines
3flagged

View all 75 engine results

AhnLab-V3Malicious: PUP/Win.OfferCore.R783989
ALYacMalicious: Gen:Variant.Application.Bundler.OfferCore.Cerbu.1
ArcabitMalicious: Trojan.Application.Bundler.OfferCore.Cerbu.1
BitDefenderMalicious: Gen:Variant.Application.Bundler.OfferCore.Cerbu.1
CTXMalicious: exe.unknown.bundler
DrWebMalicious: Trojan.InstallCore.4143
ElasticMalicious: malicious (high confidence)
EmsisoftMalicious: Gen:Variant.Application.Bundler.OfferCore.Cerbu.1 (B)
ESET-NOD32Malicious: Win32/OfferCore.B potentially unwanted application
FortinetMalicious: W32/Mecha.A!tr
GDataMalicious: Gen:Variant.Application.Bundler.OfferCore.Cerbu.1
GoogleMalicious: Detected
GridinsoftMalicious: PUP.Win32.OfferCore.dd!c
IkarusMalicious: Trojan.Win32.OfferCore
K7AntiVirusMalicious: Unwanted-Program ( 005ce5691 )
K7GWMalicious: Unwanted-Program ( 005ce5691 )
KasperskyMalicious: not-a-virus:HEUR:Downloader.NSIS.LoudOffer.gen
MalwarebytesMalicious: PUP.Optional.BundleInstaller
MicrosoftMalicious: PUADlManager:Win32/OfferCore
MicroWorld-eScanMalicious: Gen:Variant.Application.Bundler.OfferCore.Cerbu.1
RisingMalicious: Adware.OfferCore/IFPS!1.FD26 (CLASSIC)
SophosMalicious: Mal/Generic-S
SymantecMalicious: Trojan.Offercore!ATN
TrellixENSMalicious: Artemis!AE146F9406DA
VIPREMalicious: Gen:Variant.Application.Bundler.OfferCore.Cerbu.1
WebrootMalicious: W32.Adware.Gen
AcronisClean
AlibabaClean
alibabacloudClean
Antiy-AVLClean
APEXClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CylanceClean
CynetClean
DeepInstinctClean
F-SecureClean
huorongClean
JiangminClean
KingsoftClean
LionicClean
MaxSecureClean
McAfeeDClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
SangforClean
SentinelOneClean
SkyhighClean
SUPERAntiSpywareClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VirITClean
ViRobotClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.

2 heuristics

MITRE ATT&CK profile

Execution× 1Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)
DropperNetworkProfile
T1105 T1027
high
Packed PE with sandbox-observed network activity AND engine flags. Signed packed software exists legitimately, but a signed + packed + flagged binary is a signed dropper pattern.
Evidence
d2cxzkcwhivupa.cloudfront.net

PE forensics

Section entropy & packers

A known packer signature (UPX / Themida / VMProtect / etc.) matched this file. Packers aren't malicious on their own, but most malware uses them.

ent 6.32Likely packed

Section entropy11 sections

.text

6.38

.itext

6.04

.data

5.18

.bss

0.00

.idata

4.82

.didata

2.76

.edata

1.34

.tls

0.00

.rdata

1.38

.reloc

6.70

.rsrc

4.56

0.0Packed threshold 7.28.0

Detected packers

.NET Reactor 2.X-3.X (DetectItEasy protector)

Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.

Prevalence

How widely this file has been seen

Barely seen in the wild and first surfaced recently. 26 antivirus detections make that low prevalence materially relevant, but rarity alone is not proof of malware.

Rare & new

Unique uploaders

2

Very few people have ever uploaded this — rare.

Total submissions

2

Includes repeat uploads by the same source.

First seen

4d ago

Oct 22, 2026

Prevalence quadrant

here

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 9 questions people ask most about this file.

Is Yz7k7ivGt.exe a virus?

Yz7k7ivGt.exe is not a virus, but it is unwanted software (adware or a bundled program). Don't run it. Delete it, then empty the Recycle Bin. 26 of the 71 antivirus engines that checked it flag it, most as OfferCore. If you've already run it, see the removal steps below.

What is Yz7k7ivGt.exe?

Yz7k7ivGt.exe is a Windows program, about 16.2 MB. Its version information says it is “MECHA MANGA - FZCO, OOO Download Manager” (MECHA MANGA - FZCO, OOO). The digital signature from Infivora checks out. VirusTotal first saw it on Oct 22, 2026.

How many antivirus engines detected Yz7k7ivGt.exe?

26 of the 71 antivirus engines that checked it flag Yz7k7ivGt.exe, including Microsoft and Kaspersky. We weigh which engines flagged it and what else the scan found, not just the count. The rating comes from all the evidence together, not from this count alone.

What should I do if I already ran Yz7k7ivGt.exe?

1) Uninstall it, and any program you don't recognise that arrived at the same time, from Settings > Apps (or Control Panel > Programs). 2) Remove browser extensions you didn't add and reset your browser's home page, new-tab page and search engine if they changed. 3) Run a scan with your antivirus to catch anything bundled with it. It is unwanted software rather than an infection, so you don't need to disconnect the device, change passwords or reinstall anything unless the scan finds real malware.

How do I remove Yz7k7ivGt.exe?

To remove Yz7k7ivGt.exe: 1) uninstall it from Settings > Apps (or Control Panel > Programs), together with anything installed alongside it. 2) Remove unfamiliar browser extensions and reset browser settings it changed. 3) Delete it, then empty the Recycle Bin. 4) Run a scan with your antivirus and remove what it finds.

What kind of program is Yz7k7ivGt.exe?

Antivirus engines classify Yz7k7ivGt.exe as unwanted software: adware or a bundled program that installs things you didn't ask for. Engines attribute it to the OfferCore family.

Is Yz7k7ivGt.exe digitally signed?

Yes. Yz7k7ivGt.exe has a valid digital signature from Infivora, which shows the file hasn't been changed since that publisher signed it. Malware is sometimes signed with stolen certificates, so a signature alone isn't proof of safety.

What is the SHA-256 hash of Yz7k7ivGt.exe?

The SHA-256 fingerprint of Yz7k7ivGt.exe is 2c94af235ae600916d8aef1affe66d4d9098e8315f5aad5ea3f3283e67f9a582, and its MD5 is ae146f9406da1c387dc5f1f7be91605b. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

How up to date is this analysis of Yz7k7ivGt.exe?

This report reflects the scan on Oct 22, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Is Yz7k7ivGt.exe safe? No, we rate this exact file malicious.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What the test run showed

Confirmed in the test run

Sandbox labels we could not confirm (common in safe files too)

Threat context

What happened in the test

Input file

Processes

Files

Network

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

Engines that flagged it 26

File fingerprint

About this file

26 of 71 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is Yz7k7ivGt.exe safe? No, we rate this exact file malicious.

What We Detected

Threat Behavior

What To Do Now

Test run summary

What the test run showed

Confirmed in the test run

Sandbox labels we could not confirm (common in safe files too)

Threat context

What happened in the test

Input file

Processes

Files

Network

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Mutexes

Sandbox background — not the file

Engines that flagged it 26

File fingerprint

About this file

Related file reports