File scan report
Verdict Low Risk
Is Microsoft.
This PowerShell profile script drew no detections from 75 engines, but it is rarely submitted and was never run or inspected, so its behaviour cannot be confirmed.
Read the whole reasonShow less
Why not Safe? It has no verified publisher signature, only one source had seen it when we scanned it and no sandbox test run results are available.
Limited evidence · Nothing points to a problem, but little confirms who made it.
Review the script's contents in a text editor before letting PowerShell load it, and remove it if it appeared without your knowledge or contains commands you do not recognise.
Good practice2 tips
Low Risk: no threat found, but we could not fully confirm this file.
Get it from the publisher's own website or app store, not from a re-upload or a link someone sent you.
Keep your security software on, and stop if the file does anything you didn't expect.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 62 flagged
- Flagged 0
- No detection 62
- No result 13
- Code signing Unsigned
- Test run Not run
- First seen 10d ago
Chapter 02
Why we think so
3 points against it and 2 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 62 antivirus engines that checked it flagged this PowerShell profile script. It was first seen on Oct 15, 2026 from a single source, is unsigned, and has no sandbox run or static inspection on record. Fresh scripts are often undetected, so the clean scan alone cannot confirm it is harmless.
None of the 62 antivirus engines that checked it flagged the script, including all 18 major antivirus engines that analysed it. The file is a PowerShell profile, a script that runs automatically every time PowerShell starts, so its contents matter. No sandbox execution or static inspection of its code is available. It has been submitted by only one source since Oct 15, 2026, and it carries no signature or other benign anchor. Without visibility into what the script does, the evidence is too thin to call it either harmless or hostile.
What We Detected
None of the 62 antivirus engines that checked it flagged this PowerShell profile script, and all 18 major antivirus engines that analysed it returned a clean result. No behaviour rules, reputation databases or community reports point to a threat.
Threat Behavior
No observation from the test run is available, and our static analysis was not run on these bytes. A PowerShell profile executes automatically whenever PowerShell starts, which makes it a common place for both personal customisations and persistence tricks. The file is rarely submitted (first seen on Oct 15, 2026) and unsigned, so there is no history to lean on.
What To Do Now
If you wrote this profile yourself or copied it from a source you trust, review its contents before use. If it appeared on your system unexpectedly, open it in a text editor and look for downloads, encoded commands or hidden windows. Upload it for a deeper scan if anything looks unfamiliar.
Where this verdict could be wrong1 caveat
- None of the 62 antivirus engines that checked it flagged the script, and a PowerShell profile is often a user's own customisation file, which would be benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 62 antivirus engines that checked it flagged the file
- All 18 major antivirus engines that analysed it returned a clean result
- A PowerShell profile runs automatically whenever PowerShell starts
- Rarely submitted, seen from a single source
- No sandbox run or static inspection of the script's contents is available
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
None of the 62 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 15, 2026, 4:06 PM UTC
- SHA-256
2d146627f90d7dddd0031e4b4700dffac70319571d0bbae34c136d874e252403- SHA-1
66fcafcb99e69896854c671ae2dc09378f08afd5- MD5
2e76b6662f055b1a70aa54921cb31fa6
About this file
Microsoft.PowerShell_profile.ps1 is a Powershell file of 9.8 kB.
- Type and size
- Powershell · 9.8 kB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 15, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned Updated
Verdict history
- Suspicious
- Low Riskafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 04
Questions & answers
Short answers to the 5 questions people ask most about this file.
Is Microsoft.PowerShell_profile.ps1 safe?
What is Microsoft.PowerShell_profile.ps1?
How many antivirus engines detected Microsoft.PowerShell_profile.ps1?
What is the SHA-256 hash of Microsoft.PowerShell_profile.ps1?
How up to date is this analysis of Microsoft.PowerShell_profile.ps1?
Community
Member reviews and reports for this exact file hash.