File scan report
Verdict Suspicious
Is hw2_
Fourteen of the 67 antivirus engines that checked it flagged this unsigned loader, including Microsoft and Symantec, while runtime mappings indicate several forms of possible…
Read the whole reasonShow less
Why Suspicious? 14 antivirus engines flag it and a test run recorded behaviour typical of malware.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
14 of 67 flagged
- Flagged 14
- No detection 53
- No result 8
- Code signing Unsigned
- Test run Completed
- First seen 13d ago
Chapter 02
Why we think so
4 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Microsoft and Symantec are among 14 of the 67 antivirus engines that checked it flagging this unsigned executable, and its sandbox data maps to four injection-related techniques. A clean sandbox verdict, fully checked contacts, and absent family consensus temper the finding, but execution should be avoided pending trusted provenance.
The detection ratio is substantial: 14 of the 67 antivirus engines that checked it flagged the executable, including two major antivirus engines and 14 independent engine votes. Microsoft identified Wacatac, while Symantec and several other products issued generic machine-learning or rule-based detections, so there is no reliable family consensus. Evidence from the test run maps activity to T1055.001, T1055.002, T1055.003, and T1620, which supports possible process injection, although no target process was recorded. The sample is unsigned, only three days old in the available records, and lacks an established publisher history. Counter-evidence includes a clean result from the sole sandbox run, no cached reputation issues among the two observed domains, and no corroborating malware-specific external-intelligence hit.
What We Detected
Fourteen of the 67 antivirus engines that checked it flagged the executable. These include Microsoft with Trojan:Win32/Wacatac.C!ml and Symantec with ML.Attribute.HighConfidence, plus detections from CrowdStrike, Elastic, Malwarebytes, Sangfor, SentinelOne, and others. The labels are mostly generic or machine-learning based and do not establish one specific malware family.
Threat Behavior
The completed observation from the test run mapped the sample to T1055.001, T1055.002, T1055.003, and T1620, all associated with loading code or possible process injection. No injected target process, persistence mechanism, malicious child, or cached malicious network destination was identified. The sole sandbox run returned clean, so the behavioral evidence is concerning but not conclusive.
What To Do Now
Do not run the file on a production or personal system unless its source and expected function can be independently verified. Keep security software enabled, let your antivirus remove the file, and obtain a fresh copy from the software publisher's official release channel if it was expected to be legitimate.
Where this verdict could be wrong4 caveats
- The only completed sandbox run returned a clean verdict and identified no injected target process.
- The host-reputation check covered both observed domains and found neither in the malicious or suspicious cache.
- No malware-specific YARAify rule, MalwareBazaar record, malicious file it created, packing indicator, or strong family consensus was found.
- Thirteen major antivirus engines did not flag the sample, while the two major detections used generic or machine-learning labels.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The only completed sandbox run returned a clean result.
- Both observed domains were covered by the host-reputation check, with no malicious or suspicious cache matches.
- No malicious file it created, persistence indicator, high-entropy code, or recognized packer was found.
- No malware-specific YARAify rule or MalwareBazaar record corroborated the detections.
- Fourteen of the 67 antivirus engines that checked it flagged the executable, including Microsoft and Symantec.
- Data from the test run mapped four injection-related techniques, including three process-injection variants.
- The executable is unsigned and has no established publisher history.
- The file was first observed on Oct 13, 2026, limiting reputation history.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 14sandbox rule tags
- 1spawned processes
- 0network contacts
- 2filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
High concern: Injected code into another program on the test computer.
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Note: Listed the programs running on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Note: Checked which security software was installed on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as loading code in memory; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 4: FileSeen in the test run
hw2_loader.exe
2dcefd1dc12595029352ded6e11ddbc22dfa378e0f5f96cf38b8365bf4239499
Uploaded file
- 1
Processes
What ran
- Evidence 2 of 4: ProcessSeen in the test run
hw2_loader.exe
"C:\Users\user\Desktop\hw2_loader.exe"
Test run
- 2
Files
Created or changed
- Evidence 3 of 4: Written fileSeen in the test run
ConDrv
\Device\ConDrv
Test run - Evidence 4 of 4: Written fileSeen in the test run
Connect
\Device\ConDrv\\Connect
Test run - +1 more recorded observation
4 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
14MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1055.001· Process injection
- T1055.002· Process injection
- T1055.003· Process injection
- T1057· Lists programs
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1518· Checks your AV
- T1553
- T1553.002
- T1620· In-memory loading
Observed activity
Processes started
1Programs the file ran, with their command lines.
hw2_loader.exe"C:\Users\user\Desktop\hw2_loader.exe"
Files
2Files the file created, changed or deleted.
- Written
\Device\ConDrv - Written
\Device\ConDrv\\Connect
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
a1672.dscr.akamai.net - VM host
eip-terr-na.cdp1.digicert.com.akahost.net
Chapter 04
Technical details
14 of the 67 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 14
- Microsoft (major engine)Trojan:Win32/Wacatac.C!ml
- Symantec (major engine)ML.Attribute.HighConfidence
- Antiy-AVLGrayWare/Win32.Wacapew
- APEXMalicious
- BkavW32.Malware.4979F5D3
- CrowdStrikewin/malicious_confidence_60% (W)
- DeepInstinctMALICIOUS
- Elasticmalicious (high confidence)
File fingerprint
- Last analyzed
- Oct 16, 2026, 5:51 AM UTC
- SHA-256
2dcefd1dc12595029352ded6e11ddbc22dfa378e0f5f96cf38b8365bf4239499- SHA-1
fd5f6a58d981574be7312be0d893f26dbfa1e680- MD5
fa6f3a12571a6d18dba4b17ebf5153ec
About this file
hw2_loader.exe is a Win32 EXE file of 169.0 kB.
- Type and size
- Win32 EXE · 169.0 kB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 13, 2026On VirusTotal.
- Submitted by
- 14 distinct sources
- Packer
- None detected
- Entropy
- 5.88 of 8
First scanned
Antivirus consensus
14 of 67 engines flagged this file
8 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-116 engines2flagged
- Tier-234 engines6flagged
- Low-trust17 engines6flagged
View all 75 engine results
- Antiy-AVLMalicious: GrayWare/Win32.Wacapew
- APEXMalicious: Malicious
- BkavMalicious: W32.Malware.4979F5D3
- CrowdStrikeMalicious: win/malicious_confidence_60% (W)
- DeepInstinctMalicious: MALICIOUS
- ElasticMalicious: malicious (high confidence)
- MalwarebytesMalicious: Malware.Heuristic.108256
- McAfeeDMalicious: ti!2DCEFD1DC125
- MicrosoftMalicious: Trojan:Win32/Wacatac.C!ml
- PaloaltoMalicious: generic.ml
- SangforMalicious: Trojan.Win32.Save.a
- SentinelOneMalicious: Static AI - Suspicious PE
- SymantecMalicious: ML.Attribute.HighConfidence
- TrapmineMalicious: malicious.high.ml.score
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CTXClean
- CylanceClean
- CynetClean
- DrWebClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MaxSecureClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PandaClean
- RisingClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.
The saved runtime evidence maps this activity to MITRE T1055.001 (a process-injection method VirusTotal does not map on clean files). It supports possible process injection, but no target process was recorded.
EvidenceT1055.001 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is hw2_loader.exe safe, or is it malware?
What is hw2_loader.exe?
How many antivirus engines detected hw2_loader.exe?
What should I do if I already ran hw2_loader.exe?
What is the SHA-256 hash of hw2_loader.exe?
How up to date is this analysis of hw2_loader.exe?
Community
Member reviews and reports for this exact file hash.