File scan report
Verdict Safe
Is Equilotl.
Only 1 of the 62 antivirus engines that checked it flagged this unsigned executable, using a generic less reliable label, while stronger scanners and corroborating intelligence…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Keep security protection enabled and prefer a copy obtained directly from the project's official release channel. If the current file came from an unknown source, verify its SHA-256 before running it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 62 flagged
- Flagged 1
- No detection 61
- No result 12
- Code signing Unsigned
- Test run Completed
- First seen 4mo ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Trapmine alone flagged the file with a generic machine-learning label; none of the major antivirus engines reported malware. A sandbox mapped possible process injection, but recorded no target process, malicious verdict, persistence, hostile child, or known-bad contacted host, making a false positive substantially more likely.
The detection pattern is weak: only 1 of the 62 antivirus engines that checked it flagged the sample, and that detector is less reliable with a generic machine-learning label. None of the major antivirus engines reported malware, and there is no family consensus. Evidence from the test run mapped T1055, but no injected process, precise technique, persistence mechanism, or malicious sandbox verdict was recorded. The complete reputation check for the three contacted domains and one contacted IP found no known-malicious or suspicious hosts. The file is unsigned, which reduces provenance assurance, but unpacked code, moderate prevalence, and the lack of malware-specific external corroboration favor a false-positive explanation.
What We Detected
Only 1 of the 62 antivirus engines that checked it flagged the executable. The sole detection came from Trapmine and used the generic label “malicious.moderate.ml.score”; no major antivirus engines identified malware and no named family consensus exists.
Threat Behavior
One completed sandbox run mapped activity to MITRE T1055, which can indicate process injection. However, it recorded no injected target process, no exact injection method, no persistence indicators, no malicious sandbox verdict, and no malicious file it created. The host-reputation check covered all three contacted domains and the one contacted IP and found none known to be malicious or suspicious; one additional domain was identified as sandbox background traffic rather than sample activity.
Additional Context
The executable is unsigned, so its publisher cannot be authenticated. The antivirus analysis found no packer, no high-entropy code, and no likely packing, while MalwareBazaar and YARAify supplied no malware-specific match. Conflicting community annotations are insufficient to outweigh the stronger structured evidence.
What To Do Now
Keep security software enabled and obtain the executable from the project's official release channel where possible. If its origin is uncertain, verify its SHA-256 with the publisher or test it in an isolated environment before routine use.
Where this verdict could be wrong3 caveats
- Runtime mapping includes T1055 Process Injection, although no target process or exact injection method was recorded.
- The executable is unsigned, so its publisher and provenance cannot be verified.
- One community annotation reports a malicious sandbox result, but another calls the same hash clean; neither is corroborated by the saved sandbox verdict or trusted engine detections.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the major antivirus engines reported malware.
- The sole detection was a generic label from a less reliable engine.
- The completed host-reputation check covered every observed sample contact and found no known-malicious or suspicious host.
- No malicious sandbox verdict, persistence indicator, or malicious file it created was recorded.
- The antivirus analysis found no packer, likely packing, or high-entropy code, and researcher intelligence produced no malware-specific match.
- The Windows executable is unsigned, so its publisher cannot be authenticated.
- The sandbox mapped possible process injection, although it did not identify a target process or exact method.
- Trapmine produced one generic machine-learning detection.
- Third-party researcher annotations conflict, with one reporting a malicious sandbox assessment.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 2spawned processes
- 3network contacts
- 6filesystem & mutex artifacts
Includes 9 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
1 of the 62 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- Trapminemalicious.moderate.ml.score
File fingerprint
- Last analyzed
- Oct 17, 2026, 7:57 AM UTC
- SHA-256
2fcb9ff0e8bf201a5304f02b3810a10a3229fe392c8972d47e95741c13f4dc5f- SHA-1
e9b7a18f034b2de57e2fb01ab548080b6994539e- MD5
e901278d6ab0972bf5db1224f30691bf
About this file
Equilotl.exe is a Win32 EXE file of 15.2 MB.
- Type and size
- Win32 EXE · 15.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 3, 2026On VirusTotal.
- Submitted by
- 131 distinct sources
- Packer
- None detected
- Entropy
- 6.15 of 8
First scanned
Includes every engine result (74), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Equilotl.exe safe?
What is Equilotl.exe?
How many antivirus engines detected Equilotl.exe?
What is the SHA-256 hash of Equilotl.exe?
Is it safe to run Equilotl.exe?
How up to date is this analysis of Equilotl.exe?
Community
Member reviews and reports for this exact file hash.