File scan report
Verdict Suspicious
Is Guitar
This unsigned, VMProtect-protected program is flagged by 30 of the 70 antivirus engines that checked it, including several major vendors, though only with generic or packer…
Read the whole reasonShow less
Why Suspicious? 30 antivirus engines flag it and one of our detection rules matched it.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
Avoid running this file unless it came from the official publisher; replace unofficial copies with the vendor's own installer and keep your antivirus enabled.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
30 of 70 flagged
- Flagged 30
- No detection 40
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 6mo ago
Chapter 02
Why we think so
4 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
30 of the 70 antivirus engines that checked it flag this unsigned executable, including Microsoft, ESET, Avira and Sophos, but their labels describe packing or generic threats rather than a named malware family. The file is heavily protected with VMProtect, which hides its code. Our sandbox runs saw no network contacts or injection. That pattern is common in cracked software, which is a real infection risk.
Nine major antivirus engines detections rule out treating this file as clean, even after vendors that share one scan engine are collapsed. None of the labels names a real malware family; most refer to VMProtect packing or generic machine-learning buckets. The file is unsigned and almost entirely made of one encrypted section, so its actual behaviour is hidden from static inspection. Our sandbox runs observed only obfuscation and no network traffic, injection or persistence. It has been submitted by 711 sources since Apr 2, 2026, which fits a widely shared protected or cracked program, but that does not make it trustworthy.
What We Detected
30 of the 70 antivirus engines that checked it flagged this file, including Microsoft (Malgent), ESET-NOD32 (Packed.VMProtect), Avira (Agent), Sophos (Mal/Generic-S) and Symantec (a machine-learning detection). None of the labels names a specific malware family. The file is unsigned and protected with VMProtect, with a single 32 MB high-entropy section that holds nearly all of its code.
Threat Behavior
Our sandbox runs recorded only code obfuscation. There were no network contacts, no injection into other processes, no dropped files and no persistence. A heavily protected program can delay or hide its payload, so this absence is not a clean result. No complete host-reputation result is available.
What To Do Now
Do not run this file unless it came directly from the official publisher. If you obtained it from an unofficial download or crack site, delete it and get the software from the vendor. Keep your antivirus enabled.
Where this verdict could be wrong2 caveats
- Many detections key on VMProtect packing itself, and the file has 711 submitters with no malware-specific rule or public-database listing, so it may be a protected or cracked copy of a legitimate program rather than malware.
- Third-party sandbox notes found no remote control traffic or confirmed payload.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No named malware family in any engine label
- Sandbox runs showed no network contacts, injection or persistence
- No public malware-database listing or malware-specific rule matches
- Flagged by 30 of the 70 antivirus engines that checked it, including Microsoft, ESET, Avira and Sophos
- Unsigned executable with no publisher identity
- Heavily protected with VMProtect, which hides its real code
- Profile matches redistributed or cracked software from unofficial sources
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 2sandbox rule tags
- 1spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 2: FileSeen in the test run
GuitarPro.exe
2ffc402cf9a81c6dfb422ebac3702987b2cbc39055afd38f92122882766f1d7e
Uploaded file
- 1
Processes
What ran
- Evidence 2 of 2: ProcessSeen in the test run
GuitarPro.exe
"C:\Users\user\Desktop\GuitarPro.exe"
Test run
2 facts from the test run. See the full activity list.
Includes 2 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
30 of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 30
- Avast (major engine)Win64:MalwareX-gen [Misc]
- AVG (major engine)Win64:MalwareX-gen [Misc]
- Avira (major engine)TR/W64.Agent
- ESET-NOD32 (major engine)Win32/Packed.VMProtect.ACT trojan
- F-Secure (major engine)Trojan.TR/W64.Agent
- Fortinet (major engine)W32/PossibleThreat
- GData (major engine)Win64.Trojan.Agent.IO670B
- Ikarus (major engine)Trojan.Win32.VMProtect
File fingerprint
- Last analyzed
- Oct 23, 2026, 11:37 AM UTC
- SHA-256
2ffc402cf9a81c6dfb422ebac3702987b2cbc39055afd38f92122882766f1d7e- SHA-1
f4216999546f43483f6a0b3119033bc176780b60- MD5
7c407eb82fd65ac7e7846a4afd571e9b
About this file
GuitarPro.exe says it is Guitar Pro 8 (Arobas Music® Guitar Pro® 8), 33.9 MB.
- Claims to be
- Guitar Pro 8 (Arobas Music® Guitar Pro® 8)From the file's own version information, written by whoever built it.
- Original name
- GuitarPro.exeMatches the shared file name.
- Type and size
- Win32 EXE · 33.9 MB
- Signer
- UnsignedNo code signature.
- First seen
- Apr 2, 2026On VirusTotal.
- Submitted by
- 711 distinct sources
- Packer
- VMProtect new 32 jmp 8 (DetectItEasy protector)Packing hides code; legitimate installers use it too.
- Entropy
- 7.78 of 8A code section is highly compressed or encrypted.
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is GuitarPro.exe safe, or is it malware?
What is GuitarPro.exe?
How many antivirus engines detected GuitarPro.exe?
I already downloaded and ran GuitarPro.exe — what should I do?
What is the SHA-256 hash of GuitarPro.exe?
How up to date is this analysis of GuitarPro.exe?
Community
Member reviews and reports for this exact file hash.