File scan report
Verdict Suspicious
Is Darth
Fortinet alone identified the archive as Riskware/Application, with no named-family consensus among 75 engines.
Read the whole reasonShow less
Why Suspicious? One antivirus engine (Fortinet) flags it and one of our detection rules matched it.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or extract it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already opened or extracted it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 65 flagged
- Flagged 1
- No detection 64
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 7mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 65 antivirus engines that checked it flagged the archive, and the sole label is the broad Fortinet Riskware/Application designation rather than a named malware family. That weak detection footprint is offset by evidence from the test run mapped to and T1562.001, plus a service-style persistence indicator. The sample also made direct connections to 13 IP addresses, but no complete host-reputation result is available because contactedHosts is null. The sandbox did not issue a malicious verdict, and no inspected child was identified as malicious, although all ten child verdicts remain unresolved. With no curated intelligence hit or family consensus, the evidence supports caution rather than a definitive malware attribution.
What We Detected
Fortinet was the only engine among 75 to flag the archive, using the broad label Riskware/Application. No major family consensus, confirmed hacking tool label, or researcher-curated intelligence match identifies a specific malware family.
Threat Behavior
One completed sandbox run recorded activity mapped to T1055 process injection and T1562.001 impairment of defenses, along with a service-style persistence indicator. The archive also contacted 13 IP addresses directly. Their reputation was not fully assessed because no contacted-host cross-check was saved. Ten files it created were inspected; none was identified as malicious, but every child remains without a resolved verdict.
What To Do Now
Do not run the archive on a production system. Verify its origin and expected purpose, keep security software enabled, and test it only in an isolated environment if business use requires further validation.
Where this verdict could be wrong4 caveats
- Only Fortinet flagged the file, and its Riskware/Application label denotes broad riskware or unwanted program behavior rather than a named malware family.
- No sandbox returned a malicious verdict, so the completed sandbox run did not independently issue a malicious determination.
- The absence of a MalwareBazaar listing, the absence of a known-software database match, and the absence of community YARA matches provide no curated corroboration, though absence may reflect coverage gaps.
- Fifteen major antivirus engines reported no detection, including Kaspersky, BitDefender, ESET-NOD32, Avast, and Microsoft-independent peers.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1/65 engines reported a detection.
- Major antivirus engines do not agree on one malware family and no named family was identified.
- No sandbox returned a malicious verdict.
- No dropped file is known to be malicious after 10 children were inspected.
- YARAify, CIRCL, and MalwareBazaar supplied no corroborating hit.
- A service-style persistence indicator, ServiceExample, was observed.
- The sample contacted 13 IP addresses without a completed reputation cross-check.
- The archive contains executable content and exhibits long-sleep and debug-environment-detection traits.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 14spawned processes
- 11network contacts
- 31filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Set itself to start automatically after a restart.
Moderate concern: Checked whether it was running on a test computer.
Note: Listed the programs running on the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
DarthFN.zip
33a98b92bebf8b97c4148422714bbf4f2a0a5f92dd2d703b3d029b63bbf6bc1c
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/clrjit.dll",#1
Test run - Evidence 3 of 7: ProcessSeen in the test run
rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/coreclr.dll",#1
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
Temp
C:\ProgramData\Microsoft\Windows\WER\Temp
Test run - Evidence 5 of 7: Written fileSeen in the test run
adb839c0-6bd8-4bbb-82e1-5e068eb396b1
C:\ProgramData\Microsoft\Windows\WER\Temp\adb839c0-6bd8-4bbb-82e1-5e068eb396b1
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
172.67.179.49
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
150.171.73.13
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1055· Process injection
- T1057· Lists programs
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1106
- T1202
- T1497· Sandbox evasion
- T1539
- T1562.001· Disables security
Observed activity
Processes started
14Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/clrjit.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/coreclr.dll",#1DarthFN.exe"C:\Users\<USER>\AppData\Local\Temp\DarthFN/DarthFN.exe"rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/hostfxr.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/hostpolicy.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/Microsoft.Spark.Worker.dll",#1
Show all 14 entries for processes started
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/System.Collections.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/System.ComponentModel.Primitives.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/System.Console.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/System.Diagnostics.Process.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/System.Private.CoreLib.dll",#1msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igk.filexspace.com/getfile/TGNGNMJ?title=Dependeciesrundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/System.Runtime.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DarthFN/System.Runtime.InteropServices.dll",#1
Network contacts
1111 hosts, listed as 11 addresses. Links show the host and path only.
- IP address
172.67.179.49 - IP address
150.171.73.13 - IP address
151.101.194.137 - IP address
104.16.80.73 - IP address
104.21.85.107 - IP address
104.26.2.199
Show all 11 entries for network contacts
- IP address
104.16.79.73 - IP address
35.190.80.1 - IP address
104.18.10.207 - IP address
172.67.169.22 - IP address
104.17.24.14
Files
21Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\adb839c0-6bd8-4bbb-82e1-5e068eb396b1 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\1c5b1274-5ce0-4c65-b0f0-c51a809bafe1 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\4bf8c518-c35e-4aa2-9315-340664c99d45
Show all 21 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\f0454513-3614-47e6-9e43-148b4330c1f0 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\b12785ca-496d-42bb-9ed7-c1c97a96d6e6 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\48254e89-f315-49cb-a12d-e5ec2f20ddbe - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF906.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER11C0.tmp.xml - Written
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\edge_BITS_3328_13324473\BIT7B50.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\edge_BITS_3328_13324473\0b18f766-7469-4aa3-88b7-99e69c55d14d - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF906.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER11C0.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF906.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER11C0.tmp.xml
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Auto-start
ServiceExample
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\WERReportingForProcess860Global\AmiProviderMutex_InventoryApplicationFileGlobal\e1d0afb7-0e8c-498f-bf9b-48c86213efe1Local\!BrowserEmulation!SharedMemory!MutexLocal\VERMGMTBlockListFileMutexLocal\URLBLOCK_FILEMAPSWITCH_MUTEX_2040
Show all 10 entries for mutexes
Local\URLBLOCK_HASHFILESWITCH_MUTEXLocal\URLBLOCK_DOWNLOAD_MUTEXIsoScope_7f8_IE_EarlyTabStart_0xaf0_MutexIsoScope_7f8_ConnHashTable<2040>_HashTable_Mutex
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 860 -s 496 - VM host
8.8.8.8 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- dd9729a2f62a8c742aac…b9c1eeNot checkedno saved verdict
- 6fc60adc117431c23aeb…c31d45Not checkedno saved verdict
- b4375494bb10be11db61…e66de7Not checkedno saved verdict
- 9c506c9347f872c33752…f73c22Not checkedno saved verdict
- a166041b2627a95b2e6a…ec8838Not checkedno saved verdict
- 001dc22d5205f5cdc3ba…7b4ef6Not checkedno saved verdict
- 5b20181ee4e188aa6b32…aa1211Not checkedno saved verdict
- 0761aa90038ef2975b38…4aeb64Not checkedno saved verdict
- 1d393bc4164e01d0229d…ec55e4Not checkedno saved verdict
- c07fc9fbf4dd7897bbb0…410589Not checkedno saved verdict
Chapter 04
Technical details
1 of the 65 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
- Fortinet (major engine)Riskware/Application
File fingerprint
- Last analyzed
- Sep 10, 2026, 10:16 AM UTC
- SHA-256
33a98b92bebf8b97c4148422714bbf4f2a0a5f92dd2d703b3d029b63bbf6bc1c- SHA-1
eb8170898d158a1c4585acf92276efd7620e5505- MD5
9a69d49a97e2ca1e07039846af4096af
About this file
DarthFN.zip is a ZIP file of 12.8 MB.
- Type and size
- ZIP · 12.8 MB
- Signer
- Not applicable
- First seen
- Mar 14, 2026On VirusTotal.
- Submitted by
- 190 distinct sources
First scanned
Antivirus consensus
1 of 65 engines flagged this file
10 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines1flagged
- Tier-235 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- FortinetMalicious: Riskware/Application
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforNo result
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.
The sandbox recorded persistence through a service or scheduled task. Installers set these up legitimately for their own updaters and services, so this is context, not proof of malicious intent.
EvidenceServiceExampleVirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is DarthFN.zip safe, or is it malware?
What is DarthFN.zip?
How many antivirus engines detected DarthFN.zip?
What should I do if I already opened or extracted DarthFN.zip?
What is the SHA-256 hash of DarthFN.zip?
How up to date is this analysis of DarthFN.zip?
Community
Member reviews and reports for this exact file hash.