File scan report
Verdict Safe
Is Mortal Shell.
A tiny 202-byte internet shortcut for Mortal Shell with no engine detections, clean static analysis and no hostile activity in the test run in one sandbox run.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This looks like an ordinary game shortcut and can be kept. If you are unsure, check in a text editor that its target is your game launcher.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 49 flagged
- Flagged 0
- No detection 49
- No result 26
- Code signing Not applicable
- Test run Completed
- First seen 7d ago
Chapter 02
Why we think so
0 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This is a small Windows internet shortcut file, the kind game launchers place on the desktop. Our static analysis found no obfuscation or hidden commands, and the sandbox run showed only the shortcut being opened.
The file is a 202-byte .url shortcut, a plain-text link format, and its name matches a game title. None of the 49 antivirus engines that checked it flagged it, and twelve major antivirus engines reported it clean. Our static analysis read it as shortcut text with no obfuscation, no encoded commands and no rules matched. In the one sandbox run, the only activity was the command prompt opening the shortcut, with no injection, no files written and no network contacts. It was submitted by a single source, which is normal for a shortcut created on one user's PC.
What We Detected
A 202-byte Windows internet shortcut first seen on Oct 19, 2026. None of the 49 antivirus engines that checked it flagged it, and our static analysis found no suspicious content.
Threat Behavior
In the single sandbox run, the only activity was the command prompt opening the shortcut. The run showed no high-risk techniques, process injection, written files or network contacts. A shortcut only points to a location; it carries no code of its own. No host reputation check was available for its target.
What To Do Now
If you have the game installed, this is most likely the desktop link its launcher created. To be sure, open the file in a text editor and confirm that it points to your game launcher.
Where this verdict could be wrong1 caveat
- The shortcut's target was not shown in our evidence. A .url file only points elsewhere, so a link to an unexpected website or file would still need checking.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 49 antivirus engines that checked it flagged the file
- Our static analysis found no obfuscation, hidden commands or suspicious rules
- The sandbox run showed no injection, file writes or network activity
- Tiny plain-text shortcut consistent with a game launcher's desktop link
7 sources checked · 6 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 1 isolated test; no test environment rated what it did as risky.
Test run summary
Capture complete- 1isolated sandbox run
- 2sandbox rule tags
- 1spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
2MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1082· System recon
- T1574· Execution hijack
Observed activity
Processes started
1Programs the file ran, with their command lines.
cmd.exe"C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\<USER>\Desktop\Mortal Shell.url"
Chapter 04
Technical details
None of the 49 antivirus engines that checked it flag it.
No risky structure found
We opened the uploaded Internet shortcut in an isolated sandbox and read its structure without running it.
Checked on Oct 19, 2026 while the file was uploaded. MalwareTips deleted its copy afterwards; VirusTotal keeps the uploaded file.
Sources checked
Every check behind this verdict
7 sources checked · 6 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 19, 2026, 5:05 PM UTC
- SHA-256
371ca8c0540159ddf6e221075f5a9e0f003d3c26632475fbf1225a15df4d8b30- SHA-1
1e472bb869e036e134f91f6e0e861e3b168ede4f- MD5
b174272f2cb2b73c61b77d2a9b0509e9
About this file
Mortal Shell.url is an INI file of 202 B.
- Type and size
- INI · 202 B
- Signer
- Not applicable
- First seen
- Oct 19, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned Updated
Antivirus consensus
0 of 49 engines flagged this file
26 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-112 engines0flagged
- Tier-228 engines0flagged
- Low-trust9 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderNo result
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureNo result
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingNo result
- SangforClean
- SentinelOneNo result
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSNo result
- TrendMicroNo result
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumNo result
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Barely seen in the wild and first surfaced recently. That limits reputation evidence, but rarity alone is not proof of malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Mortal Shell.url safe?
What is Mortal Shell.url?
How many antivirus engines detected Mortal Shell.url?
What is the SHA-256 hash of Mortal Shell.url?
Is it safe to open Mortal Shell.url?
How up to date is this analysis of Mortal Shell.url?
Community
Member reviews and reports for this exact file hash.