Safe
Clean across our antivirus network, signed by Gibson Research Corporation, and matches prevalent legitimate ValiDrive utility despite packer and heuristic flags.
382041665c4670222b…53b0ad19a4The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
Dominant clean engine consensus (0/72 malicious, full tier1 coverage) outweighs synthesis heuristics on injection/LSASS/IPs, which lack sandbox or detection corroboration. High prevalence and community validation as GRC's ValiDrive tool explain behavioural signals. Verified signing adds trust despite no historical stats. YARAify hits are packer/cert-focused, not malicious.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
0/72 engines.malicious; 17 tier1ReportedClean
signing.verified=true; signer='Gibson Research Corporation'
prevalence.classification='common_old'; uniqueSources=3627
communityComments[1]: 'ValiDrive is a lightweight program for testing real flash drive capacity' linking grc.com
behaviour.hasMaliciousSandboxVerdict=false; droppedChildren.hasMaliciousChild=false
- 0 malicious engines (72 reporting, 17 tier1 clean)
- prevalence 'common_old' (3627 sources)
- signing.verified by Gibson Research Corporation
- communityComments validate as grc.com ValiDrive tool
- No malicious sandbox or children
- triggeredHeuristics 'ProcessInjection' (high severity, T1055)
- behaviour.offensiveTechniques includes LSASS targeting
- peAnalysis.likelyPacked=true (PECompact)
- Direct IP contacts without DNS (19 IPs)
This is the legitimate ValiDrive.exe from Gibson Research Corporation for USB drive testing. Safe to use; ignore heuristic flags explained by its low-level drive access.
PE Digital Certificate corroborated by 1 source
- 6 YARA rulesPE_Digital_Certificate, PE_Potentially_Signed_Digital_Certificate, pecompact2
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 23.216.147.76
- 192.229.211.108
- 20.99.185.48
- 104.98.118.163
- 20.99.186.246
- 20.99.133.109
- 23.53.122.135
- 23.209.116.9
- 20.99.184.37
- 20.22.113.133
- C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
- C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
- \\?\PIPE\wkssvc
- C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4EA.tmp.WERInternalMetadata.xml
- C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5B5.tmp.csv
- C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5F4.tmp.txt
- C:\ProgramData\Microsoft\Windows\WER\Temp\WERF15B.tmp.WERInternalMetadata.xml
- C:\ProgramData\Microsoft\Windows\WER\Temp\WERF15D.tmp.csv
- Local\Shell.CMruPidlList
- Local\SessionImmersiveColorMutex
- Global\SyncRootManager
- Local\Mutexf01b4d95cf55d32a.automaticDestinations-ms
- Local\SHResolveLibrary:C:/Users/Virtual/AppData/Roaming/Microsoft/Windows/Libraries/Documents.library-ms
Files this sample writes at runtime
This file drops 2 children at runtime. None are currently flagged malicious in our cache.
- bd3493f96ae3dab469e6…0210d1Never scannednever seen before
- c9c6d514bef159b18f40…469361Never scannednever seen before
1 corroborating signal from researcher-curated sources
- PE_Digital_Certificateby albertzsigovits
- PE_Potentially_Signed_Digital_Certificateby albertzsigovits
- pecompact2by Kevin FalcozPECompact
- PECompact2xxBitSumTechnologiesby malware-lu
- PECompactV2XBitsumTechnologiesby malware-lu
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
- PE_Digital_Certificate
- PE_Potentially_Signed_Digital_Certificate
- pecompact2
- PECompact2xxBitSumTechnologies
- PECompactV2XBitsumTechnologies
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
EvidenceC:\Windows\System32\svchost.exe -k NetworkService -pSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exeSample contacted 19 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence23.216.147.76 · 192.229.211.108 · 20.99.185.48
0 detections across 76 engines
Section entropy & packers
Executable sections have high entropy (7.2+) — the code is compressed or encrypted and only decrypted at runtime. Classic packing behaviour.
How often this file shows up in the wild
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- ValiDrive.exe
- Size
- 104.0 KB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 382041665c4670222b8b2600df1e3f4ec97d2b24b071d0f94e503e53b0ad19a4
- MD5
- 1fa9affcc560b68c96e8f4e44d91385e
- SHA-1
- 564365650bc4603f6c5817f0ade8aa1ec7a7ca47
- PE imphash
- 09d0478591d4f788cb3e5ea416c25237
- First seen (VT)
- 2/28/2024, 8:26:11 AM
- Last analysis (VT)
- 4/5/2026, 6:09:20 AM
- First scan (MalwareTips)
- 4/24/2026, 6:09:57 AM
- Last scan (MalwareTips)
- 4/24/2026, 6:09:57 AM
- Code signer
- Gibson Research Corporationverified
- Community reputation
- +35trusted
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.