File scan report
Verdict Safe
Is Vali
Clean across the antivirus engines, signed by Gibson Research Corporation, and matches prevalent legitimate ValiDrive utility despite packer and rule flags.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 72 flagged
- Flagged 0
- No detection 72
- No result 4
- Code signing Gibson Research Corporation
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No engines detect threats in this common file with positive reputation. Signed and packed consistently with lightweight assembly tool.
High prevalence and community validation as GRC's ValiDrive tool explain behavioural signals. Verified signing adds trust despite no historical stats. YARAify hits are packer/cert-focused, not malicious.
What We Detected
Clean scan: 0/72 engines flag malicious, including major like Kaspersky, BitDefender.
Threat Behavior
PECompact packing and high entropy suit compact assembly tool. No malicious files it created, sandbox verdicts, or bad hosts. Offensive MITRE (3/12) routine for system tools.
What To Do Now
Safe to run; verifies real USB drive capacity per grc.com. Matches known benign pattern.
Where this verdict could be wrong3 caveats
- triggeredHeuristics 'one of our behaviour rules' flags access to the Windows password store (Mimikatz-like), which could indicate credential access if not tool-specific.
- behaviour.contactedIps direct (no domains, e.g. 23.216.147.76 Akamai) matches 'one of our behaviour rules' heuristic (medium), potentially evading DNS blocks.
- peAnalysis.highEntropyCode=true; likelyPacked=true (PECompact) — common in both legit compact tools and malware.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0 malicious engines (72 reporting, 17 major clean)
- prevalence 'widely seen and long established' (3627 sources)
- signing.verified by Gibson Research Corporation
- communityComments validate as grc.com ValiDrive tool
- No malicious sandbox or children
- triggeredHeuristics 'one of our behaviour rules' (high severity, T1055)
- peAnalysis.likelyPacked=true (PECompact)
- Direct IP contacts without DNS (19 IPs)
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 4spawned processes
- 5network contacts
- 24filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
12MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1045
- T1055· Process injection
- T1071· Application protocol
- T1082· System recon
- T1548
- T1562· Disables security
- T1562.001· Disables security
- T1574.002· Execution hijack
Observed activity
Processes started
3Programs the file ran, with their command lines.
executable.exe"C:\Users\<USER>\Desktop\executable.exe"validrive.exe%SAMPLEPATH%\validrive.exe382041665c4670222b8b2600df1e3f4ec97d2b24b071d0f94e503e53b0ad19a4.exe%SAMPLEPATH%\382041665c4670222b8b2600df1e3f4ec97d2b24b071d0f94e503e53b0ad19a4.exe
Network contacts
55 hosts, listed as 5 addresses. Links show the host and path only.
- IP address
104.98.118.163 - IP address
23.53.122.135 - IP address
23.209.116.9 - IP address
20.22.113.133 - IP address
23.34.172.81
Files
19Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db - Written
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp - Written
\\?\PIPE\wkssvc - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4EA.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5B5.tmp.csv
Show all 19 entries for files
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5F4.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF15B.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF15D.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF16E.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2575.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER25E3.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2670.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER269F.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER265F.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER26A0.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2016.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2018.tmp.csv
Mutexes
5Named locks a program uses so only one copy runs; malware families often reuse them.
Local\Shell.CMruPidlListLocal\SessionImmersiveColorMutexGlobal\SyncRootManagerLocal\Mutexf01b4d95cf55d32a.automaticDestinations-msLocal\SHResolveLibrary:C:/Users/Virtual/AppData/Roaming/Microsoft/Windows/Libraries/Documents.library-ms
Sandbox background — not the file
26The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
Show all 26 entries for sandbox background — not the file
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
updater.exeC:\Program Files (x86)\Google3320_1362596897\bin\updater.exe - VM process
updater.exeC:\Program Files (x86)\Google3784_1305551991\bin\updater.exe - VM process
updater.exeC:\Program Files (x86)\Google656_1023583890\bin\updater.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM host
23.216.147.76 - VM host
192.229.211.108 - VM host
20.99.185.48 - VM host
20.99.186.246 - VM host
20.99.133.109 - VM host
20.99.184.37 - VM host
192.168.0.80 - VM host
23.216.147.64 - VM host
a83f:8110:0:0:700:700:2800:4000 - VM host
20.69.140.28 - VM host
a83f:8110:1800:0:0:0:0:200 - VM host
13.107.4.50 - VM host
184.25.191.235 - VM host
a83f:8110:0:0:beac:bf78:cce1:d301 - VM host
131.253.33.203
Files this sample writes at runtime
This file drops 2 children at runtime. None are currently flagged malicious in our cache. 2 have no saved verdict and were not checked; that is missing coverage, not a finding.
- bd3493f96ae3dab469e6…0210d1Not checkedno saved verdict
- c9c6d514bef159b18f40…469361Not checkedno saved verdict
Chapter 04
Technical details
None of the 72 antivirus engines that checked it flag it; signed by Gibson Research Corporation.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Apr 24, 2026, 10:09 AM UTC
- SHA-256
382041665c4670222b8b2600df1e3f4ec97d2b24b071d0f94e503e53b0ad19a4- SHA-1
564365650bc4603f6c5817f0ade8aa1ec7a7ca47- MD5
1fa9affcc560b68c96e8f4e44d91385e
About this file
ValiDrive.exe is a Win32 EXE file of 106.5 kB.
- Type and size
- Win32 EXE · 106.5 kB
- Signer
- Gibson Research CorporationValid code signature.
- First seen
- Feb 28, 2024On VirusTotal.
- Submitted by
- 3,627 distinct sources
- Packer
- PECompact (VirusTotal tag)Packing hides code; legitimate installers use it too.
- Entropy
- 7.55 of 8A code section is highly compressed or encrypted.
First scanned Updated
Antivirus consensus
0 of 72 engines flagged this file
4 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust18 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.
Showing the 5 saved rule names of 6 matched.
- PE_Digital_Certificategeneric
- PE_Potentially_Signed_Digital_Certificategeneric
- pecompact2generic
- PECompact2xxBitSumTechnologiesgeneric
- PECompactV2XBitsumTechnologiesgeneric
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
Executable sections have high entropy (7.2+) — the code is compressed or encrypted and only decrypted at runtime. Classic packing behaviour.
Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is ValiDrive.exe safe?
What is ValiDrive.exe?
How many antivirus engines detected ValiDrive.exe?
Is ValiDrive.exe digitally signed?
What is the SHA-256 hash of ValiDrive.exe?
Is it safe to run ValiDrive.exe?
How up to date is this analysis of ValiDrive.exe?
Community
Member reviews and reports for this exact file hash.
