File scan report
Verdict Safe
Is Mod
No antivirus engine detected the long-circulating archive, although one sandbox recorded process-loading and direct-IP activity that lacks a complete host-reputation check.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 68 flagged
- Flagged 0
- No detection 68
- No result 7
- Code signing Not applicable
- Test run Completed
- First seen 11y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 68 antivirus engines that checked it were free of detections, including 17 major antivirus engines, and the archive has circulated widely since 2015. One sandbox recorded potentially offensive techniques and 11 direct-IP contacts, but produced no malicious runtime verdict; those IPs were not fully reputation-checked.
The archive received no malicious or suspicious detections from 75 antivirus engines, including 17 major antivirus engines. It has been observed since 2015 across 256 sources and 480 submissions, making an undiscovered commodity threat less likely. One completed sandbox run mapped activity to and three other offensive techniques, but it did not issue a malicious sandbox verdict. Ten extracted children were inspected without a confirmed malicious child, although their individual verdicts remain unresolved. The 11 contacted IP addresses lack a complete host-reputation assessment. No complete contacted-host reputation result was available. Overall, the extensive detection history outweighs the uncorroborated behavioural heuristics.
What We Detected
No malicious or suspicious detection was reported among 75 antivirus engines. This includes 17 major antivirus engines, such as Avast, BitDefender, ESET-NOD32, Kaspersky, and Fortinet. The archive has also circulated since 2015, with 256 sources and 480 submissions, without accumulating a malware family label.
Threat Behavior
One sandbox run mapped activity to T1005, T1055, T1543.002, and T1562.001. It also observed rundll32 loading a temporary DLL and connections to 11 IP addresses, but issued no malicious sandbox verdict. Host reputation was not completely checked for those IP addresses. Ten extracted children were inspected without a confirmed malicious child, though their individual classifications remain unknown.
What To Do Now
Obtain the archive from its original trusted distribution channel and keep security software enabled while extracting or running it. If the source is uncertain, verify the SHA-256 hash and consider monitoring outbound connections during first use.
Where this verdict could be wrong3 caveats
- One of our behaviour rules mapped rundll32 loading zlib.net.dll to T1055, which warrants caution despite the lack of engine detections.
- One of our behaviour rules recorded 11 direct-IP contacts, while the missing contacted-host reputation result means their reputations were not completely checked.
- All 10 extracted children have unknown verdicts, so the absence of a known-malicious dropped file does not establish that every archive component is benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/68 antivirus engines reported a malicious or suspicious result.
- All 17 reporting major antivirus engines returned no detection.
- Observed since 2015 across 256 sources and 480 submissions.
- No malicious sandbox verdict was issued.
- No malicious child or external-intelligence hit was confirmed.
- Sandbox evidence mapped DLL loading through rundll32 to T1055.
- Four offensive MITRE techniques were recorded in one sandbox run.
- Eleven direct-IP contacts were observed without a complete host-reputation result.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 18sandbox rule tags
- 7spawned processes
- 11network contacts
- 40filesystem & mutex artifacts
Includes 18 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 68 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 9, 2026, 6:43 PM UTC
- SHA-256
39550fdf9b9647dcfffc049551908673ef01e18cd364486db47da09552df003f- SHA-1
c29fccaf4672ba1a3c0107ee6e965f8ed4987418- MD5
e145c2b9b4b704b0ee49e82c899732fd
About this file
ModManager (x64) 1.0.0.59.zip is a ZIP file of 142.2 kB.
- Type and size
- ZIP · 142.2 kB
- Signer
- Not applicable
- First seen
- Sep 15, 2015On VirusTotal.
- Submitted by
- 256 distinct sources
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ModManager (x64) 1.0.0.59.zip safe?
What is ModManager (x64) 1.0.0.59.zip?
How many antivirus engines detected ModManager (x64) 1.0.0.59.zip?
What is the SHA-256 hash of ModManager (x64) 1.0.0.59.zip?
Is it safe to open or extract ModManager (x64) 1.0.0.59.zip?
How up to date is this analysis of ModManager (x64) 1.0.0.59.zip?
Community
Member reviews and reports for this exact file hash.