File scan report
Verdict Low Risk
Is rqwa2hxhg.
Old unsigned 26 KB EXE with zero engine detections but minimal evidence and no signer history.
Why not Safe? It has no verified publisher signature and only 2 sources had seen it when we scanned it.
Limited evidence · Nothing points to a problem, but little confirms who made it.
Good practice2 tips
Low Risk: no threat found, but we could not fully confirm this file.
Get it from the publisher's own website or app store, not from a re-upload or a link someone sent you.
Keep your security software on, and stop if the file does anything you didn't expect.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 17y ago
Chapter 02
Why we think so
3 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No antivirus engine flagged the file across 75 total scanners. The sample is unsigned, extremely rare, and lacks any corroborating malicious signals from sandbox, external intel, or prior similar-hash verdicts.
Zero malicious detections from 75 engines, including 17 major antivirus engines that returned clean, is a strong negative signal. However, the file is unsigned, has only two historical submissions, and contacted-host reputation data is unavailable. The single low-severity rule on direct-IP traffic is inconclusive without host reputation context. Limited evidence and absence of a trusted publisher therefore prevent a confident safe verdict.
What We Detected
75 engines scanned the 26 KB Win32 EXE; none returned a malicious or suspicious result. 17 major antivirus engines explicitly classified it clean. The binary is unsigned and shows no packers or high-entropy code sections.
Threat Behavior
One sandbox execution recorded four MITRE techniques common in legitimate software and a single direct-IP connection. No offensive techniques, files it created, or malicious sandbox verdict were observed. External-intel sources (CIRCL, MalwareBazaar, YARAify) returned no matches.
What To Do Now
Because the file is unsigned, rare, and lacks host-reputation coverage, treat it as unknown. Do not run it without additional verification such as code signing, broader sandbox coverage, or submission to multiple independent scanners.
- 0/71 engines flagged malicious
- 17 major antivirus engines returned clean
- no malicious sandbox verdict
- unsigned executable
- rare but long known prevalence (2 submissions)
- contactedHosts reputation check unavailable
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 4sandbox rule tags
- 1spawned processes
- 1network contact
- 0filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
4MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1059· Runs commands
- T1082· System recon
- T1129· Loads modules
- T1564.003· Hides artifacts
Observed activity
Processes started
1Programs the file ran, with their command lines.
program.exe"C:\Users\<USER>\Desktop\program.exe"
Network contacts
11 host, listed as 1 address. Links show the host and path only.
- IP address
<MACHINE_DNS_SERVER>
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Aug 19, 2026, 3:37 AM UTC
- SHA-256
3bd50397e265518462960b076f67489572ddb7291f6b12089ed8e31c1615fc5a- SHA-1
53f7a567183e3e09847c2687572bbdef3fb727eb- MD5
1246b430ce5977c9a68b6755cd504f39
About this file
rqwa2hxhg.exe is a Win32 EXE file of 26.1 kB.
- Type and size
- Win32 EXE · 26.1 kB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 25, 2009On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 3.94 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 5 questions people ask most about this file.
Is rqwa2hxhg.exe safe?
What is rqwa2hxhg.exe?
How many antivirus engines detected rqwa2hxhg.exe?
What is the SHA-256 hash of rqwa2hxhg.exe?
How up to date is this analysis of rqwa2hxhg.exe?
Community
Member reviews and reports for this exact file hash.