File scan report
Verdict Safe
Is pk3
No antivirus engine flagged the archive, and its completed sandbox run produced no malicious verdict, despite one isolated defense-impairment technique mapping.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
The evidence supports normal use when the archive came from the expected source. Keep security protection enabled and verify the source or published checksum before executing extracted files.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 66 flagged
- Flagged 0
- No detection 66
- No result 11
- Code signing Not applicable
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 66 antivirus engines that checked it flagged pk3DS.zip, including the major antivirus engines, and the completed sandbox run produced no malicious verdict. One mapping warrants ordinary caution, but it lacks corroboration from detections, persistence, process injection, hostile contacts, or malicious child verdicts.
The archive received no malicious or suspicious detections among 77 engines, with all 18 major contributors reporting no detection. One completed sandbox run produced no malicious verdict and showed no persistence indicators or injected processes. All three observed network hosts were covered by the reputation check, with none listed as malicious or suspicious. is a meaningful counter-signal, but it appears alone among mostly techniques common in legitimate software and has no supporting engine, file it created, or threat-intelligence evidence. The seven extracted files without saved verdicts represent incomplete child-level coverage, so they do not strengthen either side of the assessment.
What We Detected
None of the 66 antivirus engines that checked it flagged the ZIP archive, including 18 major antivirus engines. No named malware family, hacking tool label, brand mismatch, or malware-specific YARA rule was reported.
Threat Behavior
One completed sandbox run produced no malicious verdict. It launched the included .NET application components and recorded one offensive mapping, T1562.001, but found no process injection or persistence indicators. The reputation check covered both contacted domains and the contacted IP, and none was listed as malicious or suspicious. Seven extracted files have no saved individual verdicts, which leaves some child-level coverage incomplete without making those files risk indicators.
What To Do Now
Use the archive only if it came from the expected project or distributor, and keep security software enabled. If the download source is uncertain, verify its published hash or scan the extracted executables individually before running them.
Where this verdict could be wrong3 caveats
- The runtime mapping includes T1562.001, a defense-impairment technique, although no engines or other runtime indicators corroborate malicious use.
- The archive has only three recorded submissions despite being over two years old, so broad real-world reputation evidence is limited.
- Seven extracted children lack saved verdicts; this is missing child-level coverage rather than evidence that they are harmful.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 66 antivirus engines that checked it flagged the archive.
- All 18 major antivirus contributors reported no detection.
- The completed sandbox run produced no malicious verdict and observed no persistence or process injection.
- The host-reputation check covered all three observed contacts and found none listed as malicious or suspicious.
- No malware-specific YARA rules or known malicious child verdicts were found.
- The sandbox mapped one defense-impairment technique, T1562.001, without corroborating hostile activity.
- The archive is uncommon, with only three recorded submissions.
- Seven extracted components lack saved individual assessments.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 10spawned processes
- 3network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
12MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1056· Keylogging
- T1059· Runs commands
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1106
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1562.001· Disables security
- T1564.001· Hides artifacts
- T1574.002· Execution hijack
Observed activity
Processes started
10Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\pk3DS/net8.0-windows/pk3DS.Core.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\pk3DS/net8.0-windows/pk3DS.WinForms.dll",#1pk3DS.WinForms.exe"C:\Users\<USER>\AppData\Local\Temp\pk3DS/net8.0-windows/pk3DS.WinForms.exe"unarchiver.exe"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\pk3DS.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\dm4ug2uj.e1x" "C:\Users\user\Desktop\pk3DS.zip"exo-open/usr/bin/exo-open exo-open /tmp/pk3DS.zip
Show all 10 entries for processes started
exo-open/usr/bin/exo-open -engrampa/usr/bin/engrampa engrampa /tmp/pk3DS.zip7z/usr/lib/p7zip/7z l -slt -bd -y -- /tmp/pk3DS.zippython3.8/usr/bin/python3.8 -
Network contacts
33 hosts, listed as 2 domains, 1 address. Links show the host and path only.
- Domain
cdn.onenote.net - Domain
tse1.mm.bing.net - IP address
23.54.34.68
Files
14Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Temp\dm4ug2uj.e1x - Written
C:\Users\user\AppData\Local\Temp\dm4ug2uj.e1x\pk3DS - Written
C:\Users\user\AppData\Local\Temp\dm4ug2uj.e1x\pk3DS\7703.zip - Written
C:\Users\user\AppData\Local\Temp\dm4ug2uj.e1x\pk3DS\net8.0-windows - Written
C:\Users\user\AppData\Local\Temp\dm4ug2uj.e1x\pk3DS\net8.0-windows\pk3DS.Core.dll - Written
C:\Users\user\AppData\Local\Temp\dm4ug2uj.e1x\pk3DS\net8.0-windows\pk3DS.Core.pdb
Show all 14 entries for files
- Written
C:\Users\user\AppData\Local\Temp\dm4ug2uj.e1x\pk3DS\net8.0-windows\pk3DS.WinForms.deps.json - Written
C:\Users\user\AppData\Local\Temp\dm4ug2uj.e1x\pk3DS\net8.0-windows\pk3DS.WinForms.dll - Written
C:\Users\user\AppData\Local\Temp\dm4ug2uj.e1x\pk3DS\net8.0-windows\pk3DS.WinForms.exe - Written
C:\Users\user\AppData\Local\Temp\dm4ug2uj.e1x\pk3DS\net8.0-windows\pk3DS.WinForms.pdb - Written
C:\Users\user\AppData\Local\Temp\dm4ug2uj.e1x\pk3DS\net8.0-windows\pk3DS.WinForms.runtimeconfig.json - Written
C:\Users\user\AppData\Local\Temp\unarchiver.log - Written
\Device\ConDrv\\Connect - Written
/root/.cache/dconf/user
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
DBWinMutex
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
dbus-launch/usr/bin/dbus-launch dbus-launch --autolaunch=a39eb3ed78b7401fb6809ed0c562a5b1 --binary-syntax --close-stderr
Files this sample writes at runtime
This file drops 7 children at runtime. None are currently flagged malicious in our cache. 7 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 6ac9f5000c3b7f73ddb2…9dab37Not checkedno saved verdict
- f67b628b1bf5f5278902…d7e3baNot checkedno saved verdict
- 7e618911e20bbd7fbc28…a8d7e7Not checkedno saved verdict
- ee420c7aa501860bea6f…c99091Not checkedno saved verdict
- 5430d2b2d6f654df66d7…8fd389Not checkedno saved verdict
- c71152bf25e40d647b24…b4e782Not checkedno saved verdict
- 8dda3aa3d8a84eb0f736…3f40cfNot checkedno saved verdict
Chapter 04
Technical details
None of the 66 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 9, 2026, 6:37 PM UTC
- SHA-256
41acb803898fe2b3d8141b5419b675d900ee253f6a7aaf29724066049343fbd6- SHA-1
287a2a194d36fe190fac98376bb85327145ade5b- MD5
62b8f5e934e515481a6a0bcadc23b3ac
About this file
pk3DS.zip is a ZIP file of 3.1 MB.
- Type and size
- ZIP · 3.1 MB
- Signer
- Not applicable
- First seen
- Jun 6, 2024On VirusTotal.
- Submitted by
- 3 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 66 engines flagged this file
11 of the 77 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-237 engines0flagged
- Low-trust11 engines0flagged
View all 77 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BitDefenderThetaClean
- BkavNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CybereasonClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MAXClean
- MaxSecureClean
- McAfeeClean
- McAfeeDNo result
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is pk3DS.zip safe?
What is pk3DS.zip?
How many antivirus engines detected pk3DS.zip?
What is the SHA-256 hash of pk3DS.zip?
Is it safe to open or extract pk3DS.zip?
How up to date is this analysis of pk3DS.zip?
Community
Member reviews and reports for this exact file hash.