File scan report
Verdict Safe
Is netcat GUI.
A long-circulating, packed netcat GUI tool flagged by 6 of the 71 antivirus engines that checked it using only generic packer and machine-learning labels, with clean sandbox runs.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Use this tool only if you need netcat functionality, preferably from an official source, and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
6 of 71 flagged
- Flagged 6
- No detection 65
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 9y ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Six of the 71 antivirus engines that checked it flag this file, but only with generic labels tied to its packer or machine-learning scores, and no engine names a malware family. Six sandbox runs showed no high-risk behaviour, and the file has circulated widely since 2017. It is a dual-use networking tool, so use it only if you need it.
Only one major antivirus engine flags the file, and Ikarus's label names a commercial packer rather than malware, while 17 other major antivirus engines report nothing. The remaining detections are generic machine-learning or rule labels with no family. Six sandbox runs recorded no injection, no high-risk techniques and no malicious verdict, and the hosts contacted were checked and are not known to be bad. The file has been seen by 148 sources since 2017 and has no listings in malware sample databases or malware-specific rule hits. Packed, unsigned utilities like this commonly attract generic detections.
What We Detected
6 of the 71 antivirus engines that checked it flagged this unsigned executable. Ikarus labels it as a potentially unwanted file because of its Themida-style protector, SentinelOne reports a static AI suspicion, and four less reliable engines give generic machine-learning results. No engine names a malware family. The file is wrapped with a BoxedApp virtualization packer.
Threat Behavior
Six sandbox runs showed no injection into other processes and no high-risk techniques, and the only recorded sandbox verdict was clean. Network contacts were limited to IP ranges that look like Microsoft or CDN infrastructure, and none of the checked hosts are known to be malicious. The file has been widely seen since 2017.
What To Do Now
If you intend to use a netcat GUI, this file shows no evidence of a malware payload. Netcat can open remote shells, so run it only for your own legitimate networking tasks, prefer an official source, and keep your antivirus enabled.
Where this verdict could be wrong3 caveats
- The file is unsigned and wrapped in a BoxedApp/Themida-style packer, which hides its contents from static inspection.
- One community comment reports a third-party sandbox score of 56/100 for evasion behaviour, and batch-feed tags list several malware families, though none of these are corroborated by the engines.
- Netcat itself is a dual-use networking tool that can be misused for remote shells.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Seen by 148 independent sources since 2017.
- Six sandbox runs found no high-risk behaviour and no malicious verdict.
- No engine names a malware family, and 17 major antivirus engines report it clean.
- It has no listings in malware sample databases and no malware-specific rule hits.
- The file is unsigned and wrapped in a commercial packer.
- Netcat is a dual-use networking tool that can be misused.
- One major antivirus engine labels it as potentially unwanted because of the packer.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 6 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 6isolated sandbox runs
- 9sandbox rule tags
- 3spawned processes
- 2network contacts
- 26filesystem & mutex artifacts
Includes the sandbox verdicts, 9 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
6 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 6
The Safe verdict weighed these detections and treats them as non-decisive.
- Ikarus (major engine)PUA.Themida
- APEXMalicious
- CynetMalicious (score: 100)
- MaxSecureTrojan.Malware.74671347.susgen
- SentinelOneStatic AI - Suspicious PE
- Trapminemalicious.high.ml.score
File fingerprint
- Last analyzed
- Oct 18, 2026, 9:35 PM UTC
- SHA-256
41d37c9baa08bab1e4498df80110cadd2898d8be121aaab232c236ac644fcf08- SHA-1
7d1adcb6bf5bd88c322e963e46605c2e32616c81- MD5
1910e4527c9261610c2747a4245bc6a8
About this file
netcat GUI.exe is a Win32 EXE file of 6.3 MB.
- Claims to be
- netcat GUIFrom the file's own version information, written by whoever built it.
- Original name
- netcat GUI.exeMatches the shared file name.
- Type and size
- Win32 EXE · 6.3 MB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 8, 2017On VirusTotal.
- Submitted by
- 148 distinct sources
- Packer
- None detected
- Entropy
- 6.09 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is netcat GUI.exe safe?
What is netcat GUI.exe?
How many antivirus engines detected netcat GUI.exe?
What is the SHA-256 hash of netcat GUI.exe?
Is it safe to run netcat GUI.exe?
How up to date is this analysis of netcat GUI.exe?
Community
Member reviews and reports for this exact file hash.