File scan report
Verdict Safe
Is netcat GUI.
A long-circulating, packed netcat GUI tool flagged by 6 of the 71 antivirus engines that checked it using only generic packer and machine-learning labels, with clean sandbox runs.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Use this tool only if you need netcat functionality, preferably from an official source, and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
6 of 71 flagged
- Flagged 6
- No detection 65
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 9y ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Six of the 71 antivirus engines that checked it flag this file, but only with generic labels tied to its packer or machine-learning scores, and no engine names a malware family. Six sandbox runs showed no high-risk behaviour, and the file has circulated widely since 2017. It is a dual-use networking tool, so use it only if you need it.
Only one major antivirus engine flags the file, and Ikarus's label names a commercial packer rather than malware, while 17 other major antivirus engines report nothing. The remaining detections are generic machine-learning or rule labels with no family. Six sandbox runs recorded no injection, no high-risk techniques and no malicious verdict, and the hosts contacted were checked and are not known to be bad. The file has been seen by 148 sources since 2017 and has no listings in malware sample databases or malware-specific rule hits. Packed, unsigned utilities like this commonly attract generic detections.
What We Detected
6 of the 71 antivirus engines that checked it flagged this unsigned executable. Ikarus labels it as a potentially unwanted file because of its Themida-style protector, SentinelOne reports a static AI suspicion, and four less reliable engines give generic machine-learning results. No engine names a malware family. The file is wrapped with a BoxedApp virtualization packer.
Threat Behavior
Six sandbox runs showed no injection into other processes and no high-risk techniques, and the only recorded sandbox verdict was clean. Network contacts were limited to IP ranges that look like Microsoft or CDN infrastructure, and none of the checked hosts are known to be malicious. The file has been widely seen since 2017.
What To Do Now
If you intend to use a netcat GUI, this file shows no evidence of a malware payload. Netcat can open remote shells, so run it only for your own legitimate networking tasks, prefer an official source, and keep your antivirus enabled.
Where this verdict could be wrong3 caveats
- The file is unsigned and wrapped in a BoxedApp/Themida-style packer, which hides its contents from static inspection.
- One community comment reports a third-party sandbox score of 56/100 for evasion behaviour, and batch-feed tags list several malware families, though none of these are corroborated by the engines.
- Netcat itself is a dual-use networking tool that can be misused for remote shells.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Seen by 148 independent sources since 2017.
- Six sandbox runs found no high-risk behaviour and no malicious verdict.
- No engine names a malware family, and 17 major antivirus engines report it clean.
- It has no listings in malware sample databases and no malware-specific rule hits.
- The file is unsigned and wrapped in a commercial packer.
- Netcat is a dual-use networking tool that can be misused.
- One major antivirus engine labels it as potentially unwanted because of the packer.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 6 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 6isolated sandbox runs
- 9sandbox rule tags
- 3spawned processes
- 2network contacts
- 26filesystem & mutex artifacts
What this file did when executed
This file was detonated in 6 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1027.005· Obfuscated code
- T1071· Application protocol
- T1082· System recon
- T1496
- T1497· Sandbox evasion
- T1497.001· Sandbox evasion
- T1562.001· Disables security
- T1574.002· Execution hijack
Observed activity
Processes started
3Programs the file ran, with their command lines.
program.exe"C:\Users\<USER>\AppData\Local\Temp\program.exe"41d37c9baa08bab1e4498df80110cadd2898d8be121aaab232c236ac644fcf08.exe%SAMPLEPATH%\41d37c9baa08bab1e4498df80110cadd2898d8be121aaab232c236ac644fcf08.exefile.exe%SAMPLEPATH%\file.exe
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
104.98.118.168 - IP address
20.96.153.111
Files
16Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Roaming - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER654.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER74E.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER78D.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER904.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER905.tmp.csv
Show all 16 entries for files
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER916.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER534B.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER535C.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5406.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5437.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5417.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5448.tmp.txt - Deleted
%USERPROFILE%\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000018.db - Deleted
%USERPROFILE%\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001a.db
Registry and auto-start
4Settings the file changed, including ways to start again after a restart.
- Set
HKLM\System\CurrentControlSet\Services\GoogleChromeElevationService\Start - Set
HKLM\System\CurrentControlSet\Services\GoogleChromeElevationService\ImagePath - Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService126.0.6462.0\Start - Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService126.0.6462.0\ImagePath
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
bx_thread_mutex_00001780boxedapp_shared_env_mutex_00000f1c_00001780boxedapp_process_list_mutex_00000f1c_00001780boxedapp_global_shared_mem_00000f1c_00001780bx_process_mutex_00000f1c_00001780_00000f1cbx_thread_mutex_000005fc
Show all 10 entries for mutexes
boxedapp_shared_env_mutex_000002d8_000005fcboxedapp_process_list_mutex_000002d8_000005fcboxedapp_global_shared_mem_000002d8_000005fcbx_process_mutex_000002d8_000005fc_000002d8
Sandbox background — not the file
23The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google3656_191289905\bin\updater.exe - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM injection target
C:\Program Files\Google3656_191289905\bin\updater.exe - VM host
www.microsoft.com
Show all 23 entries for sandbox background — not the file
- VM host
res.public.onecdn.static.microsoft - VM host
204.79.197.203 - VM host
a83f:8110:0:0:4b82:21:0:0 - VM host
192.168.0.40 - VM host
23.216.147.76 - VM host
20.99.132.105 - VM host
20.62.24.77 - VM host
104.86.182.43 - VM host
20.99.184.37 - VM host
20.99.186.246 - VM host
192.229.211.108 - VM host
23.216.147.64 - VM host
20.99.185.48 - VM host
20.99.133.109 - VM host
23.216.81.152 - VM host
a83f:8110:2800:0:2800:0:1800:0 - VM host
23.196.193.245
Chapter 04
Technical details
6 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 6
The Safe verdict weighed these detections and treats them as non-decisive.
- Ikarus (major engine)PUA.Themida
- APEXMalicious
- CynetMalicious (score: 100)
- MaxSecureTrojan.Malware.74671347.susgen
- SentinelOneStatic AI - Suspicious PE
- Trapminemalicious.high.ml.score
File fingerprint
- Last analyzed
- Oct 18, 2026, 9:35 PM UTC
- SHA-256
41d37c9baa08bab1e4498df80110cadd2898d8be121aaab232c236ac644fcf08- SHA-1
7d1adcb6bf5bd88c322e963e46605c2e32616c81- MD5
1910e4527c9261610c2747a4245bc6a8
About this file
netcat GUI.exe is a Win32 EXE file of 6.3 MB.
- Claims to be
- netcat GUIFrom the file's own version information, written by whoever built it.
- Original name
- netcat GUI.exeMatches the shared file name.
- Type and size
- Win32 EXE · 6.3 MB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 8, 2017On VirusTotal.
- Submitted by
- 148 distinct sources
- Packer
- None detected
- Entropy
- 6.09 of 8
First scanned
Antivirus consensus
6 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines1flagged
- Tier-236 engines1flagged
- Low-trust17 engines4flagged
View all 75 engine results
- APEXMalicious: Malicious
- CynetMalicious: Malicious (score: 100)
- IkarusMalicious: PUA.Themida
- MaxSecureMalicious: Trojan.Malware.74671347.susgen
- SentinelOneMalicious: Static AI - Suspicious PE
- TrapmineMalicious: malicious.high.ml.score
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is netcat GUI.exe safe?
What is netcat GUI.exe?
How many antivirus engines detected netcat GUI.exe?
What is the SHA-256 hash of netcat GUI.exe?
Is it safe to run netcat GUI.exe?
How up to date is this analysis of netcat GUI.exe?
Community
Member reviews and reports for this exact file hash.