File scan report
Verdict Malicious
Is compensation-
Four major antivirus engines and eight independent detectors flagged this document-themed ISO, with BitDefender identifying Zmutzy and ESET detecting a shellcode-running trojan.
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already opened or extracted it, follow the steps below.
What to do now3 steps
This disk image (ISO) is harmful. Don't open or extract it, and delete it.
If you haven't opened or extracted it
Don't open or extract this archive. Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash.
If you already opened or extracted it
If you already extracted it, delete the extracted files too and run a full antivirus scan.
If a page it opened asked for a password or card details and you entered them, change that password and call your bank.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
14 of 58 flagged
- Flagged 14
- No detection 44
- No result 17
- Code signing Not applicable
- Test run Not run
- First seen 13d ago
Chapter 02
Why we think so
6 points against it and 0 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The ISO drew 14 detections among 75 engines, including four major detections and eight independent flagged engines. BitDefender identified Zmutzy, while ESET and DrWeb reported shellcode-running or packed-trojan patterns; avoid mounting or opening it.
The detection pattern is materially stronger than a less reliable false-positive cluster: 14 of the 58 antivirus engines that checked it flagged the file, including four major detections and eight independent flagged engines. BitDefender identifies Zmutzy, while ESET reports a ShellcodeRunner trojan and DrWeb reports a packed trojan, providing cross-vendor agreement on harmful content despite imperfect family consensus. The ISO is has only one known submission, and uses a compensation-statement theme consistent with deceptive delivery. A Metasploit-related rule-based adds concern, but it rests on one less reliable label and is not treated as confirmed offensive tooling. No completed observation from the test run or complete contacted-host reputation result is available, so the conclusion rests primarily on static antivirus evidence.
What We Detected
Fourteen of the 58 antivirus engines that checked it flagged the ISO. The detections include BitDefender's Zmutzy label, ESET's ShellcodeRunner trojan label, DrWeb's packed-trojan label, and Symantec's generic malicious-code label. Eight independent engine lineages contributed detections, making a shared-engine counting artifact an insufficient explanation.
Threat Behavior
The image is tagged as containing a Windows executable and is presented as a compensation-recovery statement, a theme that may encourage recipients to mount the image and launch its contents. One rule-based references Cobalt Strike or Metasploit artifacts, but its evidence is a single VBA32 Metasploit label; offensive-tool confirmation was not reached. No completed sandbox observation exists, so execution, persistence, injection, and network activity were not directly observed. No complete contacted-host reputation result is available.
What To Do Now
Do not mount the ISO or execute anything inside it. Quarantine or delete the file, keep security software enabled, and investigate the delivery source and any system on which its contents may already have run.
Where this verdict could be wrong3 caveats
- No malware-specific YARAify rule or MalwareBazaar record corroborated the detections, although absence from those collections does not establish benignity.
- The Zmutzy family label lacks strong major consensus, and several detections use generic or differing trojan names.
- No completed sandbox run is available to confirm execution, persistence, or network behavior.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Four major antivirus engines detected trojan-related content.
- Eight independent detector lineages contributed to the overall detection count.
- The file is has only one known submission, and has no established benign history.
- The compensation-statement filename may be intended to entice a recipient into mounting the disk image.
- The image contains a Windows executable despite presenting itself as a statement.
- One engine associated the contents with a Metasploit downloader, though that label was not independently confirmed.
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
No completed test run is saved for this file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Chapter 04
Technical details
14 of the 58 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 14
- BitDefender (major engine)Gen:Variant.Zmutzy.258
- DrWeb (major engine)Trojan.Packed2.52037
- Emsisoft (major engine)Gen:Variant.Zmutzy.258 (B)
- ESET-NOD32 (major engine)Win32/ShellcodeRunner.AHR trojan
- GData (major engine)Gen:Variant.Draftor.26803
- Symantec (major engine)Scr.Malcode!gen43
- AhnLab-V3Trojan/Win.Generic.C5947002
- ALYacGen:Variant.Draftor.26803
File fingerprint
- Last analyzed
- Oct 13, 2026, 1:48 PM UTC
- SHA-256
4401c11cb33030a96570433bab9fd48619c6fbaefb783b12388401a861761d9a- SHA-1
d789ab9db8f3c9eb030d50e43c18c626896ff57d- MD5
2218b00813782ee78f3f7f7f0b9e361c
About this file
compensation-recovery-statement-[number].iso is an ISO image file of 981.0 kB.
- Type and size
- ISO image · 981.0 kB
- Signer
- Not applicable
- First seen
- Oct 13, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is compensation-recovery-statement-[number].iso a virus?
What is compensation-recovery-statement-[number].iso?
How many antivirus engines detected compensation-recovery-statement-[number].iso?
What should I do if I already opened or extracted compensation-recovery-statement-[number].iso?
How do I remove compensation-recovery-statement-[number].iso?
What kind of malware is compensation-recovery-statement-[number].iso?
What is the SHA-256 hash of compensation-recovery-statement-[number].iso?
How up to date is this analysis of compensation-recovery-statement-[number].iso?
Community
Member reviews and reports for this exact file hash.