File scan report
Verdict Suspicious
Is Local
Eight of the 71 antivirus engines that checked it flag this small unsigned .NET executable with generic machine-learning labels, while three sandbox runs stayed clean and no…
Read the whole reasonShow less
Why Suspicious? 8 antivirus engines flag it, but no major engine agrees; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Only run this program if you built it yourself or received it from a source you personally trust, and keep your security protection switched on. If you must test it, use a disposable virtual machine first and upload it again if it starts making network connections or adding startup entries.
What to do now5 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
It is only 1 day old. If you're unsure, scan it again in a few days; antivirus engines often catch up on new files.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
8 of 71 flagged
- Flagged 8
- No detection 63
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 1d ago
Chapter 02
Why we think so
5 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This is a small, unsigned .NET program first seen on Nov 6, 2026 and submitted by a single source. Eight engines return generic or machine-learning malicious labels, but none of the 18 major engines in our network flagged it, the combined sandbox verdict was clean, and no dangerous network contacts were found. The signals point both ways, so caution is warranted.
Eight of the 71 antivirus engines that checked it flagged this 17 KB .NET executable, yet all of the labels are vague — "malicious" confidence scores and hashed generic names rather than a known malware family, and none of the 18 major engines in our network, including Kaspersky, ESET, BitDefender, Fortinet and Avira, detected anything. The combined sandbox verdict was clean, with no injected process, no files it created, no persistence and no credential access. The network picture is equally quiet: the file reached ordinary content-delivery and web devices, and the reputation check covered all five contacted hosts with no malicious or suspicious result. Against that, the file is unsigned, tiny, rarely submitted — one source, first seen on Nov 6, 2026 — and carries tags describing obfuscation and debugger or virtual-machine detection, which is a common combination for both hobby tools and small commodity loaders. With no verified publisher, no trusted-software reference entry and no broad real-world history, there is no anchor strong enough to clear it, so the mixed picture is reported as caution rather than a clean bill of health.
What We Detected
Eight of the 71 antivirus engines that checked it flagged this file, but every label is a generic or machine-learning style verdict: CrowdStrike reports a moderate malicious confidence score, SentinelOne a static-AI "suspicious PE" verdict, Elastic a moderate-confidence malicious verdict, Trapmine a moderate malicious score, APEX a plain "malicious", Bkav a hashed generic name and Kingsoft a numeric signature. No engine named a real malware family, and none of the 18 major engines in our network — Kaspersky, ESET, BitDefender, Fortinet, Avira, Avast, G Data, DrWeb, Emsisoft among them — detected anything.
What The File Is
It is a 17 KB unsigned .NET executable, first seen on Nov 6, 2026 and submitted by a single source. Its file tags describe the assembly as obfuscated and as containing debugger and virtual-machine detection. Our own static analysis completed and found no decisive behaviour: no packing (entropy is a low 4.94), no auto-run, download or credential-access pattern, and 13 capabilities typical of a small .NET utility. One string references a public push-notification relay service, which is unusual for a chat program but was not matched by any observed network activity.
Threat Behavior
Three sandbox runs were completed and the combined verdict was clean. No process was injected into, no file was dropped, no persistence entry was created, no credentials were touched and no remote control traffic was seen. The only contacts recorded were ordinary content-delivery and web devices, and the reputation check covered all five hosts with nothing known-bad found.
What To Do Now
Treat this file with caution: the detection record is real but vague, and a small unsigned program of unknown origin deserves more suspicion than a mainstream signed application. If you did not build it yourself or receive it from a source you personally trust, do not run it. If you do need to test it, keep your existing security software active, run it in a disposable virtual machine first, and watch for outbound connections or new startup entries; a fresh check of the file after any behaviour appears is the quickest way to confirm or clear the concern.
Where this verdict could be wrong3 caveats
- None of the 18 major engines in our network flagged the file and the combined sandbox verdict was clean, so the eight flags may reflect generic machine-learning scoring on a small obfuscated .NET assembly rather than real malicious code.
- The only network traffic recorded was ordinary content-delivery and web devices, and the reputation check of all five contacted hosts found nothing known-bad — no remote control contact was observed.
- A reference to a public notification-relay service was found in the file's strings, but no associated network activity was observed in any run, so it may be an unused or developer leftover.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 18 major engines, including Kaspersky, ESET, BitDefender, Fortinet, Avira and G Data, flagged the file.
- The combined sandbox verdict was clean, with no injected processes, no dropped files, no persistence entries and no credential access.
- The reputation check covered all five contacted hosts and found none known to be malicious or suspicious; the traffic observed looks like ordinary web and content-delivery requests.
- Our static analysis found no decisive malicious pattern and no packing — the code sections are low-entropy and the file is a plain .NET assembly.
- Eight of the 71 antivirus engines that checked it flagged the file; the labels come from generic and machine-learning style detections rather than any named malware family.
- The executable is unsigned and very small, and it was submitted by a single source on Nov 6, 2026, so there is almost no real-world history to judge it by.
- The file's own metadata tags describe the assembly as obfuscated and as containing debugger or virtual-machine detection.
- Our static analysis catalogued 13 capabilities and found a reference to a public push-notification relay service in the file's strings, which is unusual for a chat utility of this size.
- A program calling itself a chat client that arrives unsigned, rarely seen and lightly obfuscated is a common disguise for small commodity loaders.
7 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 14sandbox rule tags
- 2spawned processes
- 2network contacts
- 1filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 6: FileSeen in the test run
LocalChat.exe
49b90c1c50b32d051ed88f2f141122e4aa1a0c912909156114558b47cd8070c5
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 6: ProcessSeen in the test run
LocalChat.exe
"C:\Users\<USER>\Desktop\LocalChat.exe"
Test run - Evidence 3 of 6: ProcessSeen in the test run
LocalChat.exe
"C:\Users\user\Desktop\LocalChat.exe"
Test run - +1 more recorded observation
- 1
Files
Created or changed
- Evidence 4 of 6: Written fileSeen in the test run
Roaming
C:\Users\user\AppData\Roaming
Test run
- 2
Network
Hosts contacted
- Evidence 5 of 6: Contacted hostSeen in the test run
www.msn.com.edgekey.net
Contacted during the test run.
Test run - Evidence 6 of 6: Contacted hostSeen in the test run
e592.d.akamaiedge.net
Contacted during the test run.
Test run - +1 more recorded observation
6 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 14 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
8 of the 71 antivirus engines that checked it flag it; no publisher signature.
No risky structure found
We opened the uploaded Windows program in an isolated sandbox and read its structure without running it.
What the code can do, found by Mandiant capa rules, not behaviour that was seen.
- check if file existsT1083 · Scans your files
- get common file pathT1083 · Scans your files
- compiled to the .NET platform
- create directory
- create HTTP request
- create thread
- read file in .NET
- receive HTTP response
- send data
- send HTTP request
1 link found. Only domains are shown; paths and query strings are never published.
Checked on Nov 6, 2026 while the file was uploaded. MalwareTips deleted its copy afterwards; VirusTotal keeps the uploaded file.
Sources checked
Every check behind this verdict
7 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 8
- APEXMalicious
- BkavW32.Malware.E68FE1A6
- CrowdStrikewin/malicious_confidence_60% (D)
- Elasticmalicious (moderate confidence)
- Kingsoftmalware.kb.c.654
- McAfeeDti!49B90C1C50B3
- SentinelOneStatic AI - Suspicious PE
- Trapminemalicious.moderate.ml.score
File fingerprint
- Last analyzed
- Nov 6, 2026, 3:39 PM UTC
- SHA-256
49b90c1c50b32d051ed88f2f141122e4aa1a0c912909156114558b47cd8070c5- SHA-1
e4cb834f55c8b07074c39bd6215fd414dba832b8- MD5
97b82b8374fab87cc7c42c98ef04ac10
About this file
LocalChat.exe is a Win32 EXE file of 17.4 kB.
- Original name
- LocalChat.exeMatches the shared file name.
- Type and size
- Win32 EXE · 17.4 kB
- Signer
- UnsignedNo code signature.
- First seen
- Nov 6, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 4.94 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is LocalChat.exe safe, or is it malware?
What is LocalChat.exe?
How many antivirus engines detected LocalChat.exe?
What should I do if I already ran LocalChat.exe?
What is the SHA-256 hash of LocalChat.exe?
How up to date is this analysis of LocalChat.exe?
Community
Member reviews and reports for this exact file hash.