File scan report
Verdict Safe
Is 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔 safe? Yes, no threats found.
No antivirus engine flagged this widely distributed, ByteDance-signed CapCut installer, and its completed sandbox run showed installation activity without a malicious verdict.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Bytedance Pte. Ltd.
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged the file, and its verified ByteDance signature aligns with the observed CapCut installation paths, registry entries, program markers, and service domains. It is an older, widely submitted sample, while the completed sandbox run and fully covered host-reputation check produced no malicious finding.
The strongest evidence identifies this executable as a CapCut installer signed by Bytedance Pte. Ltd. None of the 71 antivirus engines that checked it flagged it, including no detections among the major antivirus engines, and the sample has been submitted 69,747 times by 3,695 sources. Its completed sandbox run contacted CapCut and ByteDance infrastructure, created CapCut installation records, and received a clean runtime assessment. All 35 distinct observed hosts were covered by the reputation cross-check, with none listed as malicious or suspicious; Microsoft background contacts were excluded from sample activity. Six offensive-capability techniques and updater-process injection remain cautionary observations, but they lack corroboration from engines, malicious hosts, persistence indicators, malware-specific YARA rules, or malicious child verdicts.
What We Detected
None of the 71 antivirus engines that checked it flagged the executable. It carries a verified signature from Bytedance Pte. Ltd., and runtime artifacts consistently identify CapCut: the installer launched packages under the local CapCut directory, created ByteDance and CapCut program markers, and wrote CapCut uninstall and publisher records.
Threat Behavior
One completed sandbox run received a clean assessment. The executable contacted CapCut, ByteDance, and related content-delivery services; the host-reputation check covered all 35 distinct observed domains and IPs and found no malicious or suspicious entries. Three Microsoft contacts were analysis-environment background traffic and were not attributed to the sample. The run mapped T1134, T1486, T1543.003, T1547.001, T1548, and T1560 and reported interaction with updater processes, but it recorded no persistence indicators, malicious child verdict, or malware-specific YARA match.
What To Do Now
The binary evidence is consistent with a widely distributed CapCut installer, although its unusual displayed filename is not informative. If CapCut was intended, verify that the signature still shows Bytedance Pte. Ltd. before running it. If the file arrived unexpectedly or from an untrusted sender, obtain a fresh installer through the publisher's normal distribution channel and keep security software enabled.
Where this verdict could be wrong4 caveats
- The sandbox mapped six offensive-capability techniques and reported injection into updater processes, which warrants caution despite the clean runtime verdict.
- The displayed filename does not identify CapCut, although the verified ByteDance signature and installation activity consistently do.
- Ten dropped files lack saved verdicts, so their individual safety was not established.
- Historical files sharing only this import-table fingerprint received four suspicious assessments, but none shared the signer and installer-framework import-table fingerprint collisions are weak identity evidence.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the executable.
- The digital signature verifies to Bytedance Pte. Ltd.
- The file has 69,747 submissions from 3,695 sources and has circulated for roughly 989 days.
- The completed sandbox run received a clean assessment and produced CapCut-specific installation artifacts.
- All 35 observed hosts were covered by the reputation check, with no malicious or suspicious entries.
- The displayed filename is unrelated to CapCut and could confuse recipients about the executable's purpose.
- The sandbox mapped six techniques associated with offensive capabilities.
- Runtime reporting indicated interaction with multiple updater processes.
- Ten extracted files do not have individual saved assessments.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 30sandbox rule tags
- 11spawned processes
- 29network contacts
- 37filesystem & mutex artifacts
Includes the sandbox verdicts, 30 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Bytedance Pte. Ltd..
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 11, 2026, 3:15 AM UTC
- SHA-256
4a9d815f284adda187982e2b24da2beaad860739bc4b4cb1cf26408e7c221dd6- SHA-1
021f3f26d86f98af28dc987baad8714f64867207- MD5
c91e097550ea6ccedf592d8b83414e0d
About this file
🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔 is a Win32 EXE file of 2.3 MB.
- Type and size
- Win32 EXE · 2.3 MB
- Signer
- Bytedance Pte. Ltd.Valid code signature.
- First seen
- Jan 26, 2024On VirusTotal.
- Submitted by
- 3,695 distinct sources
- Packer
- None detected
- Entropy
- 3.03 of 8
First scanned
Includes every engine result (75), 2 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔 safe?
What is 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔?
How many antivirus engines detected 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔?
Is 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔 digitally signed?
What is the SHA-256 hash of 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔?
Is it safe to run 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔?
How up to date is this analysis of 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔?
Community
Member reviews and reports for this exact file hash.