Is korea pv.exe safe?
A tier-1 engine identifies confirmed hacktool functionality, while nine additional engines flag the unsigned executable despite limited harmful behavior during one sandbox run.
Ten of 74 engines detected the executable, including two tier-1 engines; Ikarus specifically identified riskware/hacktool functionality, satisfying the corroboration requirement for offensive tooling. One sandbox run did not demonstrate harmful execution, but the unsigned status and confirmed hacktool classification warrant containment rather than use.
4df901992aac867fd6…7f608b90578cf7Recommended next actions
Before running
Do not run it. Delete this file from the device, then empty the Recycle Bin or Trash.
If you already ran it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
Ten of 74 engines detected the executable, including two tier-1 engines; Ikarus specifically identified riskware/hacktool functionality, satisfying the corroboration requirement for offensive tooling. One sandbox run did not demonstrate harmful execution, but the unsigned status and confirmed hacktool classification warrant containment rather than use.
Ten of 74 engines flagged the executable, including two tier-1 detections. Ikarus specifically reported PUA.RiskWare.Hacktool, and the corroborated hacktool indicator meets the threshold for treating offensive tooling as a threat regardless of intended use. The file is unsigned and has no established publisher history. One completed sandbox run showed no malicious verdict or offensive-only MITRE techniques, and the two observed domains had complete reputation coverage without known-bad results. Those counter-signals reduce certainty about active payload behavior, but they do not outweigh the confirmed offensive-tool classification.
What We Detected
Ten of 74 antivirus engines flagged the file. Two were tier-1 detections: Ikarus identified PUA.RiskWare.Hacktool, while Symantec reported ML.Attribute.HighConfidence. CrowdStrike, Elastic, Rising, and several other engines added generic or machine-learning detections, but no strong consensus established a specific malware family.
Threat Behavior
The executable is unsigned and lacks publisher history. One completed sandbox run produced no malicious verdict and no offensive-only MITRE techniques; the observed activity consisted of nine more broadly applicable techniques, including T1027, T1071, and T1497. Both contacted domains were checked against the host cache, with no malicious or suspicious matches, and no malicious child file was observed.
What To Do Now
Quarantine the file and do not execute it on a production or personal system. Keep endpoint protection enabled, and only investigate the sample in an isolated analysis environment if its origin and intended administrative purpose can be independently verified.
Where this verdict could be wrong4 caveats
- The completed sandbox run returned a clean result and behaviour.hasMaliciousSandboxVerdict=false.
- Fifteen of 17 reporting tier-1 engines did not detect the sample, and tier1FamilyConsensus.strong=false.
- External intelligence found no MalwareBazaar, CIRCL, or YARAify hit.
- PE analysis reports peAnalysis.likelyPacked=false and peAnalysis.highEntropyCode=false.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- One sandbox run produced no malicious verdict
- behaviour.offensiveCount=0
- Complete coverage of two contacted domains found no known-bad hosts
- No malicious dropped child was reported
- No packing or high-entropy code was identified
- Confirmed hacktool classification under engines.hacktoolConfirmed=true
- 10/74 antivirus detections
- Two tier-1 detections from Ikarus and Symantec
- Unsigned Win32 executable with no signer history
- Generic high-confidence detections from CrowdStrike and Elastic
Quarantine and avoid running the executable unless its legitimate purpose and source can be independently established. Keep endpoint protection enabled and use an isolated lab for any necessary examination.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete10 of 74 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Complete2 contacted hosts were cross-checked.
YARA
CompleteRule evaluation completed with no recorded matches.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 9MITRE ATT&CK techniques
- 2spawned processes
- 2network contacts
- 2filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Used an input-capture technique that can record credentials or keystrokes.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Note: Loads extra code modules while running.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How hacktools are abused
This is a hacking or cracking tool — the kind used to bypass software licences, generate fake keys, or attack other systems. Even when the tool 'works', these downloads very often carry hidden malware.
Bottom line:Running one means trusting an anonymous author with full access to your PC — rarely worth the risk.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
korea pv.exe
4df901992aac867fd652fc5e705197838d8f43756e1aed02177f608b90578cf7
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\pm.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
"C:\Users\user\Desktop\pm.exe"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
ecs-office.s-0005.dual-s-msedge.net
Contact observed during runtime.
04Isolated runtime analysis - Contacted hostObserved
s-0005.dual-s-msedge.net
Contact observed during runtime.
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
5 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- ecs-office.s-0005.dual-s-msedge.net
- s-0005.dual-s-msedge.net
- \Sessions\1\BaseNamedObjects\Local\__DDrawExclMode__
- \Sessions\1\BaseNamedObjects\Local\__DDrawCheckExclMode__
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 0rule hits recorded
- 10 / 74engines flagged
- 28sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
10 of 74 antivirus engines flagged the file, including APEX and Bkav.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 02
The hash has been submitted 38 times from 28 sources.
ProvenanceDerivedSourceSaved report factsObserved at - 03
Scanned file: korea pv.exe — 4df901992aac867fd652fc5e705197838d8f43756e1aed02177f608b90578cf7
ProvenanceObservedSourceUploaded fileObserved at - 04
Observed process — "C:\Users\<USER>\Desktop\pm.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 05
Observed process — "C:\Users\user\Desktop\pm.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Contacted host: ecs-office.s-0005.dual-s-msedge.net — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
Contacted host: s-0005.dual-s-msedge.net — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: hacktool
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
YARA rules
No matchesThe rule pass completed without a saved public match.
10 of 74 engines flagged this file
View all 74 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- korea pv.exe
- Format
- Win32 EXE
- Code signing
- No verified publisher
- Size
- 437.0 KB
- Last analyzed
- Oct 3, 2026, 12:42 PM UTC
4df901992aac867fd652fc5e705197838d8f43756e1aed02177f608b90578cf7Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't run this file. Delete this file from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already ran it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
From a different, clean device, change the passwords on your important accounts (email and banking first) and turn on two-factor authentication.
- Recovery step 04
Get a fresh copy from the developer's official site or an official app store.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is korea pv.exe malware?
What is korea pv.exe?
How many antivirus engines detected korea pv.exe?
I already downloaded and ran korea pv.exe — what should I do?
How do I remove korea pv.exe?
What kind of malware is korea pv.exe?
What is the SHA-256 hash of korea pv.exe?
How up to date is this analysis of korea pv.exe?
Community
Member reviews and reports for this exact file hash.