File scan report
Verdict Safe
Is Ionic.
Only one less reliable engine raised a generic downloader label on this validly signed Razer USA Ltd. .NET executable, and every major engine returned no detection.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This file is likely safe if it came with official Razer software. Keep your antivirus enabled, and obtain Razer components only from official sources.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 70 flagged
- Flagged 1
- No detection 69
- No result 4
- Code signing Razer USA Ltd.
- Test run Partial
- First seen 2y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
One of the 70 antivirus engines that checked it, VBA32, flagged this file with a generic downloader label, while all major antivirus engines found nothing. The file carries a valid signature from Razer USA Ltd., and earlier samples from that signer in our history were clean. The lone detection looks like a rule-based false positive.
The only detection is a generic rule-based label from VBA32, one of the less reliable engines, and none of the 18 major antivirus engines flagged the file. The file has a valid code signature from Razer USA Ltd., and all three earlier samples from that signer in our records were clean. It is an unpacked .NET executable, and no public malware database or rule-matching service lists it. No observation from the test run or contacted-host check was available, and the file is rarely submitted. These gaps temper confidence but do not counter the clean picture from the engines.
What We Detected
1 of the 70 antivirus engines that checked it flagged this file: VBA32, with a generic downloader rule-based label. None of the major antivirus engines, including Kaspersky, ESET, BitDefender, Avast and Microsoft-class vendors, reported a detection. The file is validly signed by Razer USA Ltd. It was first seen on Jul 25, 2024 and has been submitted by two sources.
Threat Behavior
No completed sandbox run is available, so behaviour in the test run was not observed. Static indicators show an ordinary, unpacked .NET executable with normal section entropy. No matches were found in public malware databases or community YARA rules.
What To Do Now
If you obtained this file through official Razer software or its updates, it can be used normally. Keep your antivirus enabled. If you received it from an unexpected source, re-download it from Razer's official channels.
Where this verdict could be wrong2 caveats
- The file is rarely submitted (two sources) and the signer has only three prior samples in our history, so publisher reputation is thin.
- No sandbox run or static analysis of the bytes was available, so behaviour in the test run was not observed.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Valid code signature from Razer USA Ltd.
- No detections from any major antivirus engine.
- Earlier samples from this signer in our history were all clean.
- Not packed or obfuscated; a standard .NET build.
- No listings in public malware databases or rule-matching services.
- One less reliable engine labels the file as a generic downloader.
- Rarely submitted, and the signer has only a short history in our records.
6 sources checked · 4 complete · 1 partial · 1 not needed or not applicable. See every source
Chapter 03
Technical details
1 of the 70 antivirus engines that checked it flags it; signed by Razer USA Ltd..
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 partial · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- VBA32Downloader.MSIL.gen.rexp
File fingerprint
- Last analyzed
- Oct 23, 2026, 9:42 PM UTC
- SHA-256
504406f7f8e89cf8b6e91a0607a67cc16d7b942d47c08a55a57123cc5165ec35- SHA-1
b4db9e744205fc01127010f0bbbdb802f0a945ed- MD5
13bb3592affef22eff37748ffecc8d3d
About this file
Ionic.Zip-2024Jul24-025641-d95181ce-fc9b-4d52-b4a7-f30eb1eec57d.exe says it is Razer Installer, 7.9 MB.
- Claims to be
- Razer InstallerFrom the file's own version information, written by whoever built it.
- Original name
- Ionic.Zip-2024Jul24-025641-d95181ce-fc9b-4d52-b4a7-f30eb1eec57d.exeMatches the shared file name.
- Type and size
- Win32 EXE · 7.9 MB
- Signer
- Razer USA Ltd.Valid code signature.
- First seen
- Jul 25, 2024On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.86 of 8
First scanned
Antivirus consensus
1 of 70 engines flagged this file
4 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines1flagged
View all 74 engine results
- VBA32Malicious: Downloader.MSIL.gen.rexp
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
Signed by "Razer USA Ltd." — short generic company CN. Paired with 1 engine hit(s); possible stolen, fraudulent, or reseller-purchased code-signing certificate.
EvidenceRazer USA Ltd.
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 04
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is this file safe?
What is this file?
How many antivirus engines detected this file?
Is this file digitally signed?
What is the SHA-256 hash of this file?
Is it safe to run this file?
How up to date is this analysis of this file?
Community
Member reviews and reports for this exact file hash.