File scan report
Verdict Safe
Is Love
None of the 71 antivirus engines that checked it flagged this widely submitted executable, while limited evidence from the test run showed no confirmed injection target…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Use the executable only if it came directly from the expected developer or another trusted channel. Keep security protection enabled and rescan if its hash or behavior changes.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 29d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged the executable, and it has already appeared from 188 sources despite being recently observed. One sandbox mapped possible process injection and archiving, but identified no injected target, file it created, persistence, or malicious outcome; the lack of a signature still warrants obtaining it from a trusted source.
The strongest evidence is the absence of detections across 75 engines, including all 17 major antivirus engines represented in the results. The file is also broadly distributed for its age, with 188 submitting sources and 204 submissions. One completed sandbox run returned a clean result and recorded no persistence, dropped files, or injected target process. Although and were mapped, the mapping alone does not establish the injection method, target, or intent. The executable is unsigned and host reputation coverage was unavailable, so source verification remains advisable.
What We Detected
None of the 71 antivirus engines that checked it flagged the executable, including the major antivirus engines represented in the results. It has appeared from 188 sources across 204 submissions, providing meaningful prevalence despite its recent first observation. No malware-specific YARA rule, MalwareBazaar record, suspicious packing indicator, or malicious file it created was found.
Threat Behavior
One completed sandbox run returned a clean outcome. It mapped T1055 and T1560, but recorded no injected process target, persistence indicator, dropped file, or registry change. The only contacted IP was identified as analysis-environment background traffic, not sample activity; however, no complete contacted-host reputation result is available.
What To Do Now
Confirm that the file came from the developer's official distribution channel because it is unsigned and lacks publisher history. Keep security software enabled, and avoid running a copy received through an untrusted download, message, or mirror.
Where this verdict could be wrong3 caveats
- The executable is unsigned, so no publisher identity or established signer history supports it.
- The sandbox mapped possible process injection and archive-related behavior, although it did not identify an injected process or return a malicious verdict.
- No complete reputation check was available for observed hosts; the sole recorded IP was identified as sandbox background traffic rather than sample activity.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file.
- All 17 major antivirus engines represented in the results reported no detection.
- The file has been submitted from 188 sources a total of 204 times.
- The completed sandbox run returned a clean outcome with no persistence or file it created.
- The antivirus analysis found no packer or high-entropy code indicator.
- The executable is unsigned and has no established publisher history.
- The test run mapped possible process injection and archive-related behavior, though no target or malicious consequence was demonstrated.
- A complete reputation check for observed hosts was not available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 7sandbox rule tags
- 2spawned processes
- 0network contacts
- 2filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
7MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1055· Process injection
- T1056· Keylogging
- T1071· Application protocol
- T1082· System recon
- T1560
Observed activity
Processes started
2Programs the file ran, with their command lines.
LoveManiac 0.3.6-EA1.exe"C:\Users\<USER>\Desktop\LoveManiac 0.3.6-EA1.exe"LoveManiac 0.3.6-EA1.exe"C:\Users\user\Desktop\LoveManiac 0.3.6-EA1.exe"
Files
1Files the file created, changed or deleted.
- Written
\Device\ConDrv\Connect
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\DBWinMutex
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
162.159.36.2
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 12, 2026, 12:42 AM UTC
- SHA-256
507d5e28b96b9bc61fd58e9617613cab147d05f6b6523883f8927c220de35125- SHA-1
89e640a29bf183edaf244de819bb12dcf8802094- MD5
95d8bb90c8e070e399057377e0133422
About this file
LoveManiac 0.3.6-EA1.exe is a Win32 EXE file of 44.8 MB.
- Type and size
- Win32 EXE · 44.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Sep 26, 2026On VirusTotal.
- Submitted by
- 188 distinct sources
- Packer
- None detected
- Entropy
- 6.22 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is LoveManiac 0.3.6-EA1.exe safe?
What is LoveManiac 0.3.6-EA1.exe?
How many antivirus engines detected LoveManiac 0.3.6-EA1.exe?
What is the SHA-256 hash of LoveManiac 0.3.6-EA1.exe?
Is it safe to run LoveManiac 0.3.6-EA1.exe?
How up to date is this analysis of LoveManiac 0.3.6-EA1.exe?
Community
Member reviews and reports for this exact file hash.