File scan report
Verdict Safe
Is Capys-
Only Bkav flagged this archive among 75 engines, while stronger engines, completed observation from the test run, host checks, and external intelligence supplied no corroboration.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 1d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The lone Bkav detection appears likely to be a false positive: none of the stronger engines flagged the archive, and the combined sandbox verdict was clean. No named injection target, malicious contacted host, malicious file it created, MalwareBazaar entry, or malware-specific YARA rule corroborates it, although direct static inspection was unavailable.
Only 1 of the 66 antivirus engines that checked it flagged the archive, and that was Bkav using a generic label; all 18 reporting major antivirus engines were silent. Two completed sandbox runs produced a combined clean verdict and recorded no named injection target or other high-risk technique with supporting evidence. The T1055, T1486, and mappings lacked the artefacts needed to show process injection, file encryption, or defence tampering. Reputation checks covered all three distinct observed hosts and found none marked malicious or suspicious, while the inspected children contained no harmful verdict. The main uncertainty is the absence of our static analysis and the archive's limited history since it was first seen on Nov 2, 2026.
What We Detected
Only Bkav flagged the archive, using the generic label W32.Malware.DF99DCD5. The other 74 engines did not flag it, including all 18 reporting major antivirus engines. No malware-specific YARA rule, MalwareBazaar entry, or named malware family supported the isolated result.
Threat Behavior
Two completed sandbox runs produced a combined clean verdict. All three distinct observed hosts were covered by reputation checks, with none marked malicious or suspicious, and no inspected child had a harmful verdict.
What To Do Now
The available evidence strongly suggests that Bkav's generic detection is a false positive. Because our static analysis was unavailable and the archive contains executable material, obtain it from the expected source, keep security software enabled, and rescan if its contents or source differ from what you expected.
Where this verdict could be wrong3 caveats
- Bkav labels the archive W32.Malware.DF99DCD5, although no other engine corroborates that generic detection.
- The archive was first seen on Nov 2, 2026 and has only 42 distinct submitters, so its history is not yet a strong benign anchor.
- Our static analysis was unavailable, so the archive's internal files and code were not directly inspected.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 66 antivirus engines that checked it flagged the archive, and none of the 18 reporting major antivirus engines did.
- Two completed sandbox runs produced a combined clean verdict with no named injection target.
- Reputation checks covered all three distinct observed hosts and found none marked malicious or suspicious.
- No inspected child had a harmful verdict; one child matched a known-software reference entry.
- No MalwareBazaar entry or malware-specific YARA rule was found.
- Bkav reports a generic malware label, although no other engine corroborates it.
- The archive contains executable material and was first seen on Nov 2, 2026, with 42 distinct submitters.
- Direct static inspection of the archive contents was not available.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 20sandbox rule tags
- 9spawned processes
- 3network contacts
- 40filesystem & mutex artifacts
Includes the sandbox verdicts, 20 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- BkavW32.Malware.DF99DCD5
File fingerprint
- Last analyzed
- Nov 3, 2026, 5:10 AM UTC
- SHA-256
52cb82871633a06c44efb7e0106a2d7bef8f35221d610c377668c99f6204a607- SHA-1
fafa4e76a61d4bd62692514a1c9772fe38a4ab67- MD5
f5175745e7c713e3bc8657fa60fa5673
About this file
Capys-AA-Macro-v3.91-1.zip is a ZIP file of 82.8 MB.
- Type and size
- ZIP · 82.8 MB
- Signer
- Not applicable
- First seen
- Nov 2, 2026On VirusTotal.
- Submitted by
- 42 distinct sources
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Capys-AA-Macro-v3.91-1.zip safe?
What is Capys-AA-Macro-v3.91-1.zip?
How many antivirus engines detected Capys-AA-Macro-v3.91-1.zip?
What is the SHA-256 hash of Capys-AA-Macro-v3.91-1.zip?
Is it safe to open or extract Capys-AA-Macro-v3.91-1.zip?
How up to date is this analysis of Capys-AA-Macro-v3.91-1.zip?
Community
Member reviews and reports for this exact file hash.
