File scan report

Verdict Safe

Analyzed Sep 6, 20261 month ago

Is LDPlayer safe? Yes, no threats found.

Two smaller engines flag an unwanted-program label while 17 major antivirus engines remain silent on a signed installer.

Read the whole reasonShow less

Moderate evidence · No engine flags it, but no publisher signature confirms who made it.

Run it as usual if it came from the official source

Good practice2 tips

We found nothing harmful in this file.

Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

2 of 71 flagged

Flagged 2
No detection 69
No result 4

FileLDPlayer3.4 MBSHA-256 55b61915f530…f89a1f

Code signing JUST OKAY LIMITED
Test run Completed
First seen 4mo ago

It has a valid digital signature from JUST OKAY LIMITED.

Chapter 02

Why we think so

2 points against it and 3 in its favour, checked against the scan evidence.

Analyst conclusion

Only two low-tier engines report an unwanted-program label; all major antivirus engines are clean. The file is signed, shows medium prevalence, and no malicious files it created or host hits were found.

Where this verdict could be wrong1 caveat

Community comment explicitly states 'Verdict: Clean Score: 0/100' with valid certificate for JUST OKAY LIMITED.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

8sandbox rule tags
1spawned processes
10network contacts
16filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

8

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1027· Obfuscated code
T1027.002· Obfuscated code
T1036
T1055· Process injection
T1057· Lists programs
T1071· Application protocol
T1560
T1573

Observed activity

Processes started

1

Programs the file ran, with their command lines.

LDPlayer14_ens_99602_ld.exe"C:\Users\user\Desktop\LDPlayer14_ens_99602_ld.exe"

Network contacts

10

10 hosts, listed as 6 addresses, 6 links. Links show the host and path only.

IP address8.222.131.165
IP address139.95.13.159
IP address163.181.246.192
IP address23.220.246.7
IP address139.95.13.233
IP address23.220.246.61

Show all 12 entries

URLhttp://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA%2FgMquETQMxBsUMjhPIsGg%3D
URLhttps://files.ldrescdn.com/player_files/en/leidian
URLhttps://files.ldrescdn.com/player_files/openidconfig/99602.data
URLhttps://apien.ldmnq.com/check/machine/channel
URLhttps://res.ldrescdn.com/player_files/en/lddownloader.data
URLhttp://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA/gMquETQMxBsUMjhPIsGg=

Files

14

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Roaming\xzdown\fonts\NanumGothicLight.otf
WrittenC:\Users\<USER>\AppData\Roaming\xzdown\fonts\Roboto-Regular.otf
WrittenC:\Users\<USER>\AppData\Local\Temp\CabAD0A.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\TarAD0B.tmp
WrittenC:\Users\user\AppData\Local\Microsoft\Windows\History
WrittenC:\Users\user\AppData\Local\Microsoft\Windows\INetCache

Show all 14 entries

WrittenC:\Users\user\AppData\Local\Microsoft\Windows\INetCookies
WrittenC:\Users\user\AppData\Roaming\xzdown\
WrittenC:\Users\user\AppData\Roaming\xzdown\fonts\
WrittenC:\Users\user\AppData\Roaming\xzdown\fonts\NanumGothicLight.otf
WrittenC:\Users\user\AppData\Roaming\xzdown\fonts\Roboto-Regular.otf
WrittenC:\Users\user\AppData\Roaming\xzdown\log.txt
DeletedC:\Users\<USER>\AppData\Local\Temp\CabAD0A.tmp
DeletedC:\Users\<USER>\AppData\Local\Temp\TarAD0B.tmp

Mutexes

2

Named locks a program uses so only one copy runs; malware families often reuse them.

{2266E930-7040-4A6B-B7C8-E44663785cdd}
\Sessions\1\BaseNamedObjects\{2266E930-7040-4A6B-B7C8-E44663785cdd}

Sandbox background — not the file

1

The analysis machine's own processes and connections, recorded in every run.

VM host8.8.8.8

Dropped payload

Files this sample writes at runtime

This file drops 2 children at runtime. None are currently flagged malicious in our cache. 2 have no saved verdict and were not checked; that is missing coverage, not a finding.

2 not checked

153161ab882db768c70a…d834a2Not checked
no saved verdict
72336333d602f1c3506e…bb6cb5Not checked
no saved verdict

Chapter 04

Technical details

2 of the 71 antivirus engines that checked it flag it; signed by JUST OKAY LIMITED.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete2 of 71 engines flagged it · 4 gave no result · treated as non-decisive DetailsSep 6, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsSep 6, 2026

Contacted hostsMalwareTips URL scannerPartial4 of 10 contacted hosts were cross-checked; coverage is incomplete DetailsSep 6, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsSep 6, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedSep 6, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchSep 6, 2026

Engines that flagged it 2

The saved verdict treats these detections as likely false positives.

K7AntiVirusUnwanted-Program ( 006d53ed1 )
K7GWUnwanted-Program ( 006d53ed1 )

File fingerprint

Last analyzed: Sep 6, 2026, 3:53 PM UTC

SHA-256: 55b61915f530bd597b380abed9b7bb59947291e8af4a507516136f42c5f89a1f
SHA-1: 73d1d7faf1923e80875f6e0ea436bb49742307b2
MD5: 80f728482205151f4e7bea2ad0c04422

About this file

LDPlayer is a Win32 EXE file of 3.4 MB.

Type and size: Win32 EXE · 3.4 MB
Signer: JUST OKAY LIMITEDValid code signature.
First seen: Jun 11, 2026On VirusTotal.
Submitted by: 3,612 distinct sources
Packer: None detected
Entropy: 7.64 of 8

First scanned Sep 6, 2026

Antivirus consensus

2 of 71 engines flagged this file

2 malicious0 suspicious69 not flagged4 no result

4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

The 2 detections come from 1 independent scan engine: several vendors license the same engine, so their results are one vote.

Tier-118 engines
0flagged
Tier-236 engines
1flagged
2 vendors sharing 1 engine
Low-trust17 engines
0flagged

These detections were treated as likely false positives in the saved verdict.

View all 75 engine results

K7AntiVirusMalicious: Unwanted-Program ( 006d53ed1 )
K7GWMalicious: Unwanted-Program ( 006d53ed1 )
AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 7.64Unpacked

Section entropy6 sections

.text

6.59

.rdata

5.43

.data

5.23

.fptable

0.00

.rsrc

7.80

.reloc

6.58

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely uploaded, but first seen within the last six months. No strong prior applies.

Common

Unique uploaders

3,612

Hundreds of people have uploaded this — common.

Total submissions

7,830

Includes repeat uploads by the same source.

First seen

5mo ago

Jun 11, 2026

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is LDPlayer safe?

We found nothing harmful in LDPlayer. 2 of the 71 antivirus engines that checked it flag it; after weighing the other evidence we treat those alerts as false alarms. It has a valid digital signature from JUST OKAY LIMITED. Run it only if it came from the developer's own website or an official app store.

What is LDPlayer?

LDPlayer is a Windows program, about 3.4 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Jun 11, 2026.

How many antivirus engines detected LDPlayer?

2 of the 71 antivirus engines that checked it flag LDPlayer, including K7. We weigh which engines flagged it and what else the scan found, not just the count.

Is LDPlayer digitally signed?

Yes. LDPlayer has a valid digital signature from JUST OKAY LIMITED, which shows the file hasn't been changed since that publisher signed it. Malware is sometimes signed with stolen certificates, so a signature alone isn't proof of safety.

What is the SHA-256 hash of LDPlayer?

The SHA-256 fingerprint of LDPlayer is 55b61915f530bd597b380abed9b7bb59947291e8af4a507516136f42c5f89a1f, and its MD5 is 80f728482205151f4e7bea2ad0c04422. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to run LDPlayer?

We found nothing harmful in LDPlayer, and its digital signature checks out. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of LDPlayer?

This report reflects the scan on Sep 6, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Is LDPlayer safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

Engines that flagged it 2

File fingerprint

About this file

2 of 71 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is LDPlayer safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Mutexes

Sandbox background — not the file

Engines that flagged it 2

File fingerprint

About this file

Related file reports