File scan report
Verdict Safe
Is dscrypt.
Three of the 64 antivirus engines that checked it produced generic rule-based warnings, while long-term prevalence, major silence, and the completed behavioral checks provide…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
3 of 64 flagged
- Flagged 3
- No detection 61
- No result 12
- Code signing Unsigned
- Test run Completed
- First seen 20y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The three detections are generic and identify no consistent malware family; none comes from a major antivirus engine. The file has circulated since 2006 across hundreds of submissions, and the completed sandbox run produced no malicious verdict, offensive technique, malicious child, or known-malicious host.
Only 3 of the 64 antivirus engines that checked it raised warnings, and their labels are generic rather than family-specific. No major antivirus engines flagged the executable, despite its long history and broad submission footprint. The host-reputation check covered the observed hosts and found no known-malicious or suspicious destination; the Microsoft contacts were identified as analysis-environment background traffic. UPX packing and the lack of a signature explain some uncertainty, but they do not outweigh the file's long-term prevalence and lack of corroborating malware intelligence.
What We Detected
Three of the 64 antivirus engines that checked it flagged the executable. APEX, MaxSecure, and SentinelOne used generic labels such as “Malicious,” “susgen,” and “Suspicious PE”; no major antivirus engines or consistent malware-family consensus supported those warnings. The file has also been submitted 407 times by 240 sources since September 2006, which weighs against an isolated current threat.
Threat Behavior
The executable is unsigned and compressed with UPX 2.90, so its code is less transparent to static scanners. One completed sandbox run recorded no malicious sandbox verdict, no high-risk MITRE technique, no persistence indicator, and no dropped malicious child. The named Microsoft contacts were identified as background traffic from the analysis environment, while the completed host check found no known-malicious or suspicious hosts among those inspected.
What To Do Now
Use the file only if it came from the expected historical source and its hash matches a trusted copy. Keep security software enabled, and avoid execution if the source or purpose cannot be verified.
Where this verdict could be wrong4 caveats
- The executable is unsigned and UPX-packed, which reduces transparency and can contribute to rule-based detections.
- The sandbox data lists possible injection into WMIADAP.EXE and an updater process, although no offensive technique or malicious sandbox verdict corroborates it.
- A researcher annotation reports the generic SUSP_XORed_URL_in_EXE rule, but the current YARAify check found no specific malware rules and the annotation does not identify a family.
- Three engines raised generic warnings, including the smaller SentinelOne engine, so the detections are not exclusively from less reliable scanners.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No major antivirus engines flagged the file, and no engine consensus identified a malware family.
- The hash has circulated since 2006, with 407 submissions from 240 sources.
- The completed sandbox run produced no malicious verdict and no high-risk behavior.
- No malicious file it created or persistence activity was recorded.
- The completed reputation check found no known-malicious or suspicious contacted host.
- The executable is unsigned, so its publisher cannot be authenticated through a code-signing certificate.
- UPX compression obscures the original executable layout and can trigger rule-based scanners.
- Three antivirus engines raised generic warnings, including one smaller engine.
- The sandbox recorded possible injection into two processes, but without stronger behavioral corroboration.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 5sandbox rule tags
- 3spawned processes
- 3network contacts
- 22filesystem & mutex artifacts
Includes 5 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
3 of the 64 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 3
The Safe verdict weighed these detections and treats them as non-decisive.
- APEXMalicious
- MaxSecureTrojan.Malware.300983.susgen
- SentinelOneStatic AI - Suspicious PE
File fingerprint
- Last analyzed
- Oct 12, 2026, 7:35 PM UTC
- SHA-256
5a59a076eea1e9db21100280ae8884c987a774b11424f1b989160d0585948359- SHA-1
981bf246bfb2e8fda24f1110b2a0203b19868d28- MD5
2a82d9ee11bb8d815a497dfb368f5c99
About this file
dscrypt.exe is a Win32 EXE file of 25.1 kB.
- Type and size
- Win32 EXE · 25.1 kB
- Signer
- UnsignedNo code signature.
- First seen
- Sep 6, 2006On VirusTotal.
- Submitted by
- 240 distinct sources
- Packer
- UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser, UPXPacking hides code; legitimate installers use it too.
- Entropy
- 7.38 of 8A code section is highly compressed or encrypted.
First scanned
Includes every engine result (76), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is dscrypt.exe safe?
What is dscrypt.exe?
How many antivirus engines detected dscrypt.exe?
What is the SHA-256 hash of dscrypt.exe?
Is it safe to run dscrypt.exe?
How up to date is this analysis of dscrypt.exe?
Community
Member reviews and reports for this exact file hash.