File scan report
Verdict Safe
Is Transcreen.
Only 1 of the 63 antivirus engines that checked it flagged this signed installer, while leading engines remained silent and the combined sandbox verdict found no high-risk…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 63 flagged
- Flagged 1
- No detection 62
- No result 12
- Code signing Shenzhen Photool Vision Technology Co., Ltd.
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The lone VBA32 detection is not corroborated by any leading engine, behavioral finding, or external intelligence source. The valid publisher signature and clean combined sandbox verdict strongly indicate that the Dapato label is a false positive, although the publisher has no established history in our records.
Only 1 of the 63 antivirus engines that checked it flagged the installer, and that result came from a less reliable engine while all leading engines remained silent. The file carries a valid signature claiming Shenzhen Photool Vision Technology Co., Ltd., though that publisher has no established history in our records. The combined sandbox verdict was clean and recorded no named injection target or other high-risk technique. The mapping lacks the artifact needed to establish process injection and therefore carries no adverse weight. No malware-specific community rules, public sample-database listing, malicious child, or other independent evidence corroborates VBA32's Dapato label.
What We Detected
Only 1 of the 63 antivirus engines that checked it flagged the installer. VBA32 applied the label BScope.TrojanDropper.Dapato, but no leading engine or second independent detector supported it.
Threat Behavior
The combined sandbox verdict was clean, with no named process-injection target and no high-risk technique recorded. A T1055 mapping appeared without evidence identifying an injected process, so it does not demonstrate process injection. No sample network contacts were recorded, although a complete host-reputation cross-check was not available.
What To Do Now
The evidence strongly favors an isolated antivirus false positive. Obtain the installer from the expected vendor or distribution channel, verify that the publisher signature remains valid, and keep security software enabled during installation.
Where this verdict could be wrong3 caveats
- VBA32 labels the installer BScope.TrojanDropper.Dapato, although no other engine supports that detection.
- The publisher signature is valid, but there is no established signer history or curated publisher match.
- Our own static analysis was not available, so the installer contents were not independently inspected by that method.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No leading antivirus engine flagged the file.
- The installer has a valid signature claiming Shenzhen Photool Vision Technology Co., Ltd.
- The combined sandbox verdict was clean and recorded no named injection target.
- No malware-specific community rules or public malware-sample database listing matched the hash.
- No inspected file it created carried a malicious or suspicious result.
- VBA32 labels the installer as a Dapato trojan dropper.
- The valid publisher signature has no established history in our records.
- Our own static inspection of the installer bytes was not available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 5sandbox rule tags
- 3spawned processes
- 0network contacts
- 22filesystem & mutex artifacts
Includes the sandbox verdicts, 5 mapped techniques, every process, file, registry and network entry and 1 dropped file.
Show the technical evidenceChapter 04
Technical details
1 of the 63 antivirus engines that checked it flags it; signed by Shenzhen Photool Vision Technology Co., Ltd..
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- VBA32BScope.TrojanDropper.Dapato
File fingerprint
- Last analyzed
- Oct 23, 2026, 7:12 AM UTC
- SHA-256
5c66e09cbca126dd02bbf680314a573f48274c11c47b0a291cb2f23c723e96bf- SHA-1
a196dfb73a5e0db23a872a5e03f5ca6bbd875866- MD5
ac6a10718f2d8c79ac5c8780e88161c6
About this file
Transcreen.msi is a Windows Installer file of 15.8 MB.
- Type and size
- Windows Installer · 15.8 MB
- Signer
- Shenzhen Photool Vision Technology Co., Ltd.Valid code signature.
- First seen
- Jul 29, 2026On VirusTotal.
- Submitted by
- 13 distinct sources
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is Transcreen.msi safe?
What is Transcreen.msi?
How many antivirus engines detected Transcreen.msi?
Is Transcreen.msi digitally signed?
What is the SHA-256 hash of Transcreen.msi?
Is it safe to install Transcreen.msi?
How up to date is this analysis of Transcreen.msi?
Community
Member reviews and reports for this exact file hash.