File scan report
Verdict Safe
Is sora_
None of the 70 antivirus engines that checked it flagged this unsigned 64-bit Windows program, and its sandbox run showed no high-risk techniques, though a community note raises…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Use this program only if you obtained it from its official source, and keep your antivirus protection enabled. Rescan it if it behaves unexpectedly.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The sandbox run returned clean with no injection, persistence or suspicious network activity. The file is unsigned, and a community note lists unconfirmed malware rule tags, so download it only from a source you trust.
None of the 70 antivirus engines that checked it flagged the file, and every major antivirus engine that reported on it found nothing. The combined sandbox summary returned a clean result, with no injection targets, persistence or network contact beyond the analysis machine's background traffic. The program re-launched itself with install and load arguments, which is ordinary for a setup-style tool. It has been submitted by 137 separate sources over about two months and shows no packing. The main caveats are the missing code signature and a community comment listing malware-related rule tags, which nothing else in the evidence supports.
What We Detected
None of the 70 antivirus engines that checked it flagged this 64-bit Windows executable, including all 18 major antivirus engines. The file is unsigned and shows no packing or obfuscated code. It has been seen from 137 different sources over roughly two months.
Threat Behavior
The sandbox run returned clean. The program started copies of itself with install and load arguments. It did not inject into other processes, create persistence, or make network contact beyond the analysis machine's own background traffic. A community comment lists rule tags naming several malware families, but no engine detection or rule database corroborates them. No complete host-reputation check is available.
What To Do Now
If you obtained this program from its official source, the evidence supports using it. Because it is unsigned, avoid copies from unknown sites, keep your antivirus enabled, and rescan if you see unexpected behaviour.
Where this verdict could be wrong3 caveats
- A community annotation lists YARA tags that reference ransomware and post-exploitation families. No engine detection or rule database confirms these tags, but they warrant caution.
- The file is unsigned, so no publisher identity backs it.
- No complete host-reputation check is available for the sandbox traffic.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it flagged the file
- All 18 major antivirus engines reported it clean
- The sandbox run returned clean, with no high-risk techniques
- Seen from 137 separate sources with no detections
- No packing or obfuscated code was found
- The program has no code signature, so its publisher cannot be verified
- A community comment lists malware-related rule tags that nothing else confirms
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 3sandbox rule tags
- 3spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
Includes the sandbox verdicts, 3 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 15, 2026, 9:30 PM UTC
- SHA-256
5dffbd40454953184c6af5e221614e5539369af3495970cfbdf2a412aa61433a- SHA-1
ec0069df68c7d5cebe15acf167bc175cbe860986- MD5
6144e476e84756f62381d2987a54474b
About this file
sora_1st.exe is a Win32 EXE file of 11.9 MB.
- Type and size
- Win32 EXE · 11.9 MB
- Signer
- UnsignedNo code signature.
- First seen
- Aug 18, 2026On VirusTotal.
- Submitted by
- 137 distinct sources
- Packer
- None detected
- Entropy
- 5.92 of 8
First scanned Updated
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is sora_1st.exe safe?
What is sora_1st.exe?
How many antivirus engines detected sora_1st.exe?
What is the SHA-256 hash of sora_1st.exe?
Is it safe to run sora_1st.exe?
How up to date is this analysis of sora_1st.exe?
Community
Member reviews and reports for this exact file hash.