File scan report
Verdict Malicious
Is Super Minecraft Galaxy.
Four major antivirus engines joined ten other independent detections, while the combined sandbox verdict identified malware and no verified publisher supports the executable.
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already ran it, follow the steps below.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't run it
Don't run this file. Delete it, then empty the Recycle Bin.
If you already ran it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
If you typed passwords on the device after running it, change them from another device you trust.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
14 of 71 flagged
- Flagged 14
- No detection 57
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 7d ago
Chapter 02
Why we think so
4 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The executable was flagged by 14 of the 71 antivirus engines that checked it, including Microsoft, Sophos, Symantec, and TrellixENS. The combined sandbox verdict identified malware without a conflicting clean verdict, and the file is unsigned, rarely submitted, and first seen on Oct 25, 2026.
Four major antivirus engines and ten other independent detectors flagged the executable, providing stronger evidence than an isolated generic alert. The labels differ and do not establish a reliable malware family, so the family remains unidentified. The file is unsigned and has only two known submitters, leaving no publisher or distribution history to offset those findings. The and mappings are not counted against the file because no corresponding injection target or defence-tampering artefact was recorded.
What We Detected
Fourteen of the 71 antivirus engines that checked it flagged the executable. Microsoft, Sophos, Symantec, and TrellixENS were among the four major detectors, while the remaining alerts came from several other independent engines. Their labels are mostly generic or machine-learning based and do not establish one dependable malware family.
Threat Behavior
The combined sandbox verdict identified malware, with no conflicting clean sandbox verdict recorded. The sandbox also mapped T1055 and T1562.001, but it did not record a named injection target or the artefacts needed to substantiate those mappings, so they are not treated as proof of process injection or security tampering. The inspected contacts did not match known malicious or suspicious hosts.
What To Do Now
Do not run the executable. Keep security software enabled, quarantine or remove the file, and obtain the software only from a verified official release channel if it is still needed.
Where this verdict could be wrong4 caveats
- Fourteen major antivirus engines did not flag the file, and the detecting engines did not agree on a specific malware family.
- No malicious or suspicious host appeared among the five inspected contacts.
- The antivirus analysis found no packer or high-entropy code, and no named process-injection target was recorded.
- Two of five files sharing the import-table fingerprint previously received benign assessments, although the differing publishers make those matches weak.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Fourteen major antivirus engines did not flag the file.
- The five inspected contacts had no known malicious or suspicious matches.
- No packing or high-entropy code was identified.
- No named process-injection target was recorded.
- Fourteen of the 71 antivirus engines that checked it flagged the executable, including four major antivirus engines.
- The combined sandbox verdict identified malware and had no conflicting clean result.
- The executable has no digital signature identifying a publisher.
- Only two submitters are recorded, and the file was first seen on Oct 25, 2026.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; 1 test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 26sandbox rule tags
- 2spawned processes
- 3network contacts
- 24filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Downloaded a file during the test run.
Moderate concern: Checked whether it was running on a test computer.
Note: Read the user name of the test computer.
Note: Listed the programs running on the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as setting up auto-start; no auto-start entry was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
Super Minecraft Galaxy.exe
60f1160e878efe057a7154d5c89e8f9dd2ea947bebcd7cecc3bb1e6de0eb56a1
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
file.exe
"C:\Users\<USER>\Desktop\file.exe"
Test run - Evidence 3 of 7: ProcessSeen in the test run
program.exe
"C:\Users\user\Desktop\program.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
launcher.log
C:\Users\<USER>\AppData\Local\SuperMinecraftGalaxy\launcher.log
Test run - Evidence 5 of 7: Written fileSeen in the test run
BaseNamedObjects
\Sessions\1\BaseNamedObjects
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
150.171.110.195
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
23.217.78.102
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 26 mapped techniques, every process, file, registry and network entry and 1 dropped file.
Show the technical evidenceChapter 04
Technical details
14 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 14
- Microsoft (major engine)Trojan:Win32/Yomal!rfn
- Sophos (major engine)ML/PE-A
- Symantec (major engine)ML.Attribute.HighConfidence
- TrellixENS (major engine)Artemis!52BD27A33E5B
- Antiy-AVLGrayWare/Win32.Wacapew
- APEXMalicious
- BkavW32.Malware.2189B6AF
- CrowdStrikewin/malicious_confidence_90% (W)
File fingerprint
- Last analyzed
- Nov 1, 2026, 5:15 PM UTC
- SHA-256
60f1160e878efe057a7154d5c89e8f9dd2ea947bebcd7cecc3bb1e6de0eb56a1- SHA-1
26eaf8805081618033dae78f361999b735497a03- MD5
52bd27a33e5be3d1a04996d06fb179c9
About this file
Super Minecraft Galaxy.exe is a Win32 EXE file of 48.1 kB.
- Claims to be
- Super Minecraft GalaxyFrom the file's own version information, written by whoever built it.
- Original name
- Super Minecraft Galaxy.exeMatches the shared file name.
- Type and size
- Win32 EXE · 48.1 kB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 25, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.45 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is Super Minecraft Galaxy.exe a virus?
What is Super Minecraft Galaxy.exe?
How many antivirus engines detected Super Minecraft Galaxy.exe?
What should I do if I already ran Super Minecraft Galaxy.exe?
How do I remove Super Minecraft Galaxy.exe?
What kind of malware is Super Minecraft Galaxy.exe?
What is the SHA-256 hash of Super Minecraft Galaxy.exe?
How up to date is this analysis of Super Minecraft Galaxy.exe?
Community
Member reviews and reports for this exact file hash.