File scan report
Verdict Safe
Is Aav_
All 62 antivirus engines that checked it were free of detections, including 17 major antivirus engines, and the installer has been observed since 2011.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 62 flagged
- Flagged 0
- No detection 62
- No result 14
- Code signing Unsigned
- Test run Completed
- First seen 15y ago
Chapter 02
Why we think so
4 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
One sandbox mapped activity to and recorded a direct-IP contact, but produced no malicious runtime verdict; the unsigned package should still be sourced and verified carefully.
The strongest evidence is the absence of detections across 76 antivirus engines, including no alerts from 17 major antivirus engines. The file has also been observed for more than 15 years across 69 sources and 80 submissions, making an undiscovered widespread threat less likely. One completed sandbox run recorded and mappings, but it did not issue a malicious verdict, and no inspected child was identified as malware. Research feeds supplied no family, signature, or YARA corroboration. Confidence is reduced because the MSI is unsigned, every file it created remains unclassified, and no complete saved host-reputation check exists for the contacted IP.
What We Detected
No detections were reported among 76 antivirus engines, and all 17 reporting major antivirus engines were free of alerts. The MSI has been observed since 2011, with 69 sources and 80 submissions, and no matching malware family was supplied by the available research feeds.
Threat Behavior
One completed sandbox run mapped activity to T1055 and T1485 and recorded contact with 142.251.183.94. These mappings can be concerning, but the sandbox did not issue a malicious verdict, no persistence indicator was recorded, and none of the 10 inspected children was identified as malicious. However, those children remain unclassified, and no complete saved host-reputation result is available for the contacted IP.
What To Do Now
Use the installer only if it came from the developer or another trusted distribution channel. Because the package is unsigned, verify its SHA-256 value, keep security software enabled, and avoid installation if its origin cannot be established.
Where this verdict could be wrong4 caveats
- The installer is unsigned: code signing applies to this file type and the file is unsigned, so publisher identity cannot be authenticated.
- One of our behaviour rules fired from a mapping, and was also recorded; neither technique was corroborated by an explicit malicious sandbox verdict.
- One of our behaviour rules fired for 142.251.183.94, but the missing contacted-host reputation result means the address did not receive a complete saved reputation cross-check.
- All 10 inspected files it created have unknown verdicts, so the absence of a known-malicious dropped file is not equivalent to confirmed-clean files it created.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/62 antivirus engines detected the file
- No malicious sandbox verdict
- No inspected child identified as malicious
- Observed since 2011 across 69 sources and 80 submissions
- Unsigned Windows Installer despite signing being applicable
- Sandbox mapped possible process injection to T1055
- Sandbox recorded T1485
- Direct-IP contact to 142.251.183.94 lacks a complete saved host-reputation check
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 1spawned processes
- 1network contact
- 39filesystem & mutex artifacts
Includes 12 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 62 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 8, 2026, 2:57 PM UTC
- SHA-256
6208766af9251cac1764a0e62ed3a8d19878251f287aea1fea8e5b91dddd939f- SHA-1
08cc1d005654ff7f2e8c4194bceb39499ea093eb- MD5
4a3bd47f8a08551ad35f5de566c3b4cc
About this file
Aav_ColorLab_1_0_rc2_x64.msi is a Windows Installer file of 2.3 MB.
- Type and size
- Windows Installer · 2.3 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 24, 2011On VirusTotal.
- Submitted by
- 69 distinct sources
First scanned
Includes every engine result (76), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Aav_ColorLab_1_0_rc2_x64.msi safe?
What is Aav_ColorLab_1_0_rc2_x64.msi?
How many antivirus engines detected Aav_ColorLab_1_0_rc2_x64.msi?
What is the SHA-256 hash of Aav_ColorLab_1_0_rc2_x64.msi?
Is it safe to install Aav_ColorLab_1_0_rc2_x64.msi?
How up to date is this analysis of Aav_ColorLab_1_0_rc2_x64.msi?
Community
Member reviews and reports for this exact file hash.