MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Safe

Unsigned media player exe flagged only by low-trust engines; all tier-1 engines clean, behaviour shows benign CDN contacts and no offensive actions.

Trust score82Moderate trust
MT AI confidence · 80%
Player (1).exe
153.5 KB
62917efbf880f3b23a…dd71a5f9d7
Antivirus engines
3 of 76 flagged
Code signing
Unsigned
Age
First seen 1y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

80%Confidence
High
Reasoning

Dominant signal is low-trust-only flagging with full tier-1 consensus on clean. Unsigned status and rarity add caution, but zero offensive MITRE techniques, no malicious sandbox verdict, and CDN IP contacts outweigh the direct-IP heuristic. Dropped children unknown but not malicious. Overall FP shape prevails.

Key signals · 4

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. 3/72 engines malicious, tier1Malicious=0, onlyLowTrustFlagging=true

  2. contactedIps includes CDN IPs (20.69.140.28 Azure, 23.196.193.245 Fastly) via behaviour.contactedIps

  3. triggeredHeuristics 'MalwareTips.Synth.DirectIpC2' fired but no offensiveTechniques

  4. tier1FamilyConsensus.family=null, agreeingEngines=0

Points in its favour
  • tier1Malicious=0, 17 tier1 clean
  • offensiveCount=0, no malicious sandbox
  • no malicious contacted hosts or children
  • no externalIntel or YARAify hits
Points against
  • unsigned executable
  • rare_old prevalence (3 submissions)
  • direct IP contacts (6 IPs, no DNS)
  • generic filename 'Player (1).exe'
  • reputation score 0
  • dropped children unknown
What to do

This file is safe based on our analysis. Run it if trusted source, but scan with updated security software and observe network activity.

Sources disagree

1 contradiction resolved by the scoring engine

Only low-trust / heuristic engines flagged this file
3 engines from the heuristic / generic-AI set flagged it. No tier-1 engine agreed.
Verdict treated these as likely false positives.
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
15

Adversary techniques mapped to the MITRE ATT&CK framework.

T1018T1027T1056.001T1057T1059T1063T1070.004T1071T1082T1095T1129T1202T1518.001T1573T1574.002
Spawned processes
13
$(unnamed)
"C:\Users\<USER>\Desktop\Player.exe"
$(unnamed)
C:\Windows\system32\cmd.exe /c cls
$(unnamed)
%SAMPLEPATH%\Player.exe
$(unnamed)
C:\Windows\System32\UI0Detect.exe
$(unnamed)
C:\Program Files\Google2344_802084169\bin\updater.exe
$(unnamed)
"C:\Users\user\Desktop\Player.exe"
$(unnamed)
C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
$(unnamed)
C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
+5 more processes captured.
Network activity
7
IP addresses7
  • 192.168.0.15
  • 20.69.140.28
  • 23.196.193.245
  • 20.99.133.109
  • 184.27.218.92
  • 23.46.216.136
  • 23.48.99.4
Filesystem & mutexes
10
Files written8
  • C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView\Crashpad
  • C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView\Crashpad\attachments
  • C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView\Crashpad\reports
  • C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView\Default\Local Storage\leveldb\LOG
  • C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView\Default\Network\Cookies
+3 more
Mutexes created2
  • \Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex
  • \Sessions\1\BaseNamedObjects\mfx_d3d_mutex
Dropped payload

Files this sample writes at runtime

This file drops 2 children at runtime. None are currently flagged malicious in our cache.

2 unseen
  • 4f53cda18c2baa0c0354…02b945Never scanned
    never seen before
  • 96ea12b4d524e56dd2a3…3f595eNever scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.

1 synthesis
MITRE ATT&CK profile
C2× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • DirectIpC2
    T1071
    medium

    Sample contacted 6 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    20.69.140.28 · 23.196.193.245 · 20.99.133.109
Antivirus engine breakdown

3 detections across 76 engines

3 malicious0 suspicious73 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-238 engines
0flag
Mainstream engines with mixed FP rates
Low-trust21 engines
3flag
Heuristic / generic-AI engines (high FP rate)
APEX
malicious
Malicious
Bkav
malicious
W64.AIDetectMalware
MaxSecure
malicious
Trojan.Malware.300983.susgen
Hash 62917efbf880… cross-referenced against 76 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

Unpacked
Section entropy6 sections
.text
6.31
.rdata
5.43
.data
3.84
.pdata
5.20
.rsrc
4.72
.reloc
3.82
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Rarely uploaded, but has been around for a while. Often niche legitimate software or old internal tooling; not a strong malware signal on its own.

Rare & old
Unique uploaders
3
Very few people have ever uploaded this — rare.
Total submissions
3
Includes repeat uploads by the same source.
First seen by VT
1y ago
May 20, 2025
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
here
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
5/20/2025, 10:18:52 PM
First seen (MalwareBazaar)
—
Last analysis (VT)
6/26/2025, 12:04:13 AM
Scanned here
5/9/2026, 11:50:27 PM
File name
Player (1).exe
Size
153.5 KB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
62917efbf880f3b23a563ee2445fc6334b73265f00d0e651d6b239dd71a5f9d7
MD5
3c81c3788e4b403b706ddb0a4dfbde95
SHA-1
debabe600b93d3f9a3970f240136dbca648870b5
PE imphash
f89c2f3bdca8cfb6a2e03d3121b871bc
First seen (VT)
5/20/2025, 10:18:52 PM
Last analysis (VT)
6/26/2025, 12:04:13 AM
First scan (MalwareTips)
5/9/2026, 11:50:27 PM
Last scan (MalwareTips)
5/9/2026, 11:50:27 PM
Behavior tags
64bitsdetect-debug-environmentpeexe
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.