File scan report
Verdict Safe
Is jilloff.
Zero detections across 76 engines on a 15-year-old unsigned executable with clean sandbox behaviour.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
The evidence supports treating the file as safe for normal use when the source is trusted.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 72 flagged
- Flagged 0
- No detection 72
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 15y ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No antivirus engine flagged the sample. Sandbox execution showed only background activity and no malicious files it created or host contacts. The single rule on direct-IP usage lacks supporting evidence from engines or behaviour verdicts.
All 72 antivirus engines that checked it returned clean results with zero major or less reliable malicious labels. The file is unsigned and carries a medium-severity rule for contacting IPs without DNS, yet sandbox runs produced no malicious verdicts and dropped no malicious files it created. Long file age and moderate prevalence further reduce risk. The rule alone does not override the complete absence of engine or behavioural malice signals.
What We Detected
76 engines scanned the file; none returned malicious, suspicious, or test-file labels. The sample is an unsigned Win32 EXE first seen in 2010.
Threat Behavior
Sandbox execution recorded 17 MITRE techniques common in legitimate software and 13 direct IP contacts with zero domains. No offensive techniques, no malicious sandbox verdict, and no malicious files it created were observed.
What To Do Now
The file presents low risk based on current evidence. Users may run it in a controlled environment if the source is trusted; otherwise treat as any unsigned executable.
Where this verdict could be wrong2 caveats
- Direct-IP contact without DNS could indicate evasion, yet no sandbox, engine, or file it created corroboration exists to elevate it.
- Unsigned status on a 15-year-old file is unusual for legitimate commercial software but common for older shareware or internal tools.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero engine detections across 76 scanners
- Clean sandbox verdict
- No malicious files it created
- Long file history (5687 days)
- Unsigned executable
- Direct IP contacts without DNS (rule only)
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 17sandbox rule tags
- 4spawned processes
- 3network contacts
- 25filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
17MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1027.005· Obfuscated code
- T1056.001· Keylogging
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1113
- T1115
- T1129· Loads modules
- T1497.001· Sandbox evasion
- T1564.003· Hides artifacts
- T1574.002· Execution hijack
- T1614
- T1614.001
Observed activity
Processes started
4Programs the file ran, with their command lines.
software.exe"C:\Users\<USER>\AppData\Local\Temp\software.exe"file.exe%SAMPLEPATH%\file.exe62c5a559f0ea7a5938ccd0396c754cebcf5a1e9e9983a62ab5c94fddd2a7c8cc.exe%SAMPLEPATH%\62c5a559f0ea7a5938ccd0396c754cebcf5a1e9e9983a62ab5c94fddd2a7c8cc.exefile.exeC:\Users\user\Desktop\file.exe
Network contacts
33 hosts, listed as 3 addresses. Links show the host and path only.
- IP address
104.96.203.51 - IP address
23.209.30.16 - IP address
96.7.158.45
Files
15Files the file created, changed or deleted.
- Written
C:\Documents and Settings\Administrator\Local Settings\Temp\gm_ttt_28564\D3DX8.dll - Written
C:\Users\<USER>\AppData\Local\Temp\gm_ttt_55444\D3DX8.dll - Written
C:\Users\<USER>\AppData\Local\Temp\gm_ttt_55444\a26369.mp3 - Written
C:\Users\<USER>\AppData\Local\Temp\gm_ttt_55444\a1996.mp3 - Written
C:\Users\user\AppData\Local\Temp\gm_ttt_85096 - Written
C:\Users\user\AppData\Local\Temp\gm_ttt_85096\D3DX8.dll
Show all 15 entries for files
- Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER602C.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6107.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6136.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER65BB.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER65BC.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER65CC.tmp.txt - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.h - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Registry and auto-start
2Settings the file changed, including ways to start again after a restart.
- Deleted
\REGISTRY\MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW\ - Deleted
\REGISTRY\MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW\DWFileTreeRoot
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
DDrawWindowListMutex__DDrawExclMode____DDrawCheckExclMode__DDrawDriverObjectListMutexCTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 10 entries for mutexes
CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
Sandbox background — not the file
13The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM host
204.79.197.203 - VM host
20.99.186.246 - VM host
192.229.211.108 - VM host
20.99.184.37 - VM host
20.99.185.48
Show all 13 entries for sandbox background — not the file
- VM host
20.99.133.109 - VM host
23.216.81.152 - VM host
131.253.33.203 - VM host
192.168.0.6 - VM host
52.185.73.156 - VM host
a83f:8110:0:0:0:0:1:0 - VM host
192.168.0.42
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 3 have no saved verdict and were not checked; that is missing coverage, not a finding.
- edfc5f86be36c2c509e4…2b076aNot checkedno saved verdict
- 8109b7c55610d9836514…7766bdNot checkedno saved verdict
- 7ecaa4e8095301c5357e…da239eNot checkedno saved verdict
Chapter 04
Technical details
None of the 72 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jul 22, 2026, 2:37 PM UTC
- SHA-256
62c5a559f0ea7a5938ccd0396c754cebcf5a1e9e9983a62ab5c94fddd2a7c8cc- SHA-1
7ef390ab6cb722025a76c18507ae914565ad4dc1- MD5
361ef67aa047cc20cfe16eeea2a6b25d
About this file
jilloff.exe is a Win32 EXE file of 14.6 MB.
- Type and size
- Win32 EXE · 14.6 MB
- Signer
- UnsignedNo code signature.
- First seen
- Dec 26, 2010On VirusTotal.
- Submitted by
- 33 distinct sources
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned Updated
Antivirus consensus
0 of 72 engines flagged this file
4 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust18 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is jilloff.exe safe?
What is jilloff.exe?
How many antivirus engines detected jilloff.exe?
What is the SHA-256 hash of jilloff.exe?
Is it safe to run jilloff.exe?
How up to date is this analysis of jilloff.exe?
Community
Member reviews and reports for this exact file hash.