File scan report
Verdict Suspicious
Is Invitation.
An unsigned, installer named like an invitation that silently installs the FleetDeck remote-access agent, flagged by 22 of the 71 antivirus engines that checked it including five…
Read the whole reasonShow less
Why Suspicious? 22 antivirus engines flag it and one of our detection rules matched it.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
Do not run this file unless your own IT team confirmed sending it; if it already ran, remove the FleetDeck Agent and scan the system with protection enabled.
What to do now5 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
It is only 3 days old. If you're unsure, scan it again in a few days; antivirus engines often catch up on new files.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
22 of 71 flagged
- Flagged 22
- No detection 49
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 3d ago
Chapter 02
Why we think so
5 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This program installs the FleetDeck remote-management agent, which gives someone remote control of the computer. Engines such as ESET and Kaspersky label it a remote-admin tool, and the invitation-style name on an unsigned, file matches how attackers trick people into installing remote-access software.
22 of the 71 antivirus engines that checked it flagged the file, with five major antivirus engines among them, and most labels name a remote-administration tool rather than a specific malware family. In the sandbox it installed the FleetDeck Agent service, contacted the FleetDeck update server, made the service run in Safe Mode with networking, and managed it through hidden PowerShell windows. Those actions are what the legitimate remote-access product does, but they also hand full remote control to whoever owns the account the agent reports to. The file is unsigned, seen by only one submitter, and named like an invitation, a common lure for tricking users into installing remote-access tools. No malicious hosts, injection targets or malicious dropped files were found, so the evidence points to a risky remote-access installer rather than conventional malware.
What We Detected
22 of the 71 antivirus engines that checked it flagged this unsigned program. ESET, Kaspersky, Webroot, AhnLab and K7 describe it as a FleetDeck remote-administration tool or unwanted program, while DrWeb, Avast/AVG and Symantec use generic trojan or reputation labels. It is and rare.
Threat Behavior
When run, it installs the FleetDeck Agent service and connects to FleetDeck's update server. It registers the service to start even in Safe Mode with networking and uses hidden PowerShell windows to restart the service and adjust a firewall rule. No code injection into other processes and no malicious network hosts were recorded. The practical risk is remote control of the PC by whoever sent the file.
What To Do Now
If you did not knowingly request remote support from a trusted IT provider, do not run it. If it already ran, uninstall the FleetDeck Agent, disconnect from the network, run a full scan with your security software kept enabled, and change passwords from another device.
Where this verdict could be wrong2 caveats
- FleetDeck is a commercial remote-management product, and several engines label it as potentially unwanted rather than a trojan, so an administrator deploying it on purpose would see the same behaviour.
- No malicious contacted hosts, no malicious dropped files and no injection target were recorded.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No contacted host is known to be malicious
- No injection into other processes was recorded
- Behaviour matches the commercial FleetDeck product rather than a custom payload
- Installs a remote-access agent that gives another party control of the computer
- Invitation-style file name on an unsigned, program, a common lure for remote-access abuse
- Five major antivirus engines flag the file, including remote-admin and trojan labels
- Registers its service to run in Safe Mode with networking
- Runs PowerShell in hidden windows to manage the service
7 sources checked · 6 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 31sandbox rule tags
- 6spawned processes
- 2network contacts
- 13filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Downloaded a file during the test run.
Moderate concern: Stopped a service or program on the test computer.
Note: Read the user name of the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Talked to servers over the internet during the test run.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as creating a service; no new service was recorded.
Not confirmed: A sandbox rule tagged this run as setting up auto-start; no auto-start entry was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
Invitation.exe
630665bfd44ee182c387145e674f7a46628f80d4f83f2eeb4ad41072c9e65c9d
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
powershell.exe
C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " Restart-Service 'FleetDeck Agent Service' "
Test run - Evidence 3 of 7: ProcessSeen in the test run
powershell.exe
C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " $s=Get-Service 'FleetDeck Agent Service' if($s.Status -eq 'Running') { $s.Stop() if ($?) { $s.WaitForStatus('Stopped') } } while('True') { Move-Item -Force 'C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent_svc.exe' -Destination 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -ErrorVariable err if(!$err) { break } Start-Sleep -s 1 } $s.Start() "
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
FleetDeck Agent Installer.log
C:\Users\<USER>\AppData\Local\Temp\FleetDeck\FleetDeck Agent Installer.log
Test run - Evidence 5 of 7: Written fileSeen in the test run
2759704230.msi
C:\Users\<USER>\AppData\Local\Temp\2759704230.msi
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
agentupdate.fleetdeck.io
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
99.86.101.86
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes 31 mapped techniques, every process, file, registry and network entry and 7 dropped files.
Show the technical evidenceChapter 04
Technical details
22 of the 71 antivirus engines that checked it flag it; no publisher signature.
No risky structure found
We opened the uploaded Windows program in an isolated sandbox and read its structure without running it.
12 links found. Only domains are shown; paths and query strings are never published.
Checked on Oct 22, 2026 while the file was uploaded. MalwareTips deleted its copy afterwards; VirusTotal keeps the uploaded file.
Sources checked
Every check behind this verdict
7 sources checked · 6 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 22
- Avast (major engine)FileRepMalware [Misc]
- AVG (major engine)FileRepMalware [Misc]
- DrWeb (major engine)Trojan.Siggen36.24563
- ESET-NOD32 (major engine)WinGo/RemoteAdmin.FleetDeck.A potentially unsafe application
- Kaspersky (major engine)not-a-virus:HEUR:RemoteAdmin.Win32.Convagent.gen
- Symantec (major engine)ML.Attribute.HighConfidence
- AhnLab-V3Unwanted/Win.RemoteAdmin.R799664
- APEXMalicious
File fingerprint
- Last analyzed
- Oct 22, 2026, 6:05 PM UTC
- SHA-256
630665bfd44ee182c387145e674f7a46628f80d4f83f2eeb4ad41072c9e65c9d- SHA-1
07d5f32a0e6889aba54c269a532ed23cbd84988e- MD5
be0f8fa8b112f417af278432ea1560bb
About this file
Invitation.exe says it is FleetDeck Agent, 4.4 MB.
- Claims to be
- FleetDeck AgentFrom the file's own version information, written by whoever built it.
- Original name
- fleetdeck_installerWorth noting: Differs from the name it was shared under.
- Type and size
- Win32 EXE · 4.4 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 22, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 7.09 of 8
First scanned
Includes every engine result (75), 2 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Invitation.exe safe, or is it malware?
What is Invitation.exe?
How many antivirus engines detected Invitation.exe?
What should I do if I already ran Invitation.exe?
What is the SHA-256 hash of Invitation.exe?
How up to date is this analysis of Invitation.exe?
Community
Member reviews and reports for this exact file hash.