File scan report
Verdict Malicious
Is PO-
Eleven of the 61 antivirus engines that checked it flagged this ARJ attachment, with four major detections including Kaspersky’s Androm backdoor identification.
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already opened it, follow the steps below.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't opened it
Don't open this file. Delete it, then empty the Recycle Bin or Trash.
If you already opened it
Disconnect the device from the internet, then run a full scan with your security software.
If you typed passwords on the device after running it, change them from another device you trust.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall the operating system.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
11 of 61 flagged
- Flagged 11
- No detection 50
- No result 14
- Code signing Not applicable
- Test run Not run
- First seen 15d ago
Chapter 02
Why we think so
5 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The archive drew 11 detections among 75 engines, including four major antivirus engines and ten deduplicated detection sources. Kaspersky named the Androm backdoor, while TrendMicro identified a Nametrick pattern; behavior in the test run was not observed, so the archive should not be opened.
The principal evidence is 11 detections among 75 engines, including four major detections and ten deduplicated sources. Kaspersky specifically identifies an Androm backdoor, while TrendMicro identifies Nametrick and other engines report injector or generic trojan patterns. The labels are not fully consistent, so the exact family attribution is less certain than the harmful-file assessment. No completed sandbox run is available, and contacted-host reputation was not checked or saved, leaving runtime and network behavior unverified. The absence of MalwareBazaar and malware-specific YARAify matches is counter-evidence, but it is insufficient to offset the major detections.
What We Detected
Eleven of the 61 antivirus engines that checked it flagged the ARJ attachment. Four major antivirus engines detected it: Kaspersky reported an Androm backdoor, TrendMicro reported a Nametrick heuristic, Ikarus reported Win32.Outbreak, and Sophos reported generic malware. After related products were deduplicated, ten detection sources remained.
Threat Behavior
No completed sandbox observation is available, so execution, persistence, process activity, and network behavior were not observed. No complete contacted-host reputation result is available either. Static engine labels suggest a backdoor or injector delivered inside an attachment archive, but the exact family remains somewhat uncertain because the major labels differ.
What To Do Now
Do not open or extract the archive. Keep security software enabled, let your antivirus remove the file, and delete it unless it is required for an incident investigation. If it arrived by email, inspect the message and related mailboxes for matching attachments or sender infrastructure.
Where this verdict could be wrong3 caveats
- Most engines did not flag the archive, including BitDefender, ESET-NOD32, Fortinet, Avast, and Avira.
- The major antivirus engines do not show strong agreement on one family; major antivirus engines do not agree on one malware family.
- MalwareBazaar returned no match and YARAify returned zero malware-specific rules, although both can miss new or uncommon samples.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Most antivirus engines did not flag the archive.
- Several major engines, including BitDefender, ESET-NOD32, Fortinet, Avast, and Avira, reported no detection.
- Researcher-curated malware databases and rules supplied no corroborating match.
- Eleven antivirus engines flagged the archive, including four major antivirus engines.
- Kaspersky identified an Androm backdoor, and TrendMicro identified a Nametrick pattern.
- Ten deduplicated detection sources indicate the findings are not confined to one shared scanning technology.
- The file is an attachment-style archive, a format that can conceal an executable payload.
- No the test run is available to determine the archive's full behavior.
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
No completed test run is saved for this file.
Threat context
How remote-access malware works
This opens a secret way into the computer. Once it runs, an attacker can control the PC from anywhere: see the screen, read files, install more malware or use the machine to attack others.
Bottom line:It is built to stay hidden and keep that connection open for as long as possible.
Chapter 04
Technical details
11 of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 11
- Ikarus (major engine)Win32.Outbreak
- Kaspersky (major engine)UDS:Backdoor.Win32.Androm.gen
- Sophos (major engine)Mal/Generic-S
- TrellixENS (major engine)Artemis!9F8B1D7BBF0C
- TrendMicro (major engine)HEUR_NAMETRICK.D
- TrendMicro-HouseCall (major engine)HEUR_NAMETRICK.D
- huorongTrojan/Injector.bud
- RisingTrojan.Injector!8.C4 (CLOUD)
File fingerprint
- Last analyzed
- Oct 12, 2026, 4:30 AM UTC
- SHA-256
6a43f55478af17ab826462f0e9d7f2fbe68d9f4c298bd43416f8c881178478a4- SHA-1
06ca51b9f29a01627ee1a5c995086311cab9cc2f- MD5
a2eebf5e686912597439111a3b1b9090
About this file
PO-086979-CIF-012-2026-Supply.arj is an ARJ file of 319.4 kB.
- Type and size
- ARJ · 319.4 kB
- Signer
- Not applicable
- First seen
- Oct 11, 2026On VirusTotal.
- Submitted by
- 8 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is PO-086979-CIF-012-2026-Supply.arj a virus?
What is PO-086979-CIF-012-2026-Supply.arj?
How many antivirus engines detected PO-086979-CIF-012-2026-Supply.arj?
What should I do if I already opened PO-086979-CIF-012-2026-Supply.arj?
How do I remove PO-086979-CIF-012-2026-Supply.arj?
What kind of malware is PO-086979-CIF-012-2026-Supply.arj?
What is the SHA-256 hash of PO-086979-CIF-012-2026-Supply.arj?
How up to date is this analysis of PO-086979-CIF-012-2026-Supply.arj?
Community
Member reviews and reports for this exact file hash.