File scan report
Verdict Safe
Is Coco-
No engines flagged the file and sandbox behaviour shows only benign activity.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 4y ago
Chapter 02
Why we think so
0 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Zero detections across 75 engines, no offensive techniques observed, and medium prevalence over four years support a clean classification.
All 75 reporting engines returned clean results, including 17 major antivirus engines. The unsigned status is neutral for a file with no detections and no brand-mismatch claims. Sandbox execution recorded only techniques common in legitimate software and no malicious verdict. Medium prevalence and long history without similar-hash matches further reduce risk.
What We Detected
75 antivirus engines scanned the sample; none returned a malicious or suspicious result. The file is an unsigned 64-bit Windows executable first seen in 2022 with medium prevalence.
Threat Behavior
One sandbox execution recorded eight MITRE techniques common in legitimate software and no offensive techniques. No domains were contacted; a single IPv6 address was reached, but host-reputation coverage is unavailable. No files it created or persistence indicators were observed.
What To Do Now
The file can be considered safe for normal use. Keep security software enabled and avoid running unsigned executables from untrusted sources as a general precaution.
Where this verdict could be wrong1 caveat
- contactedHosts is null — host-reputation cross-check was not completed, so the single IPv6 contact cannot be confirmed clean or malicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero malicious detections across 75 reporting engines
- No offensive MITRE techniques observed
- Medium prevalence with long clean history
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 8sandbox rule tags
- 2spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
8MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1056.001· Keylogging
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1095· Custom network
- T1497· Sandbox evasion
- T1518· Checks your AV
Observed activity
Processes started
2Programs the file ran, with their command lines.
executable.exe"C:\Users\<USER>\Desktop\executable.exe"Coco-External.exe%SAMPLEPATH%\Coco-External.exe
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
a83f:8110:2a04:0:602a:400:b0:2b04
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Aug 25, 2026, 9:43 PM UTC
- SHA-256
6a51af4af8817fd837d95bdf97ec6f76c25fcc00abcee3c11fa5810e38d78490- SHA-1
953178868e49d00a897f85e85dea4a9f50dcf55f- MD5
8f9a7cfed21157062ea9df52efe2a49a
About this file
Coco-External.exe is a Win32 EXE file of 162.3 kB.
- Type and size
- Win32 EXE · 162.3 kB
- Signer
- UnsignedNo code signature.
- First seen
- Feb 17, 2022On VirusTotal.
- Submitted by
- 27 distinct sources
- Packer
- None detected
- Entropy
- 4.63 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Coco-External.exe safe?
What is Coco-External.exe?
How many antivirus engines detected Coco-External.exe?
What is the SHA-256 hash of Coco-External.exe?
Is it safe to run Coco-External.exe?
How up to date is this analysis of Coco-External.exe?
Community
Member reviews and reports for this exact file hash.