File scan report
Verdict Safe
Is Bookworm-
Only Kingsoft flagged this longstanding, widely submitted archive, while major antivirus engines, sandbox verdicts, file it created checks, and researcher intelligence supplied…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 8
- Code signing Not applicable
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
One of the 66 antivirus engines that checked it flagged the archive with a generic label, while no major antivirus engines detected it. Its long circulation history and lack of corroboration support a likely isolated false positive, although direct-IP traffic and justify obtaining the game from a reputable source.
The archive received one generic Kingsoft detection among 74 engines, with no major detections or family consensus. It has circulated for more than three years across 159 sources and 173 submissions, which weighs against a newly distributed threat. One completed sandbox run did not produce a malicious conclusion, and no inspected child was identified as malicious. However, evidence from the test run included and two direct-IP contacts, and no complete host-reputation result is available for those addresses. No CIRCL, MalwareBazaar, or YARAify corroboration was present, making the lone detection most consistent with a false positive.
What We Detected
Kingsoft was the only engine among 74 to flag the archive, using the generic label “malware.kb.a.750.” No major antivirus engines detected it, and there was no shared malware-family identification. The archive has been observed for 1244 days across 159 sources and 173 submissions.
Threat Behavior
One sandbox run recorded T1562.001 and connections to 13.107.6.158 and 23.209.116.41, but it did not produce a malicious sandbox conclusion. Because contactedHosts is unavailable, those IP addresses do not have a complete saved reputation cross-check. Ten children were inspected without a malicious child finding, although their individual verdicts remain unknown. Researcher intelligence supplied no CIRCL, MalwareBazaar, or YARAify hit.
What To Do Now
Prefer an authorized or otherwise reputable distribution source and scan the extracted executable before launching it. Keep security software enabled, especially because repackaged game archives can be modified independently of the original software.
Where this verdict could be wrong3 caveats
- The sandbox's offensive-technique list includes T1562.001, an impairment-of-defenses technique that warrants caution despite the absence of a malicious sandbox conclusion.
- One of our behaviour rules fired after contacts to 13.107.6.158 and 23.209.116.41; the missing contacted-host reputation result means no complete host-reputation result is available.
- The 10 files it created have unknown individual verdicts, so the absence of a known-malicious dropped file does not establish that every extracted component is benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No major antivirus engines detected the archive.
- Only 1/66 engines reported a malicious result.
- The file has 1244 days of history across 159 unique sources.
- No sandbox returned a malicious verdict.
- No CIRCL, MalwareBazaar, or YARAify hit was present.
- Kingsoft supplied the sole generic detection among 74 engines.
- appeared in the completed sandbox observation.
- Direct-IP contacts were observed without a complete saved host-reputation cross-check.
- All 10 extracted children have unknown individual verdicts.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 7sandbox rule tags
- 5spawned processes
- 2network contacts
- 19filesystem & mutex artifacts
Includes 7 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The Safe verdict weighed these detections and treats them as non-decisive.
- Kingsoftmalware.kb.a.750
File fingerprint
- Last analyzed
- Sep 12, 2026, 5:08 AM UTC
- SHA-256
6e3af053485c794ce6bbc6c779396b6088b0002c0aff0de635119126a062e708- SHA-1
eac131a21b58ee18af7737b75e13f8e0e2cc8222- MD5
33e70625b3a7c2105693aec3db470bba
About this file
Bookworm-Adventures_Win_EN_Rip.zip is a ZIP file of 22.1 MB.
- Type and size
- ZIP · 22.1 MB
- Signer
- Not applicable
- First seen
- Apr 16, 2023On VirusTotal.
- Submitted by
- 159 distinct sources
First scanned
Includes every engine result (74) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Bookworm-Adventures_Win_EN_Rip.zip safe?
What is Bookworm-Adventures_Win_EN_Rip.zip?
How many antivirus engines detected Bookworm-Adventures_Win_EN_Rip.zip?
What is the SHA-256 hash of Bookworm-Adventures_Win_EN_Rip.zip?
Is it safe to open or extract Bookworm-Adventures_Win_EN_Rip.zip?
How up to date is this analysis of Bookworm-Adventures_Win_EN_Rip.zip?
Community
Member reviews and reports for this exact file hash.