File scan report
Verdict Safe
Is Bookworm-
Only Kingsoft flagged this longstanding, widely submitted archive, while major antivirus engines, sandbox verdicts, file it created checks, and researcher intelligence supplied…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 8
- Code signing Not applicable
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
One of the 66 antivirus engines that checked it flagged the archive with a generic label, while no major antivirus engines detected it. Its long circulation history and lack of corroboration support a likely isolated false positive, although direct-IP traffic and justify obtaining the game from a reputable source.
The archive received one generic Kingsoft detection among 74 engines, with no major detections or family consensus. It has circulated for more than three years across 159 sources and 173 submissions, which weighs against a newly distributed threat. One completed sandbox run did not produce a malicious conclusion, and no inspected child was identified as malicious. However, evidence from the test run included and two direct-IP contacts, and no complete host-reputation result is available for those addresses. No CIRCL, MalwareBazaar, or YARAify corroboration was present, making the lone detection most consistent with a false positive.
What We Detected
Kingsoft was the only engine among 74 to flag the archive, using the generic label “malware.kb.a.750.” No major antivirus engines detected it, and there was no shared malware-family identification. The archive has been observed for 1244 days across 159 sources and 173 submissions.
Threat Behavior
One sandbox run recorded T1562.001 and connections to 13.107.6.158 and 23.209.116.41, but it did not produce a malicious sandbox conclusion. Because contactedHosts is unavailable, those IP addresses do not have a complete saved reputation cross-check. Ten children were inspected without a malicious child finding, although their individual verdicts remain unknown. Researcher intelligence supplied no CIRCL, MalwareBazaar, or YARAify hit.
What To Do Now
Prefer an authorized or otherwise reputable distribution source and scan the extracted executable before launching it. Keep security software enabled, especially because repackaged game archives can be modified independently of the original software.
Where this verdict could be wrong3 caveats
- The sandbox's offensive-technique list includes T1562.001, an impairment-of-defenses technique that warrants caution despite the absence of a malicious sandbox conclusion.
- One of our behaviour rules fired after contacts to 13.107.6.158 and 23.209.116.41; the missing contacted-host reputation result means no complete host-reputation result is available.
- The 10 files it created have unknown individual verdicts, so the absence of a known-malicious dropped file does not establish that every extracted component is benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No major antivirus engines detected the archive.
- Only 1/66 engines reported a malicious result.
- The file has 1244 days of history across 159 unique sources.
- No sandbox returned a malicious verdict.
- No CIRCL, MalwareBazaar, or YARAify hit was present.
- Kingsoft supplied the sole generic detection among 74 engines.
- appeared in the completed sandbox observation.
- Direct-IP contacts were observed without a complete saved host-reputation cross-check.
- All 10 extracted children have unknown individual verdicts.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 7sandbox rule tags
- 5spawned processes
- 2network contacts
- 19filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
7MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1056· Keylogging
- T1071· Application protocol
- T1082· System recon
- T1497· Sandbox evasion
- T1562.001· Disables security
Observed activity
Processes started
5Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Bookworm Adventures Deluxe/bass.dll",#1BookwormAdventures.exe"C:\Users\<USER>\AppData\Local\Temp\Bookworm Adventures Deluxe/BookwormAdventures.exe"rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Bookworm Adventures Deluxe/j2k-codec.dll",#1PopUninstall.exe"C:\Users\<USER>\AppData\Local\Temp\Bookworm Adventures Deluxe/PopUninstall.exe"msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "C:\Users\<USER>\AppData\Local\Temp\Bookworm Adventures Deluxe/readme.html"
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
13.107.6.158 - IP address
23.209.116.41
Files
15Files the file created, changed or deleted.
- Written
C:\ProgramData - Written
C:\ProgramData\PopCap Games - Written
C:\ProgramData\PopCap Games\WinBAD - Written
C:\ProgramData\PopCap Games\WinBAD\ - Written
C:\Users\user\AppData\Local\Temp\bmgp3nsj.cow - Written
C:\Users\user\AppData\Local\Temp\bmgp3nsj.cow\Bookworm Adventures Deluxe
Show all 15 entries for files
- Written
C:\Users\user\AppData\Local\Temp\bmgp3nsj.cow\Bookworm Adventures Deluxe\BookwormAdventures.exe - Written
C:\Users\user\AppData\Local\Temp\bmgp3nsj.cow\Bookworm Adventures Deluxe\Flash.ocx - Written
C:\Users\user\AppData\Local\Temp\bmgp3nsj.cow\Bookworm Adventures Deluxe\Install.log - Written
C:\Users\user\AppData\Local\Temp\bmgp3nsj.cow\Bookworm Adventures Deluxe\Install_props.xml - Written
C:\Users\user\AppData\Local\Temp\bmgp3nsj.cow\Bookworm Adventures Deluxe\PopUninstall.exe - Written
C:\Users\user\AppData\Local\Temp\bmgp3nsj.cow\Bookworm Adventures Deluxe\bass.dll - Written
C:\Users\user\AppData\Local\Temp\bmgp3nsj.cow\Bookworm Adventures Deluxe\cdprops.xml - Written
C:\Users\user\AppData\Local\Temp\bmgp3nsj.cow\Bookworm Adventures Deluxe\images - Written
C:\Users\user\AppData\Local\Temp\bmgp3nsj.cow\Bookworm Adventures Deluxe\images\cutscenes
Mutexes
4Named locks a program uses so only one copy runs; malware families often reuse them.
Local\SM0:416:168:WilStaging_02Local\SM0:4816:168:WilStaging_02Local\SM0:1968:168:WilStaging_02Local\SM0:3420:168:WilStaging_02
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 5b98347cff356441e186…050875Not checkedno saved verdict
- 471643ea9df42cc16841…74e9c0Not checkedno saved verdict
- 3e28c08a043fd7ff6661…b563d8Not checkedno saved verdict
- a568a19a4ef440bc097d…424310Not checkedno saved verdict
- 3db774fa7963fda84b94…553286Not checkedno saved verdict
- d98cd5d6ed9c4a957016…161c01Not checkedno saved verdict
- 2775df2cc5fc47742fa9…0146fdNot checkedno saved verdict
- ad1b9f2126c10d0dadc5…17d02eNot checkedno saved verdict
- 697f3becb429a13f89d9…e790a4Not checkedno saved verdict
- 6610426dcde514b48926…5d4621Not checkedno saved verdict
Chapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The Safe verdict weighed these detections and treats them as non-decisive.
- Kingsoftmalware.kb.a.750
File fingerprint
- Last analyzed
- Sep 12, 2026, 5:08 AM UTC
- SHA-256
6e3af053485c794ce6bbc6c779396b6088b0002c0aff0de635119126a062e708- SHA-1
eac131a21b58ee18af7737b75e13f8e0e2cc8222- MD5
33e70625b3a7c2105693aec3db470bba
About this file
Bookworm-Adventures_Win_EN_Rip.zip is a ZIP file of 22.1 MB.
- Type and size
- ZIP · 22.1 MB
- Signer
- Not applicable
- First seen
- Apr 16, 2023On VirusTotal.
- Submitted by
- 159 distinct sources
First scanned
Antivirus consensus
1 of 66 engines flagged this file
8 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-236 engines1flagged
- Low-trust13 engines0flagged
View all 74 engine results
- KingsoftMalicious: malware.kb.a.750
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Bookworm-Adventures_Win_EN_Rip.zip safe?
What is Bookworm-Adventures_Win_EN_Rip.zip?
How many antivirus engines detected Bookworm-Adventures_Win_EN_Rip.zip?
What is the SHA-256 hash of Bookworm-Adventures_Win_EN_Rip.zip?
Is it safe to open or extract Bookworm-Adventures_Win_EN_Rip.zip?
How up to date is this analysis of Bookworm-Adventures_Win_EN_Rip.zip?
Community
Member reviews and reports for this exact file hash.