File verdict·Decided by the MT AI Engine
Our call

Safe

Clean scans across 72 engines including top tier1 vendors, behaviour consistent with portable web-based app using Microsoft Edge WebView2, medium prevalence supports benign commodity software.

Trust score88High trust
MT AI confidence · 88%
winscript-portable.exe
10.3 MB
6f8d7de0998667282705a0df392f
Antivirus engines
0 of 76 flagged
Code signing
Unsigned
Age
First seen 2mo ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

88%Confidence
Very high
Reasoning

Unanimous clean results from 72 engines, including 17 tier1 like BitDefender and Kaspersky, indicate no malicious signatures or heuristics fired. Behaviour shows standard WebView2 spawning for a portable app, with files dropped in expected user data paths. One offensive MITRE technique (T1562.001) and debug detection tag raise minor flags, but absence of sandbox alerts, malicious children, or external intel confirms safety. Medium prevalence across 17 sources aligns with legitimate software distribution.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. 0/72 engines.malicious, 17 tier1ReportedClean (e.g., BitDefender, ESET-NOD32, Kaspersky undetected)

  2. behaviour.offensiveTechniques=['T1562.001'] but ambientCount=7, processes spawn msedgewebview2.exe legitimately

  3. prevalence.classification='medium', 17 uniqueSources

  4. droppedChildren.hasMaliciousChild=false (8 inspected, all unknown)

  5. filenameAnalysis.looksLikePortable=true

Points in its favour
  • 0/72 engines.malicious, tier1ReportedClean=17
  • Legitimate Microsoft Edge WebView2 processes
  • Medium prevalence (17 unique sources)
  • No malicious dropped children or sandbox verdicts
  • No external intel or heuristic triggers
Points against
  • Unsigned executable (no Authenticode verification)
  • behaviour.offensiveTechniques includes T1562.001 (potential tool disablement)
  • tags['detect-debug-environment'] suggests anti-analysis
  • Recent file (ageDays=8), reputation=0
What to do

This appears to be a safe portable application, likely a web-scripting tool using Edge WebView2. Run in a sandbox if wary of the debug detection tag.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
8

Adversary techniques mapped to the MITRE ATT&CK framework.

T1018T1036T1056T1059T1071T1082T1106T1562.001
Spawned processes
7
$(unnamed)
"C:\Users\<USER>\Desktop\winscript-portable.exe"
$(unnamed)
"C:\Users\user\Desktop\winscript-portable.exe"
$(unnamed)
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\134.0.3124.93\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=winscript-portable.exe --webview-exe-version=2.4.0 --user-data-dir="C:\Users\user\AppData\Local\flic…
$(unnamed)
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\134.0.3124.93\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\flick.winscript.dev\EBWebView /prefetch:4 /pfhostedapp:9966bbccc2dcc0f1c07bc7a92…
$(unnamed)
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\134.0.3124.93\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\flick.winscript.dev\EBWebView" --webview-exe-name=winscript-portable.…
$(unnamed)
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\134.0.3124.93\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\use…
$(unnamed)
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\134.0.3124.93\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=winscript-portable.exe --webview-exe-version=2.4.0 --user-data-dir="C:\Users\user\AppData\Local\flic…
Filesystem & mutexes
18
Files written15
  • C:\Users\user\AppData\Local\flick.winscript.dev
  • C:\Users\user\AppData\Local\flick.winscript.dev\EBWebView
  • C:\Users\user\AppData\Local\flick.winscript.dev\EBWebView\8729a88b-289f-404b-9a78-4ccf0794f34b.tmp
  • C:\Users\user\AppData\Local\flick.winscript.dev\EBWebView\BrowserMetrics
  • C:\Users\user\AppData\Local\flick.winscript.dev\EBWebView\BrowserMetrics\BrowserMetrics-69E511F3-1444.pma
+10 more
Mutexes created3
  • \Sessions\1\BaseNamedObjects\DBWinMutex
  • \Sessions\1\BaseNamedObjects\Local\ChromeProcessSingletonStartup!
  • \Sessions\1\BaseNamedObjects\__OMADM_NAMED_MUTEX__
Dropped payload

Files this sample writes at runtime

This file drops 8 children at runtime. None are currently flagged malicious in our cache.

8 unseen
  • 4f4b15a44590d478a98140ebbcNever scanned
    never seen before
  • 41c91a9c93d76295746a1cc304Never scanned
    never seen before
  • 903fe65cb6fb5b3c5d838fad6eNever scanned
    never seen before
  • a0c9abae18599f0a65fce38e87Never scanned
    never seen before
  • 36010d34116fd014683968e8f4Never scanned
    never seen before
  • e54e9d1652848051e07a4c8461Never scanned
    never seen before
  • f7b24f2eb3d5eb0550528b5fedNever scanned
    never seen before
  • 4bd19a12e59964e2d028a0d9ffNever scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Antivirus engine breakdown

0 detections across 76 engines

0 malicious0 suspicious76 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-238 engines
0flag
Mainstream engines with mixed FP rates
Low-trust21 engines
0flag
Heuristic / generic-AI engines (high FP rate)
All 76 engines report this file as clean.
Hash 6f8d7de09986… cross-referenced against 76 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

Unpacked
Section entropy6 sections
.text
6.24
.rdata
6.27
.data
1.52
.pdata
6.65
.rsrc
3.83
.reloc
5.45
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
17
Moderate upload volume.
Total submissions
18
Includes repeat uploads by the same source.
First seen by VT
2mo ago
Apr 19, 2026
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
4/19/2026, 11:48:30 AM
First seen (MalwareBazaar)
Last analysis (VT)
4/21/2026, 3:59:31 AM
Scanned here
4/27/2026, 5:20:21 AM
File name
winscript-portable.exe
Size
10.27 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
6f8d7de09986672827739e88e7bd62149560f87114177c3d7b9ead05a0df392f
MD5
563a1e38b112f0c84595040ac38fe829
SHA-1
e1319ed657e59c66dc42597e0c75b70873e09935
PE imphash
8e3963a8d933e246b6f4e8616fc79b24
First seen (VT)
4/19/2026, 11:48:30 AM
Last analysis (VT)
4/21/2026, 3:59:31 AM
First scan (MalwareTips)
4/20/2026, 3:19:31 PM
Last scan (MalwareTips)
4/27/2026, 5:20:21 AM
Behavior tags
64bitschecks-user-inputdetect-debug-environmentpeexe
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scanned by
harlan4096Staff
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.