File scan report
Verdict Safe
Is Beholder.
Only Jiangmin flagged this widely submitted executable, while major antivirus engines, observations from the test run, host checks, and threat-intelligence sources supplied no…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
The isolated detection can reasonably be treated as a false positive. Keep security protection enabled and use a copy obtained from the expected source with a matching SHA-256 hash.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 71 flagged
- Flagged 1
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 9y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The lone Jiangmin detection is most consistent with a false positive. None of the other 74 engines flagged the file, the test run produced no malicious verdict or high-risk technique, and all 21 inspected hosts lacked malicious or suspicious classifications.
Only 1 of the 71 antivirus engines that checked it flagged the executable, and that result came from Jiangmin; all reporting major antivirus engines were clean. The file has substantial history, with 571 sources and 713 submissions since it was first seen on Nov 9, 2016. Eight completed observations from the test run supplied no malicious verdict, named injection target, or high-risk technique. The complete host cross-check inspected 21 contacts and found no malicious or suspicious classifications, while three external intelligence checks returned no hits. Although the executable is unsigned and one behaviour rule noted direct-IP traffic, neither point corroborates the lone detection.
What We Detected
Jiangmin was the only engine to flag the executable, using the label Backdoor.MSIL.fdwk. None of the other 74 engines flagged it, including every reporting major antivirus engine. The file has also accumulated 713 submissions from 571 sources since it was first seen on Nov 9, 2016.
Threat Behavior
Eight completed observations from the test run produced no malicious verdict, named process-injection target, persistence indicator, dropped file, or high-risk technique. One behaviour rule noted direct-IP traffic, but the complete reputation check of 21 contacted hosts found no malicious or suspicious classifications. Three external intelligence checks also supplied no matching threat entry.
What To Do Now
The evidence strongly indicates that Jiangmin's isolated alert is a false positive. Keep security software enabled, obtain the executable from its expected source, and verify its hash before running it if provenance remains uncertain.
Where this verdict could be wrong3 caveats
- Jiangmin labels the file Backdoor.MSIL.fdwk, although no other engine or evidence from the test run corroborates that label.
- The executable is unsigned, so its publisher cannot be authenticated.
- One behaviour rule noted direct-IP traffic, but the inspected host set contained no malicious or suspicious hosts.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 71 antivirus engines that checked it flagged the file, and every reporting major antivirus engine was clean.
- Eight completed observations from the test run produced no malicious verdict or high-risk technique.
- All 21 inspected contacted hosts had neither malicious nor suspicious classifications.
- No matching entry appeared in the three checked external threat-intelligence sources.
- The file has 713 submissions from 571 sources and was first seen on Nov 9, 2016.
- The executable has no digital signature, so its publisher cannot be authenticated.
- Jiangmin labels it Backdoor.MSIL.fdwk.
- One behaviour rule noted direct-IP traffic during analysis.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 8 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 8isolated sandbox runs
- 6sandbox rule tags
- 2spawned processes
- 8network contacts
- 25filesystem & mutex artifacts
Includes the sandbox verdicts, 6 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
1 of the 71 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- JiangminBackdoor.MSIL.fdwk
File fingerprint
- Last analyzed
- Oct 24, 2026, 8:31 PM UTC
- SHA-256
734006303f1964a742ddef0fdd7905d19db91f275eb9ccb69e65db5c48153b8b- SHA-1
c6dc3741c7fef673b02e3644dbaa04a90159f86a- MD5
1078e34456b405811a9d6bbb2587227c
About this file
Beholder.exe is a Win32 EXE file of 17.7 MB.
- Type and size
- Win32 EXE · 17.7 MB
- Signer
- UnsignedNo code signature.
- First seen
- Nov 9, 2016On VirusTotal.
- Submitted by
- 571 distinct sources
- Packer
- None detected
- Entropy
- 6.53 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Beholder.exe safe?
What is Beholder.exe?
How many antivirus engines detected Beholder.exe?
What is the SHA-256 hash of Beholder.exe?
Is it safe to run Beholder.exe?
How up to date is this analysis of Beholder.exe?
Community
Member reviews and reports for this exact file hash.