File scan report
Verdict Safe
Is myfairy.
Only 2 of the 71 antivirus engines that checked it raised generic less reliable alerts, with no major detection or corroborating malicious sandbox, host, file it created, or…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Keep protection enabled and use the file only if its origin and intended purpose are trusted. Prefer a publisher-signed copy from an official distribution channel.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 71 flagged
- Flagged 2
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The two detections are generic alerts from less reliable engines; none of the 71 antivirus engines that checked it produced a detection from a major antivirus engine. UPX packing, an absent signature, low prevalence, and one offensive technique mapping merit caution, but the completed runtime and host checks did not independently corroborate malware activity.
Only 2 of the 71 antivirus engines that checked it flagged the executable, and both detections came from less reliable engines using generic labels. No major antivirus engines identified malware or agreed on a family. One completed sandbox run produced no malicious verdict, while its named domains were identified as analysis-environment background contacts and the full host-reputation check found no malicious or suspicious host. The high-severity dropper rule-based rests on packing, unsigned status, and an IP contact, but that synthesis lacks independent engine, sandbox-verdict, file it created, or research-rule corroboration. UPX packing, scarce prevalence, and the lack of a digital signature still justify caution and prevent a stronger benign assessment.
What We Detected
Bkav and MaxSecure flagged the file, accounting for 2 of the 71 antivirus engines that checked it. Both used generic rule labels; no major antivirus engines detected it, and no engine family consensus emerged. The executable is unsigned and packed with UPX 2.90 using LZMA, with a high-entropy packed section.
Threat Behavior
One sandbox run mapped a single offensive technique, T1485, alongside 13 techniques common in legitimate software, but it did not issue a malicious verdict. The Microsoft domains shown in the run were recorded as sandbox background traffic rather than sample-generated activity. All 11 distinct recorded contacts received host-reputation coverage, with no known-malicious or suspicious result. Ten dropped files lack saved verdicts, so they provide no conclusion; none is confirmed malicious.
What To Do Now
Keep security software enabled. If the file came from an untrusted source or was unexpected, avoid running it and obtain a fresh copy from the software publisher; the absent signature means its publisher and integrity cannot be verified.
Where this verdict could be wrong3 caveats
- The executable is unsigned and UPX-packed, which makes its contents harder to inspect and provides no publisher identity.
- Only two submissions from two sources were recorded despite the file being over a year old, so benign prevalence is weak.
- One sandbox mapping associated the execution with T1485, although no malicious sandbox verdict corroborated that mapping.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 2 of the 71 antivirus engines that checked it flagged the file, and both were less reliable engines using generic labels.
- No major antivirus engines detected the file or established a malware-family consensus.
- The completed sandbox run returned no malicious verdict.
- The host-reputation check covered all recorded contacts and found no known-malicious or suspicious hosts.
- No file it created was confirmed malicious, and no malware-specific research rule matched.
- The Windows executable has no digital signature, so its publisher cannot be authenticated.
- UPX packing and a high-entropy packed section obscure the executable's static contents.
- The file has only two recorded submitters despite being more than a year old.
- One runtime technique mapping indicated possible data destruction behavior, though no malicious sandbox verdict corroborated it.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 14sandbox rule tags
- 3spawned processes
- 4network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
14MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1057· Lists programs
- T1064
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1140· Deobfuscation
- T1485
- T1496
- T1518.001· Checks your AV
- T1539
- T1574.002· Execution hijack
Observed activity
Processes started
3Programs the file ran, with their command lines.
program.exe"C:\Users\<USER>\Desktop\program.exe"75387d204664bb99d3dd812be484721dbe364a4fc5f31964c8b95dcc5ecd876d.exe%SAMPLEPATH%\75387d204664bb99d3dd812be484721dbe364a4fc5f31964c8b95dcc5ecd876d.exesoftware.exe"C:\Users\user\Desktop\software.exe"
Network contacts
44 hosts, listed as 4 addresses. Links show the host and path only.
- IP address
23.217.131.226 - IP address
23.55.168.160 - IP address
23.32.75.35 - IP address
104.98.118.152
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\~gs7117.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\1461wrfiles.~lk - Written
C:\Users\<USER>\AppData\Local\Temp\2533wradata.~lk - Written
C:\Users\<USER>\AppData\Local\Temp\~fspi.ico - Written
C:\Users\<USER>\AppData\Local\Temp\2017wrd.~lk\~fspi.ico - Written
C:\Users\<USER>\AppData\Local\Temp\2017wrd.~lk\1179wrdata.~lk\swfdata0
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\2017wrd.~lk\1179wrdata.~lk\swfdatar0 - Written
C:\Users\<USER>\AppData\Local\Temp\2017wrd.~lk\1179wrdata.~lk\swfdata1 - Written
C:\Users\<USER>\AppData\Local\Temp\2017wrd.~lk\mdm_temp.swf - Written
C:\Users\<USER>\AppData\Local\Temp\2017wrd.~lk\1179wrdata.~lk\~swd1.dat - Written
C:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sxx - Written
C:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sol - Written
C:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx - Written
C:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol - Written
C:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\7XVP5CMZ\localhost\H020179.sxx - Deleted
C:\Users\<USER>\AppData\Local\Temp\~fspi.ico - Deleted
C:\Users\<USER>\AppData\Local\Temp\2017wrd.~lk\~fspi.ico - Deleted
C:\Users\<USER>\AppData\Local\Temp\2017wrd.~lk\1179wrdata.~lk\swfdatar0 - Deleted
C:\Users\<USER>\AppData\Local\Temp\2017wrd.~lk\mdm_temp.swf - Deleted
C:\Users\<USER>\AppData\Local\Temp\2017wrd.~lk\1179wrdata.~lk\swfdata1 - Deleted
C:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sol - Deleted
C:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sxx - Deleted
C:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol - Deleted
C:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx - Deleted
C:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\7XVP5CMZ\localhost\H020179.sol - Deleted
C:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\7XVP5CMZ\localhost\H020179.sxx - Deleted
C:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\localhost\H020179.sol - Deleted
C:\Users\<USER>\AppData\Local\Temp\2017wrd.~lk\1179wrdata.~lk\swfdata0 - Deleted
C:\Users\<USER>\AppData\Local\Temp\2533wradata.~lk - Deleted
C:\Users\<USER>\Desktop\H020176.sol
Registry and auto-start
6Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\JEDI-VCL\TipsStartup\_JvTipsOfDay1 - Set
HKEY_CURRENT_USER\SOFTWARE\JEDI-VCL\TipsStartup\_JvTipsOfDay1 - Set
TipsStartup\_JvTipsOfDay1 - Set
Software\JEDI-VCL\TipsStartup\_JvTipsOfDay1 - Set
HKEY_CURRENT_USER\SOFTWARE\JEDI-VCL - Set
HKEY_CURRENT_USER\SOFTWARE\JEDI-VCL\TipsStartup
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
{1B655094-FE2A-433c-A877-FF9793445069}Global\mchMixCache$17a0Global\Mutex, mAH, Process $000017a0, API $77033750Global\Mutex, mAH, Process $000017a0, API $7523f3a0Global\Mutex, mAH, Process $000017a0, API $770435a0Global\Mutex, mAH, Process $000017a0, API $75243140
Show all 10 entries for mutexes
Global\Mutex, mAH, Process $000017a0, API $75243130Global\Mutex, mAH, Process $000017a0, API $75243340Global\Mutex, mAH, Process $000017a0, API $75243310Global\Mutex, mAH, Process $000017a0, API $75242ee0
Sandbox background — not the file
8The analysis machine's own processes and connections, recorded in every run.
- VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
192.168.0.41 - VM host
20.99.186.246 - VM host
23.196.193.245 - VM host
20.99.185.48
Show all 8 entries for sandbox background — not the file
- VM host
a83f:8110:0:0:64ca:1f00:0:0 - VM host
23.55.140.42
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 0e0b72fa5551305ef027…7267f9Not checkedno saved verdict
- 35831565b731294b7303…60c095Not checkedno saved verdict
- a6f58f07483cd96e0853…dbf2c9Not checkedno saved verdict
- 6a1ab70a4cd491322519…a33819Not checkedno saved verdict
- 01ca4627b62fa53563e0…9dc996Not checkedno saved verdict
- ba686f058348c5227620…f377d5Not checkedno saved verdict
- 14e4bddb191cb8c793fd…3b8eaeNot checkedno saved verdict
- 212663674be1df551390…3e2adfNot checkedno saved verdict
- 9fb41810334da8b805c1…ec6779Not checkedno saved verdict
- a741b4d07aaf56675d5e…a0b84fNot checkedno saved verdict
Chapter 04
Technical details
2 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- BkavW32.AIDetectMalware
- MaxSecureTrojan.Malware.300983.susgen
File fingerprint
- Last analyzed
- Oct 13, 2026, 1:50 AM UTC
- SHA-256
75387d204664bb99d3dd812be484721dbe364a4fc5f31964c8b95dcc5ecd876d- SHA-1
33a239a15755b62fd625449be1f1f4f666f6c168- MD5
58a838acd9ed171e114e3f9f0785109e
About this file
myfairy.exe is a Win32 EXE file of 2.2 MB.
- Type and size
- Win32 EXE · 2.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 14, 2025On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John ReiserPacking hides code; legitimate installers use it too.
- Entropy
- 7.88 of 8A code section is highly compressed or encrypted.
First scanned
Antivirus consensus
2 of 71 engines flagged this file
5 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust18 engines2flagged
View all 76 engine results
- BkavMalicious: W32.AIDetectMalware
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesNo result
- McAfeeClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
Section entropy & packers
Executable sections have high entropy (7.2+) — the code is compressed or encrypted and only decrypted at runtime. Classic packing behaviour.
Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is myfairy.exe safe?
What is myfairy.exe?
How many antivirus engines detected myfairy.exe?
What is the SHA-256 hash of myfairy.exe?
Is it safe to run myfairy.exe?
How up to date is this analysis of myfairy.exe?
Community
Member reviews and reports for this exact file hash.