File scan report
Verdict Suspicious
Is Informaal
Two of the 67 antivirus engines that checked it flagged this newly observed ZIP, but no leading engine, malware-family evidence, or static finding corroborates those detections.
Read the whole reasonShow less
Why Suspicious? 2 antivirus engines flag it, but no major engine agrees; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Avoid executing the bundled programs until the source and expected file hashes are verified. Keep security protection enabled and use an isolated disposable environment if further testing is required.
What to do now5 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or extract it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
It is less than a day old. If you're unsure, scan it again in a few days; antivirus engines often catch up on new files.
If you already opened or extracted it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 67 flagged
- Flagged 2
- No detection 65
- No result 8
- Code signing Not applicable
- Test run Not run
- First seen Today
Chapter 02
Why we think so
4 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
DeepInstinct and Bkav flagged the archive, while none of the 18 reporting leading engines did. Our static analysis found three executables but no decisive hostile pattern; because the file has only one submission and no evidence from the test run, the conflicting signals cannot yet be resolved reliably.
Two of the 67 antivirus engines that checked it flagged the archive, and both labels are generic rather than identifying a real malware family. None of the 18 reporting leading engines detected it, which substantially weakens the two alerts but does not eliminate concern. Our static analysis inspected the archive and found three executable files, yet no static rule or decisive hostile pattern matched. The hash was first seen on Nov 4, 2026 and has only one recorded submission, leaving no meaningful history to support a benign interpretation. No completed observation from the test run or complete host-reputation check is available, so there is insufficient evidence to resolve the disagreement confidently.
What We Detected
Two of the 67 antivirus engines that checked it flagged this ZIP archive: DeepInstinct used a generic malicious label, while Bkav used a generic Windows-malware label. None of the 18 reporting leading engines detected it, and no engine consensus identified a specific malware family.
Threat Behavior
Our static analysis examined 348 archive entries, including three executable files, and found no decisive hostile pattern, disguised archive entry, script, shortcut, path-traversal attempt, or archive bomb. This is not equivalent to observing the executables run. No completed observation from the test run is available, and no complete reputation result exists for any hosts the software might contact during execution.
What To Do Now
Do not run the bundled executables on an important system until the archive's source and expected contents can be independently verified. Keep security software enabled and, if testing is necessary, use a disposable isolated environment without sensitive accounts or data.
Where this verdict could be wrong2 caveats
- Two independent engines flagged the archive, including DeepInstinct, so the detections cannot be dismissed solely as noise.
- Our static analysis found no hostile rule matches or decisive findings, which weakens the case that the archive contains clearly identifiable malware.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 18 reporting leading antivirus engines detected the archive.
- Our static analysis found no decisive hostile pattern or suspicious archive construction.
- No malware-specific community rule or public malware-sample database entry matched the hash.
- Two independent antivirus engines flagged the archive.
- The archive contains three executable files.
- The hash was first seen on Nov 4, 2026 and has only one recorded submission.
- No completed observation from the test run is available to show what the bundled executables do.
7 sources checked · 5 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
2 of the 67 antivirus engines that checked it flag it.
Programs inside
We opened the uploaded ZIP archive in an isolated sandbox and read its structure without running it. It contains programs. Our inspection reads the structure and the code of the first program; whether the programs are safe is judged by the antivirus and sandbox evidence.
- InformaalFingerprint.exe17 KB · program
- RapidOCRBackup.dll162 KB · program
- RapidOcrOnnx.dll16 MB · program
- Config.ini2.5 KB
- Image378 KB
- Image856 KB
- Image128 KB
- Image352 KB
- Image496 KB
- Image692 KB
- Image650 KB
- Image504 KB
Showing 12 of 348 files, riskiest first.
Read from InformaalFingerprint.exe. What the code can do, found by Mandiant capa rules, not behaviour that was seen.
- connect to WMI namespace via WbemLocatorT1047
- parse PE headerT1129 · Loads modules
- contains PDB path
- create pipe
- create process on Windows
- read file on Windows
Checked on Nov 4, 2026 while the file was uploaded. MalwareTips deleted its copy afterwards; VirusTotal keeps the uploaded file.
Sources checked
Every check behind this verdict
7 sources checked · 5 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
- BkavW32.Malware.A0FCB839
- DeepInstinctMALICIOUS
File fingerprint
- Last analyzed
- Nov 4, 2026, 12:57 AM UTC
- SHA-256
79d5e701ccac550c3131ee8defc5eb61c65af3ab0383be2d7affc8f77fa1a25d- SHA-1
d9cc41a41017e6a7039a5ab9a5ce17d341e2927a- MD5
9fefb87ad2d8fba85075ef5af7bab894
About this file
InformaalFrog_Adventures_v0.14.48_yonathan.zip is a ZIP file of 27.7 MB.
- Type and size
- ZIP · 27.7 MB
- Signer
- Not applicable
- First seen
- Nov 4, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is InformaalFrog_Adventures_v0.14.48_yonathan.zip safe, or is it malware?
What is InformaalFrog_Adventures_v0.14.48_yonathan.zip?
How many antivirus engines detected InformaalFrog_Adventures_v0.14.48_yonathan.zip?
I already downloaded and opened or extracted InformaalFrog_Adventures_v0.14.48_yonathan.zip — what should I do?
What is the SHA-256 hash of InformaalFrog_Adventures_v0.14.48_yonathan.zip?
How up to date is this analysis of InformaalFrog_Adventures_v0.14.48_yonathan.zip?
Community
Member reviews and reports for this exact file hash.
