MalwareTipsTools

File scan report

Scan another file

Verdict Safe

Analyzed , 10 hours ago

Is POP2.EXE safe? Yes, no threats found.

None of the 71 antivirus engines that checked it flagged this 5.5 MB Windows executable, and four sandbox runs recorded no hostile activity, no packing and no dropped files.

Moderate evidence · No engine flags it, but no publisher signature confirms who made it.

Run it as usual if it came from the official source

No action is needed based on this evidence. Run it only if you trust its source, and keep your security software enabled.

Good practice2 tips

We found nothing harmful in this file.

  1. Run it only if it came from the developer's own website or an official app store.

  2. Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Share this file report

POP2.EXE: Safe — MalwareTips file scan

The link always shows the latest result for this exact file (its SHA-256 fingerprint).

Antivirus results

0 of 71 flagged

  • Flagged 0
  • No detection 71
  • No result 4
FilePOP2.EXE5.5 MBSHA-256 7db06c8dadc6…aac130
  • Code signing Unsigned
  • Test run Completed
  • First seen 10mo ago
When we scanned it, 35 sources had submitted it to VirusTotal (37 submissions).

Chapter 02

Why we think so

2 points against it and 3 in its favour, checked against the scan evidence.

MT AI Engine · Verdict analysis

The reasoning behind this verdict

Analyst conclusion

None of the 71 antivirus engines that checked it flagged POP2.EXE, including all 18 major ones. Four sandbox runs returned a combined clean verdict, with no injection, no dropped files and no hostile network contacts. It is unsigned, so there is no publisher to vouch for it.

Full reasoning

None of the 71 antivirus engines that checked it flagged the file, and the 18 major antivirus engines all reported clean. The combined sandbox verdict across four runs was clean. No high-risk techniques were corroborated, no processes were injected into and no files were dropped. The only network contact was background traffic from the analysis machine, and our host cross-check found nothing malicious. The file is built with Microsoft Visual C++, shows no sign of packing, and has no hits in MalwareBazaar, YARAify or CIRCL. It is unsigned and moderately prevalent, which limits confidence but gives no reason for suspicion.

Detailed assessment

What We Detected

No engine out of 75 flagged this Win32 executable, first seen on Dec 18, 2025. All 18 major antivirus engines reported it clean, and no external reference database holds a hit on it.

Threat Behavior

Four sandbox runs produced a combined clean verdict. The sample showed no injection, no persistence, no dropped files and no hostile network contacts; the single contact was the analysis machine's own background traffic. Its structure matches a normal Visual C++ build with no packer and ordinary entropy.

What To Do Now

Nothing in the evidence calls for action. As with any unsigned program, run it only if you trust where you got it, and keep your security software active.

Where this verdict could be wrong3 caveats
  • The file is unsigned and no publisher history exists, so nothing vouches for who built it.
  • 35 submitters over 328 days is moderate prevalence, which is not proof of safety on its own.
  • We have not inspected the file contents ourselves, so the assessment rests on engine and sandbox results.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Points in its favour
  • No detections from 75 engines, including all 18 major ones.
  • Clean combined sandbox verdict over four runs with no hostile behaviour.
  • No packing, and no hits in MalwareBazaar, YARAify or CIRCL.
Points against
  • The file is unsigned, so no publisher identity backs it.
  • Prevalence is moderate, so wide use alone does not establish safety.

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 4 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete
  • 4isolated sandbox runs
  • 13sandbox rule tags
  • 1spawned processes
  • 0network contacts
  • 5filesystem & mutex artifacts
Runtime behaviour

What this file did when executed

This file was detonated in 4 sandboxes and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

1
  • VT: CLEANclean

Techniques observed in the sandbox

13

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

  • T1012
  • T1027· Obfuscated code
  • T1056· Keylogging
  • T1056.001· Keylogging
  • T1057· Lists programs
  • T1059· Runs commands
  • T1071· Application protocol
  • T1082· System recon
  • T1083· Scans your files
  • T1129· Loads modules
  • T1222
  • T1497.001· Sandbox evasion
  • T1614

Observed activity

Processes started
1

Programs the file ran, with their command lines.

  • file.exe"C:\Users\user\Desktop\file.exe"
Files
1

Files the file created, changed or deleted.

  • WrittenC:\ProgramData\Microsoft\Windows Security Health\Logs
Mutexes
4

Named locks a program uses so only one copy runs; malware families often reuse them.

  • \BaseNamedObjects\Local\SM0:6908:304:WilStaging_02
  • \BaseNamedObjects\Local\SM0:6908:120:WilError_03
  • \BaseNamedObjects\Local\ZonesCacheCounterMutex
  • \BaseNamedObjects\Local\ZonesLockedCacheCounterMutex
Sandbox background — not the file
2

The analysis machine's own processes and connections, recorded in every run.

  • VM processSecurityHealthService.exeC:\Windows\System32\SecurityHealthService.exe C:\Windows\system32\SecurityHealthService.exe
  • VM hostnexusrules.officeapps.live.com

Chapter 04

Technical details

None of the 71 antivirus engines that checked it flag it; no publisher signature.

Sources checked

Every check behind this verdict

6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.

SourceStatusResultChecked
Antivirus enginesVirusTotal · 75 enginesCompletePositive signal: 0 of 71 engines flagged it · 4 gave no result Details for antivirus engines
Sandbox runVirusTotal sandboxes · C2AE, CAPA, CAPE SandboxComplete4 runs: 1 clean, 3 without a verdict Details for sandbox run
Contacted hostsMalwareTips URL scannerComplete1 contacted host checked
Signature rulesYARAify community rules + MalwareTips rulesCompleteNo rule matched
Malware sample databaseabuse.ch MalwareBazaarCompleteNot listed
Known-software referenceCIRCL hashlookupCompleteNo match

File fingerprint

Last analyzed
Nov 10, 2026, 6:59 PM UTC
SHA-256
7db06c8dadc62acb893f746ee74adf3c7cb933c85576e3957a4a01565baac130
SHA-1
89672699f7420ac52bc9c09182216ff82f0180f8
MD5
a75eb1815db007a0bf807207fba24430

About this file

POP2.EXE says it is Prince of Persia : Warrior Within, 5.5 MB.

Claims to be
Prince of Persia : Warrior WithinFrom the file's own version information, written by whoever built it.
Original name
POP2.EXEMatches the shared file name.
Type and size
Win32 EXE · 5.5 MB
Signer
UnsignedNo code signature.
First seen
Dec 18, 2025On VirusTotal.
Submitted by
35 distinct sources
Packer
None detected
Entropy
6.43 of 8

First scanned

Antivirus consensus

0 of 71 engines flagged this file

0 malicious0 suspicious71 not flagged4 no result

4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

  • Tier-118 engines
    0flagged
  • Tier-236 engines
    0flagged
  • Low-trust17 engines
    0flagged
No antivirus engine flagged this file.
View all 75 engine results
  • AcronisClean
  • AhnLab-V3Clean
  • AlibabaClean
  • alibabacloudClean
  • ALYacClean
  • Antiy-AVLClean
  • APEXClean
  • ArcabitClean
  • AvastClean
  • Avast-MobileNo result
  • AVGClean
  • AviraClean
  • BitDefenderClean
  • BitDefenderFalxNo result
  • BkavClean
  • CAT-QuickHealClean
  • ClamAVClean
  • CMCClean
  • CrowdStrikeClean
  • CTXClean
  • CylanceClean
  • CynetClean
  • DeepInstinctClean
  • DrWebClean
  • ElasticClean
  • EmsisoftClean
  • ESET-NOD32Clean
  • F-SecureClean
  • FortinetClean
  • GDataClean
  • GoogleClean
  • GridinsoftClean
  • huorongClean
  • IkarusClean
  • JiangminClean
  • K7AntiVirusClean
  • K7GWClean
  • KasperskyClean
  • KingsoftClean
  • LionicClean
  • MalwarebytesClean
  • MaxSecureClean
  • McAfeeDClean
  • MicrosoftClean
  • MicroWorld-eScanClean
  • NANO-AntivirusClean
  • PaloaltoClean
  • PandaClean
  • RisingClean
  • SangforClean
  • SentinelOneClean
  • SkyhighClean
  • SophosClean
  • SUPERAntiSpywareClean
  • SymantecClean
  • SymantecMobileInsightNo result
  • TACHYONClean
  • tehtrisClean
  • TencentClean
  • TrapmineClean
  • TrellixENSClean
  • TrendMicroClean
  • TrendMicro-HouseCallClean
  • TrustlookNo result
  • VaristClean
  • VBA32Clean
  • VIPREClean
  • VirITClean
  • ViRobotClean
  • WebrootClean
  • XcitiumClean
  • YandexClean
  • ZillyaClean
  • ZoneAlarmClean
  • ZonerClean
PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 6.43Unpacked
Section entropy4 sections
.text
6.54
.rdata
5.75
.data
5.17
.rsrc
4.14
0.0Packed threshold 7.28.0
Compiler / installer
Microsoft Visual C++ v7.0

These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.

Prevalence

How widely this file has been seen

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
35
Moderate upload volume.
Total submissions
37
Includes repeat uploads by the same source.
First seen
11mo ago
Dec 18, 2025
Prevalence quadrant
Rare · New
Needs evidence-led scrutiny
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is POP2.EXE safe?
We found nothing harmful in POP2.EXE. None of the 71 antivirus engines that checked it flag it. Run it only if it came from the developer's own website or an official app store.
What is POP2.EXE?
POP2.EXE is a Windows program, about 5.5 MB. Its version information says it is “Prince of Persia : Warrior Within”. Version information is written by whoever built the file, so it is a claim, not proof of who made it. VirusTotal first saw it on Dec 18, 2025.
How many antivirus engines detected POP2.EXE?
None of the 71 antivirus engines that checked it flag POP2.EXE. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.
What is the SHA-256 hash of POP2.EXE?
The SHA-256 fingerprint of POP2.EXE is 7db06c8dadc62acb893f746ee74adf3c7cb933c85576e3957a4a01565baac130, and its MD5 is a75eb1815db007a0bf807207fba24430. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.
Is it safe to run POP2.EXE?
We found nothing harmful in POP2.EXE. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.
How up to date is this analysis of POP2.EXE?
This report reflects the scan on Nov 10, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.
Chapter 06

Community

Member reviews and reports for this exact file hash.

Related file reports

Recent reports on other files with the same rating.

All file reports
Scan another
Check a different file
URL instead?
Check if a link is safe
This report and its SHA-256 fingerprint are public, so the next person who checks the same file gets an instant answer; documents and images are listed by type instead of their file name. A file we had not seen before is uploaded to VirusTotal, whose security partners and subscribers can download it; MalwareTips deletes its own copy after the scan. If you ran this file and are worried, scan your device with up-to-date security software.