File scan report
Verdict Safe
Is Wobbly
None of the 68 antivirus engines that checked it flagged the archive, and one sandbox run found no malicious outcome, though the file and extracted children have limited history.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 68 flagged
- Flagged 0
- No detection 68
- No result 7
- Code signing Not applicable
- Test run Completed
- First seen 20d ago
Chapter 02
Why we think so
3 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 68 antivirus engines that checked it flagged this ZIP, including the 17 major antivirus engines that reported no detection. One sandbox run produced no malicious verdict, persistence, or process injection, but the archive is and its four extracted files lack saved individual verdicts.
The antivirus evidence is consistently favorable: none of the 68 antivirus engines that checked it flagged the archive, and no malware family was identified. A completed sandbox run returned a clean result and showed no persistence or process injection. The contacted MSN asset host was explicitly attributed to the analysis environment's background activity, not the sample. is a legitimate caution because it can represent defense evasion, but it is uncorroborated by detections, malicious runtime outcomes, or researcher-specific rules. Confidence remains below the maximum because the file is newly and rarely observed, and the four extracted children have no saved individual verdicts.
What We Detected
None of the 68 antivirus engines that checked it flagged this ZIP, including 17 major antivirus engines that reported no detection. No malware family, hacking tool label, brand mismatch, or malware-specific researcher rule was identified.
Threat Behavior
One completed sandbox run produced no malicious verdict, persistence indicators, or process injection. It mapped T1562.001, which can indicate attempts to impair defenses, but this isolated mapping was not corroborated by other hostile evidence. The observed assets.msn.com contact was identified as analysis-environment background traffic rather than sample activity.
What To Do Now
The evidence supports ordinary use if the archive came from its expected source. Because it is and its four extracted files have no saved individual verdicts, keep security software enabled and scan the extracted contents before running the DLL.
Where this verdict could be wrong3 caveats
- The file has only been observed from two sources over six days, so its reputation and history are limited.
- The test run mapped T1562.001, a defense-evasion technique, although no engine detection or malicious sandbox verdict corroborated it.
- The archive's four extracted children have no saved verdicts, leaving their individual safety unconfirmed.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 68 antivirus engines that checked it flagged the archive.
- The completed sandbox run produced no malicious verdict, persistence, or process injection.
- No malware-specific external research rules or known malicious child verdicts were found.
- The archive was first seen on Oct 5, 2026 in the available records and has been submitted by two sources.
- The test run mapped T1562.001, a technique associated with impairing defenses.
- Four extracted files do not yet have saved individual verdicts.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 6sandbox rule tags
- 3spawned processes
- 0network contacts
- 8filesystem & mutex artifacts
Includes the sandbox verdicts, 6 mapped techniques, every process, file, registry and network entry and 4 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 68 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 11, 2026, 9:44 AM UTC
- SHA-256
82e4b38aa29b33f2ebc4b452af7aa4aa235b4a7ef78f965e85579aae5fb2553e- SHA-1
8f02e6df601dd0fbe258b4e5eb6fd707f35169f3- MD5
e662f0ca749a4f43bebfece842288863
About this file
WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip is a ZIP file of 103.1 kB.
- Type and size
- ZIP · 103.1 kB
- Signer
- Not applicable
- First seen
- Oct 5, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip safe?
What is WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip?
How many antivirus engines detected WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip?
What is the SHA-256 hash of WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip?
Is it safe to open or extract WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip?
How up to date is this analysis of WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip?
Community
Member reviews and reports for this exact file hash.