File scan report
Verdict Safe
Is Wobbly
None of the 68 antivirus engines that checked it flagged the archive, and one sandbox run found no malicious outcome, though the file and extracted children have limited history.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 68 flagged
- Flagged 0
- No detection 68
- No result 7
- Code signing Not applicable
- Test run Completed
- First seen 20d ago
Chapter 02
Why we think so
3 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 68 antivirus engines that checked it flagged this ZIP, including the 17 major antivirus engines that reported no detection. One sandbox run produced no malicious verdict, persistence, or process injection, but the archive is and its four extracted files lack saved individual verdicts.
The antivirus evidence is consistently favorable: none of the 68 antivirus engines that checked it flagged the archive, and no malware family was identified. A completed sandbox run returned a clean result and showed no persistence or process injection. The contacted MSN asset host was explicitly attributed to the analysis environment's background activity, not the sample. is a legitimate caution because it can represent defense evasion, but it is uncorroborated by detections, malicious runtime outcomes, or researcher-specific rules. Confidence remains below the maximum because the file is newly and rarely observed, and the four extracted children have no saved individual verdicts.
What We Detected
None of the 68 antivirus engines that checked it flagged this ZIP, including 17 major antivirus engines that reported no detection. No malware family, hacking tool label, brand mismatch, or malware-specific researcher rule was identified.
Threat Behavior
One completed sandbox run produced no malicious verdict, persistence indicators, or process injection. It mapped T1562.001, which can indicate attempts to impair defenses, but this isolated mapping was not corroborated by other hostile evidence. The observed assets.msn.com contact was identified as analysis-environment background traffic rather than sample activity.
What To Do Now
The evidence supports ordinary use if the archive came from its expected source. Because it is and its four extracted files have no saved individual verdicts, keep security software enabled and scan the extracted contents before running the DLL.
Where this verdict could be wrong3 caveats
- The file has only been observed from two sources over six days, so its reputation and history are limited.
- The test run mapped T1562.001, a defense-evasion technique, although no engine detection or malicious sandbox verdict corroborated it.
- The archive's four extracted children have no saved verdicts, leaving their individual safety unconfirmed.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 68 antivirus engines that checked it flagged the archive.
- The completed sandbox run produced no malicious verdict, persistence, or process injection.
- No malware-specific external research rules or known malicious child verdicts were found.
- The archive was first seen on Oct 5, 2026 in the available records and has been submitted by two sources.
- The test run mapped T1562.001, a technique associated with impairing defenses.
- Four extracted files do not yet have saved individual verdicts.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 6sandbox rule tags
- 3spawned processes
- 0network contacts
- 8filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
6MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1033· Reads user info
- T1070.006· Covers its tracks
- T1082· System recon
- T1497· Sandbox evasion
- T1562.001· Disables security
- T1574· Execution hijack
Observed activity
Processes started
3Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\WobblySpawnMenu/WobblySpawnMenu.dll",#1unarchiver.exeC:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\5affc59e-000f-47c0-8753-099cac24944a.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\bag44fkr.ull" "C:\Users\user\Desktop\5affc59e-000f-47c0-8753-099cac24944a.zip"
Files
8Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Temp\bag44fkr.ull - Written
C:\Users\user\AppData\Local\Temp\bag44fkr.ull\WobblySpawnMenu - Written
C:\Users\user\AppData\Local\Temp\bag44fkr.ull\WobblySpawnMenu\CHANGELOG.md - Written
C:\Users\user\AppData\Local\Temp\bag44fkr.ull\WobblySpawnMenu\README.md - Written
C:\Users\user\AppData\Local\Temp\bag44fkr.ull\WobblySpawnMenu\WobblySpawnMenu.dll - Written
C:\Users\user\AppData\Local\Temp\unarchiver.log
Show all 8 entries for files
- Written
\Device\ConDrv\\Connect - Written
stdout
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
assets.msn.com
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 18152a8c9154b6d7f4a4…93fb0fNot checkedno saved verdict
- d9c5db3d41a15e832656…656796Not checkedno saved verdict
- abe88a269b5119beb7a6…530292Not checkedno saved verdict
- 2beaf498f9d2eb2a1742…e6f27aNot checkedno saved verdict
Chapter 04
Technical details
None of the 68 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 11, 2026, 9:44 AM UTC
- SHA-256
82e4b38aa29b33f2ebc4b452af7aa4aa235b4a7ef78f965e85579aae5fb2553e- SHA-1
8f02e6df601dd0fbe258b4e5eb6fd707f35169f3- MD5
e662f0ca749a4f43bebfece842288863
About this file
WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip is a ZIP file of 103.1 kB.
- Type and size
- ZIP · 103.1 kB
- Signer
- Not applicable
- First seen
- Oct 5, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 68 engines flagged this file
7 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-237 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip safe?
What is WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip?
How many antivirus engines detected WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip?
What is the SHA-256 hash of WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip?
Is it safe to open or extract WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip?
How up to date is this analysis of WobblyMenu 163 0.30.2 2026-10-05T16-35Z ufbcIDky8.zip?
Community
Member reviews and reports for this exact file hash.