Malicious
Installer signed by Softonic with 5 tier-1 engines flagging OfferCore PUP and 5 prior malicious verdicts on the same signer.
865bfa64ec36faabc7…22bbd03e56The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The combination of tier-1 detections on OfferCore/Softonic labels, a signer with exclusively malicious history, and matching prior verdicts on the same signer and imphash outweighs the absence of sandbox or network data. Prevalence as rare_new and the installer filename do not contradict the PUP classification. Low-trust detections are present but not required for the decision given the tier-1 and signer evidence.
12 of 74 engines flagged the file, including 5 tier-1 detections naming OfferCore or Softonic downloader activity. The signer SOFTONIC INTERNATIONAL SA has a 0% safe rate across prior samples, and similar hashes consistently returned malicious verdicts for the same family.
What We Detected
12 of 74 engines reported malicious or PUP activity. Tier-1 engines DrWeb, ESET-NOD32, Kaspersky, Microsoft, and Symantec contributed detections naming OfferCore, Downware, or Softonic components. The executable is signed by SOFTONIC INTERNATIONAL SA with verified status but a 0/3 safe history.
Threat Behavior
OfferCore is a known adware/downloader framework frequently bundled with installers. The file shows high-entropy sections typical of packed or overlay-heavy installers but no confirmed packers. No sandbox execution or network contact data is available in this scan.
What To Do Now
Avoid executing the installer. If already run, review installed programs for OfferCore or Softonic entries and run a reputable anti-malware scan. Delete the file and obtain game software from official sources.
The strongest scan facts behind the verdict, preserved with their exact names and counts.
12 of 74 antivirus engines flagged the file, including AhnLab-V3, CrowdStrike, DrWeb.
The file has a valid code signature from SOFTONIC INTERNATIONAL SA.
The hash has been submitted 2 times from 2 sources.
- No sandbox malicious verdict available
- No malicious contacted hosts recorded
- No brand mismatch detected
- 5 tier-1 engines flagged OfferCore/Softonic PUP
- Signer SOFTONIC INTERNATIONAL SA has 0% safe rate
- 5 similar hashes previously marked malicious for same family
- rare_new prevalence with installer filename
Do not run this installer. The evidence from tier-1 engines and signer history indicates OfferCore PUP distribution.
Threat context
How bundlers & adware work
This is a bundler — a real-looking installer that hides extra software inside. When you run it, it quietly installs things you never asked for: ad injectors, browser toolbars, fake 'PC cleaner' apps, or even more bundlers. The people behind it get paid for every unwanted app they sneak on.
Bottom line:It's not usually built to destroy files, but it slows your PC, floods it with ads, and can be a real pain to fully remove.
What to do now
This file is dangerous. Treat it as harmful and remove it.
Don't open or run this file. Delete it from your Downloads (or wherever you saved it), then empty the Recycle Bin.
If you already opened it, disconnect from the internet and run a full scan with your antivirus — Windows Security, built into Windows, is sufficient.
If you typed any passwords while it was open, change them from a device you trust.
In future, only download software from the official website or an official app store.
offercore corroborated by 2 sources
- VT (74 engines)offercore
- MT AI Engineoffercore
12 detections across 74 engines
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Barely seen in the wild and first surfaced recently. 12 antivirus detections make that low prevalence materially relevant, but rarity alone is not proof of malware.
Forensic fingerprint
- File name
- igi-2-covert-strike-single-player-demo-2-installer.exe
- Size
- 2.03 MB
- MIME type
- application/x-msdownload
- Detected type
- Win32 EXE
- SHA-256
- 865bfa64ec36faabc7bab043705667c400eb3ad9588ae6d75810c222bbd03e56
- MD5
- f9723384ded943ef2aece10f1b4ff5f0
- SHA-1
- ada1b018d628e3c7d13ca7012f46dd6aadae2b04
- PE imphash
- 88016fcdef7f227c62171d0afad9aae4
- First seen (VT)
- Jul 22, 2026, 11:09 AM UTC
- Last analysis (VT)
- Jul 22, 2026, 11:10 AM UTC
- First scan (MalwareTips)
- Jul 22, 2026, 11:10 AM UTC
- Last scan (MalwareTips)
- Jul 22, 2026, 2:40 PM UTC
- Code signer
- SOFTONIC INTERNATIONAL SAverified
Safety FAQ
Common questions about igi-2-covert-strike-single-player-demo-2-installer.exe, answered from the scan data above.
- Yes — igi-2-covert-strike-single-player-demo-2-installer.exe is malicious, so do not run it, and delete it. 12 of 74 antivirus engines flag it (family: offercore). It behaves as adware or a potentially unwanted program (PUA) — not always destructive, but it bundles ads, trackers, or unwanted changes you didn't ask for. If you've already run it, see the removal and recovery steps below.
- igi-2-covert-strike-single-player-demo-2-installer.exe is a Windows executable program (application/x-msdownload), about 2 MB. Our analysis identifies it as malicious (family: offercore) — adware or a potentially unwanted program (PUA) — not always destructive, but it bundles ads, trackers, or unwanted changes you didn't ask for. Because a file's name and icon can be faked, the safest way to identify it is by its cryptographic hash (below), not its filename.
- 12 of 74 antivirus engines flagged igi-2-covert-strike-single-player-demo-2-installer.exe, 12 of them as outright malicious. A detection rate at this level is a reliable signal that the file is dangerous.
- Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.
- To remove igi-2-covert-strike-single-player-demo-2-installer.exe: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original igi-2-covert-strike-single-player-demo-2-installer.exe file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.
- igi-2-covert-strike-single-player-demo-2-installer.exe is classified as adware or a potentially unwanted program (PUA) — not always destructive, but it bundles ads, trackers, or unwanted changes you didn't ask for. Engines attribute it to the offercore family. Knowing the family matters because it tells you the likely impact — data theft, remote control, file encryption, or unwanted ads — and guides the cleanup.
- Yes — igi-2-covert-strike-single-player-demo-2-installer.exe carries a valid digital signature from SOFTONIC INTERNATIONAL SA, which confirms the file hasn't been tampered with since that publisher signed it. A valid signature is a positive signal, but note that malware is occasionally signed with stolen or abused certificates, so it isn't proof of safety on its own.
- The SHA-256 hash of igi-2-covert-strike-single-player-demo-2-installer.exe is 865bfa64ec36faabc7bab043705667c400eb3ad9588ae6d75810c222bbd03e56, and its MD5 is f9723384ded943ef2aece10f1b4ff5f0. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
- This report reflects the scan run on July 22, 2026. Because a file's hash never changes, the identity of igi-2-covert-strike-single-player-demo-2-installer.exe is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.