File scan report
Verdict Suspicious
Is Chrono_
Two major antivirus engines detect generic trojan activity, but weak family agreement and absent evidence from the test run prevent a confirmed XWorm attribution.
Read the whole reasonShow less
Why Suspicious? 5 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
5 of 67 flagged
- Flagged 5
- No detection 62
- No result 8
- Code signing Unsigned
- Test run Not run
- First seen 1mo ago
Chapter 02
Why we think so
6 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Five of the 67 antivirus engines that checked it flagged this unsigned executable, including Kaspersky and Microsoft. Those two major detections warrant caution, although most engines remained silent and only Zillya identified XWorm, leaving the exact malware family unresolved.
Kaspersky and Microsoft independently flagged the sample, producing two major malicious votes among 75 engines. Their labels are generic or machine-learning based, while the XWorm identification comes from Zillya alone, so no major family consensus exists. The executable is unsigned and has only one recorded submission, leaving no established publisher or distribution history. No completed sandbox observation or comprehensive contacted-host reputation check is available, so execution and network behavior remain unverified.
What We Detected
Five of the 67 antivirus engines that checked it flagged the executable. Kaspersky reported HEUR:Trojan.Win32.Generic and Microsoft reported Trojan:Win32/Wacatac.B!ml, while Zillya named Backdoor.XWorm.Win32.3294. Because the major antivirus engines do not agree on a family, the XWorm attribution remains unconfirmed.
Threat Behavior
A complete reputation check of contacted hosts is also unavailable. Static PE analysis did not identify packed or high-entropy executable code, but that does not override the antivirus detections.
What To Do Now
Do not run the executable on a production or personal system. Keep security software enabled, let your antivirus remove the file, and obtain the software from the official game platform or publisher before comparing hashes or signatures.
Where this verdict could be wrong3 caveats
- No community YARA rule matched, the hash is not listed in the MalwareBazaar malware database, and the hash is not in the known-software reference database, although absent matches do not prove benignity.
- The absence of packed-level code entropy and the absence of packing indicators provide no static indication of packed executable code.
- The XWorm name appears only in Zillya's detection; major antivirus engines do not agree on one malware family.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No strong major family consensus was present.
- YARAify, MalwareBazaar, and CIRCL returned no matching intelligence.
- Static PE analysis found neither likely packing nor high-entropy code.
- Two independent major antivirus engines flagged the executable.
- The executable is unsigned despite code signing being applicable.
- The file was first observed on Sep 12, 2026 and has only one recorded submission.
- Zillya identified Backdoor.XWorm.Win32.3294.
- No completed observation from the test run is available.
- No comprehensive contacted-host reputation result is available.
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
5 of the 67 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 5
- Kaspersky (major engine)HEUR:Trojan.Win32.Generic
- Microsoft (major engine)Trojan:Win32/Wacatac.B!ml
- APEXMalicious
- BkavW32.Malware.BED9F530
- ZillyaBackdoor.XWorm.Win32.3294
File fingerprint
- Last analyzed
- Sep 12, 2026, 2:16 PM UTC
- SHA-256
88bb9857462187e794de2769a88c0374510870d1bdff3497e5536f7f7c422f65- SHA-1
338d5a0d0f6b529dc51cbc6f17e676dd0df1885f- MD5
05bf88f8e6c0b33a5a8d5de0f9a8d6d7
About this file
Chrono_Cross_Radical_Dreamers_Edition_HUN_Steam.exe is a Win32 EXE file of 65.0 MB.
- Type and size
- Win32 EXE · 65.0 MB
- Signer
- UnsignedNo code signature.
- First seen
- Sep 12, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Chrono_Cross_Radical_Dreamers_Edition_HUN_Steam.exe safe, or is it malware?
What is Chrono_Cross_Radical_Dreamers_Edition_HUN_Steam.exe?
How many antivirus engines detected Chrono_Cross_Radical_Dreamers_Edition_HUN_Steam.exe?
What should I do if I already ran Chrono_Cross_Radical_Dreamers_Edition_HUN_Steam.exe?
What is the SHA-256 hash of Chrono_Cross_Radical_Dreamers_Edition_HUN_Steam.exe?
How up to date is this analysis of Chrono_Cross_Radical_Dreamers_Edition_HUN_Steam.exe?
Community
Member reviews and reports for this exact file hash.