File scan report
Verdict Malicious
Is Pv
Microsoft confirms game-hacking functionality, while 29 of the 71 antivirus engines that checked it flag the unsigned executable and evidence from the test run records injection…
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
Keep it only if you installed it on purpose for security testing. Otherwise delete it and run a full antivirus scan.
What to do now4 steps
This is a hacking tool. It is risky to keep and run, but finding it is not by itself a sign that the device is infected.
What to do
Don't run it unless you got it on purpose for security testing on systems you own. Delete it, then empty the Recycle Bin.
If you didn't put it on the device yourself, delete it and run a full antivirus scan: something else may have brought it.
Tools like this often come with cracked or pirated software. If it came that way, treat the whole download as unsafe and scan everything it installed.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
29 of 71 flagged
- Flagged 29
- No detection 42
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Microsoft identifies the executable as GameHack, satisfying the corroborated hacking tool criterion, and 29 of the 71 antivirus engines that checked it flag it across 23 independent detections.
The strongest evidence is Microsoft's major GameHack identification, which confirms the executable as an offensive game-hacking tool. Overall, 29 of the 71 antivirus engines that checked it flagged it, including five major detections and 23 independent engine votes. Several engines additionally use Jaik or generic trojan labels, although the Jaik attribution does not have strong independent major family consensus. A completed sandbox run returned clean and found no high-risk MITRE techniques, but it recorded injection into an updater process. The complete host-reputation cross-check found no flagged hosts, and no malicious child or external-intelligence match was present; these reduce confidence in a conventional trojan attribution but do not neutralize the confirmed hacking tool evidence.
What We Detected
Twenty-nine of the 71 antivirus engines that checked it flagged this unsigned Win32 executable, representing 23 independent detections. Microsoft identifies it as HackTool:Win32/GameHack!MTB, while BitDefender reports Gen:Variant.Jaik.292588 and several other engines use generic trojan or unwanted program labels. The Microsoft label is sufficient confirmation of game-hacking functionality under the offensive-tool criteria.
Threat Behavior
One completed sandbox run returned clean and did not map any high-risk MITRE techniques. All eight observed hosts received reputation coverage, and none was flagged as malicious or suspicious; background traffic was not treated as sample activity.
What To Do Now
Do not execute this file on a gaming account, personal computer, or work system. Keep security software enabled, quarantine or remove the executable, and run a full scan if it was already launched; also review affected game accounts for unauthorized activity.
Where this verdict could be wrong4 caveats
- The completed sandbox run returned clean and recorded no high-risk MITRE techniques.
- The file is established rather than with 103 submitters and 108 submissions.
- No packer or high-entropy code was identified, and no malicious file it created was recorded.
- MalwareBazaar and YARAify supplied no corroborating hit, while the Jaik family attribution lacks strong major consensus.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- One completed sandbox run returned clean and recorded no high-risk techniques.
- All eight observed hosts were covered by reputation checks, with none flagged.
- No malicious file it created, persistence indicator, packer, or high-entropy code was found.
- The file has been observed for years across more than 100 submitters.
- Research feeds supplied no matching malware-specific rule or sample record.
- Microsoft identifies the executable as a game-hacking tool.
- Twenty-nine of the 71 antivirus engines that checked it flag the file, spanning 23 independent detections and five major antivirus engines.
- The executable is unsigned and has no established publisher history.
- Runtime records show injection into another process.
- Several engines apply Jaik or generic trojan labels.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 5sandbox rule tags
- 3spawned processes
- 0network contacts
- 14filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Checked whether it was running on a test computer.
Note: Listed the programs running on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How hacking tools are used
Hacking tools are programs that can switch off security software, test passwords or attack other computers. Security professionals use them on purpose; criminals also bundle them with malware.
Bottom line:Keep it only if you installed it on purpose, and check how it got onto the device if you didn't.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 4: FileSeen in the test run
PvZTrainer.exe
8f0dcb0ac6bddb06e80b3664608b8efc1c18dc0420eb39ac7a86a3e0b8984fac
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 4: ProcessSeen in the test run
software.exe
"C:\Users\<USER>\Desktop\software.exe"
Test run - Evidence 3 of 4: ProcessSeen in the test run
PvZTrainer.exe
Test run - +1 more recorded observation
- 1
Files
Created or changed
- Evidence 4 of 4: Written fileSeen in the test run
Connect
\Device\ConDrv\\Connect
Test run
4 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 5 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
29 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 29
- BitDefender (major engine)Gen:Variant.Jaik.292588
- Emsisoft (major engine)Gen:Variant.Jaik.292588 (B)
- GData (major engine)Gen:Variant.Jaik.292588
- Microsoft (major engine)HackTool:Win32/GameHack!MTB
- Sophos (major engine)Generic Reputation PUA (PUA)
- Symantec (major engine)Trojan.Gen.MBT
- TrellixENS (major engine)Artemis!CAF49018D291
- TrendMicro-HouseCall (major engine)TROJ_GEN.R002H09FL25
File fingerprint
- Last analyzed
- Oct 10, 2026, 8:39 PM UTC
- SHA-256
8f0dcb0ac6bddb06e80b3664608b8efc1c18dc0420eb39ac7a86a3e0b8984fac- SHA-1
00b15659892f459a38b7a12e975da84f9e695f15- MD5
caf49018d291a09f4b30d895a3b2f6a9
About this file
PvZTrainer.exe is a Win32 EXE file of 17.4 kB.
- Type and size
- Win32 EXE · 17.4 kB
- Signer
- UnsignedNo code signature.
- First seen
- Jan 16, 2023On VirusTotal.
- Submitted by
- 103 distinct sources
- Packer
- None detected
- Entropy
- 5.38 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is PvZTrainer.exe a virus?
What is PvZTrainer.exe?
How many antivirus engines detected PvZTrainer.exe?
What should I do if I already ran PvZTrainer.exe?
How do I remove PvZTrainer.exe?
What kind of program is PvZTrainer.exe?
What is the SHA-256 hash of PvZTrainer.exe?
How up to date is this analysis of PvZTrainer.exe?
Community
Member reviews and reports for this exact file hash.