File scan report
Verdict Suspicious
Is The_
A verified, older installer has scant antivirus detection, but two malware-specific YARA matches and mapped injection-related techniques warrant caution before execution.
Read the whole reasonShow less
Why Suspicious? 2 antivirus engines flag it, but no major engine agrees and a community rule for known malware matched it.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
Verify the installer against a fresh copy from the original distributor before running it. If its source or signature differs, delete it and keep security protection enabled.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already installed it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 73 flagged
- Flagged 2
- No detection 71
- No result 4
- Code signing Sekai Project, Inc.
- Test run Completed
- First seen 9y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 2 of the 73 antivirus engines that checked it flagged this signed installer, and none were major antivirus engines. However, two malware-specific YARA patterns matched, and the test run mapped and T1134, so the file should not be run until its download source and signature are independently verified.
The antivirus result is weakly adverse: CrowdStrike and Zillya flagged the sample, but none of the major antivirus engines did and no family consensus exists. The Sekai Project signature verifies, and the sample has been observed since 2017, both of which reduce the likelihood of a newly distributed impersonator. Against that, two malware-specific YARA rules matched shellcode or suspicious string patterns. The test run mapped process injection and token-related activity, although no injection target was recorded and the sole sandbox run returned clean. The complete host check found no malicious or suspicious matches among the eight listed contacts. These mixed signals justify withholding trust while avoiding a stronger malware attribution.
What We Detected
Two of the 73 antivirus engines that checked it flagged the installer. CrowdStrike used a grayware label and Zillya used a generic dropper label; none of the major antivirus engines flagged it, and there is no agreed malware family.
The file carries a verified Sekai Project signature and dates to 2017. However, no historical signer record is available to establish a consistently clean publisher history.
Threat Behavior
Static research rules named shellcode and ScanStringsInsocks5systemz matched the file. The test run also mapped MITRE techniques T1055 and T1134, which can relate to process injection and token manipulation, but no injected target process was identified. The completed sandbox run returned clean, and all eight listed contacts received host-reputation coverage without malicious or suspicious matches; several contacts were analysis-environment background traffic rather than sample activity.
What To Do Now
Do not execute the installer unless it came from a trusted purchase account or an official distribution channel and Windows still shows the Sekai Project signature as valid. Keep security software enabled, and obtain a fresh installer from the original source if the file's provenance is uncertain.
Where this verdict could be wrong4 caveats
- Only two antivirus products raised generic or grayware-style detections, while all 18 reporting major antivirus engines did not flag the file.
- The digital signature verifies as Sekai Project, and the sample has been known since 2017 rather than appearing recently.
- The completed sandbox run returned clean, and no injected process target was recorded despite the mapping.
- All eight observed contacts were covered by the host-reputation check, with no malicious or suspicious host matches.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The digital signature verifies as Sekai Project.
- None of the major antivirus engines flagged the file.
- The sample has been observed since 2017 rather than appearing recently.
- The completed sandbox run returned clean and recorded no injected target process.
- The host-reputation check covered all eight listed contacts and found no malicious or suspicious matches.
- Two antivirus products raised grayware or generic dropper detections.
- Two malware-specific research rules matched shellcode-related or suspicious string patterns.
- The test run mapped process-injection and token-manipulation techniques.
- No established historical safety record is available for the signer.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 17sandbox rule tags
- 8spawned processes
- 2network contacts
- 27filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Note: Read the user name of the test computer.
Note: Listed the programs running on the test computer.
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
The_Labyrinth_of_Grisaia_Unrated_Installer.exe
90c08985e1c19b3cb2bda1032c1d1a0c01655249c505fd1b0382f78066383346
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
software.exe
"C:\Users\<USER>\Desktop\software.exe"
Test run - Evidence 3 of 7: ProcessSeen in the test run
software.tmp
"C:\Users\<USER>\AppData\Local\Temp\is-5LUB2.tmp\software.tmp" /SL5="$2D00EA,76800,0,C:\Users\<USER>\Desktop\software.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
software.tmp
C:\Users\<USER>\AppData\Local\Temp\is-5LUB2.tmp\software.tmp
Test run - Evidence 5 of 7: Written fileSeen in the test run
_setup64.tmp
C:\Users\<USER>\AppData\Local\Temp\is-5VVR9.tmp\_isetup\_setup64.tmp
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
142.251.183.94
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
<MACHINE_DNS_SERVER>
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 17 mapped techniques, every process, file, registry and network entry and 2 dropped files.
Show the technical evidenceChapter 04
Technical details
2 of the 73 antivirus engines that checked it flag it; signed by Sekai Project, Inc..
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
- CrowdStrikewin/grayware_confidence_60% (D)
- ZillyaDropper.Generic.Win32.13853
File fingerprint
- Last analyzed
- Oct 17, 2026, 1:47 PM UTC
- SHA-256
90c08985e1c19b3cb2bda1032c1d1a0c01655249c505fd1b0382f78066383346- SHA-1
b6185f8ade1e237861c5d2906ecd0f9dafe9c0f7- MD5
f901208ad80bd29810441d0dd5911ad1
About this file
The_Labyrinth_of_Grisaia_Unrated_Installer.exe is a Win32 EXE file of 343.0 kB.
- Type and size
- Win32 EXE · 343.0 kB
- Signer
- Sekai Project, Inc.Valid code signature.
- First seen
- Jun 1, 2017On VirusTotal.
- Submitted by
- 8 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 6.09 of 8
First scanned Updated
Includes every engine result (77), 7 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is The_Labyrinth_of_Grisaia_Unrated_Installer.exe safe, or is it malware?
What is The_Labyrinth_of_Grisaia_Unrated_Installer.exe?
How many antivirus engines detected The_Labyrinth_of_Grisaia_Unrated_Installer.exe?
What should I do if I already installed The_Labyrinth_of_Grisaia_Unrated_Installer.exe?
Is The_Labyrinth_of_Grisaia_Unrated_Installer.exe digitally signed?
What is the SHA-256 hash of The_Labyrinth_of_Grisaia_Unrated_Installer.exe?
How up to date is this analysis of The_Labyrinth_of_Grisaia_Unrated_Installer.exe?
Community
Member reviews and reports for this exact file hash.