File scan report
Verdict Safe
Is officedeploymenttool_
Microsoft-signed Office Deployment Tool with zero detections and strong signer history.
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 68 flagged
- Flagged 0
- No detection 68
- No result 7
- Code signing Microsoft Corporation
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
0 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 68 antivirus engines that checked it returned clean. The file is signed by Microsoft Corporation, a trusted publisher, and matches four prior safe verdicts under the same signer. Prevalence is widely seen but new with hundreds of submissions.
Zero malicious detections across 75 reporting engines, including 16 major antivirus engines, eliminates any engine-based threat signal. The verified Microsoft signature and 10/11 historical safe samples for this signer provide strong authenticity evidence. Four of five similar-hash records under the same signer also returned safe verdicts with the benign-signed-installer reason code. The single dissenting similar-hash entry is a different file type flagged by external CIRCL data, not relevant to this binary. The file is widely distributed (widely seen but new) and shows no sandbox malice or malicious files it created.
What We Detected
75 antivirus engines scanned the 3.5 MB executable; none flagged it malicious or suspicious. The binary carries a valid, verified code-signing certificate issued to Microsoft Corporation. Sandbox execution produced only routine system queries and two MITRE techniques (T1134, T1547.001) commonly seen in legitimate installers.
Threat Behavior
no complete contacted-host reputation result was available, IPs, or URLs were contacted. One file it created was dropped and inspected; it received no malicious verdict. No persistence mechanisms or offensive tooling were observed.
What To Do Now
The file can be executed if obtained from an official Microsoft source. Keep Windows Defender and other security software enabled; no disabling is required or recommended.
Where this verdict could be wrong1 caveat
- One similar-hash entry (44422e6936dc…) returned malicious with reason ai_unavailable:circl_known_malicious, but that file is d3dcompiler_47.dll, not the same binary.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Microsoft Corporation trusted-publisher match
- 4 prior safe verdicts under identical signer
- Zero engine detections across 75 scanners
- Widely distributed (widely seen but new)
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 14sandbox rule tags
- 2spawned processes
- 0network contacts
- 3filesystem & mutex artifacts
Includes 14 mapped techniques, every process, file, registry and network entry and 1 dropped file.
Show the technical evidenceChapter 04
Technical details
None of the 68 antivirus engines that checked it flag it; signed by Microsoft Corporation.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Aug 31, 2026, 1:02 PM UTC
- SHA-256
92a3cbd56191533e36bde1c6e4640883c900c00d1b5d43a974c870893681e0d4- SHA-1
d5131c91dc59e6b9c757dd0e69afcd26053c7d93- MD5
7075faf3efcdc90f964c30491d6b7126
About this file
officedeploymenttool_20228-20124.exe is a Win32 EXE file of 3.5 MB.
- Type and size
- Win32 EXE · 3.5 MB
- Signer
- Microsoft CorporationValid code signature.
- First seen
- Aug 11, 2026On VirusTotal.
- Submitted by
- 327 distinct sources
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is officedeploymenttool_20228-20124.exe safe?
What is officedeploymenttool_20228-20124.exe?
How many antivirus engines detected officedeploymenttool_20228-20124.exe?
Is officedeploymenttool_20228-20124.exe digitally signed?
What is the SHA-256 hash of officedeploymenttool_20228-20124.exe?
Is it safe to run officedeploymenttool_20228-20124.exe?
How up to date is this analysis of officedeploymenttool_20228-20124.exe?
Community
Member reviews and reports for this exact file hash.