Is MaxALERT_V1.1_RELEASE.zip safe?
Nine of 75 engines raised inconsistent generic alerts, while tier-1 products and external intelligence offered no corroboration; one sandbox nevertheless observed defense-evasion technique T1562.001.
The archive has mixed evidence: 9 of 75 engines detected it, but none of the 17 tier-1 engines did, and the labels disagree. One sandbox observed T1562.001, yet produced no malicious runtime verdict; the extracted children remain unclassified, so the archive should not be opened on a normal system.
92e04f7fcae32e36eb…a0597e2c5dd2fcRecommended next actions
Before opening or extracting
Do not open or extract it until the source can be verified independently.
If you already opened or extracted it
Stop using it, scan the device, and watch for unexpected behavior or security alerts. Get a fresh copy from the original trusted source and verify its exact hash when possible.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The archive has mixed evidence: 9 of 75 engines detected it, but none of the 17 tier-1 engines did, and the labels disagree. One sandbox observed T1562.001, yet produced no malicious runtime verdict; the extracted children remain unclassified, so the archive should not be opened on a normal system.
Nine of 75 engines flagged the ZIP, including five tier-2 engines, so the alerts cannot be dismissed as exclusively low-trust noise. However, all 17 tier-1 engines were silent, no family consensus formed, and the labels range from generic MSIL detections to unrelated Agent, VBRA, and Viking names. One completed sandbox observed T1562.001, a defense-evasion technique, but issued no malicious verdict and recorded no persistence. None of the external intelligence services supplied corroboration. The ten extracted children were inspected but remain unknown, and no complete contacted-host reputation result is available. These conflicting indicators justify isolation and further verification rather than execution or a definitive malware-family attribution.
What We Detected
9 of 75 antivirus engines flagged the archive. Five detections came from tier-2 engines and four from low-trust engines, while all 17 tier-1 engines reported no detection. The labels are inconsistent, naming generic malware, Agent, VBRA, an MSIL heuristic, and Viking, so they do not establish a dependable threat family.
Threat Behavior
One completed sandbox run observed T1562.001, associated with impairing defenses, alongside packing, system-information, and analysis-evasion activity. The sandbox did not issue a malicious verdict and recorded no persistence indicators or network contacts. Ten files were extracted, but each child remains unclassified; there is also no complete contacted-host reputation result available.
What To Do Now
Do not open or extract this archive on a production device. Keep endpoint protection enabled, verify the SHA-256 and download source against the developer's official release channel, and obtain a newly signed or independently verified copy if authenticity cannot be established.
Where this verdict could be wrong4 caveats
- T1562.001 is an offensive runtime technique and raises concern even though the sandbox did not issue a malicious verdict.
- Nine engine detections include five tier-2 products, so this is not a low-trust-only false-positive pattern.
- All ten inspected dropped children remain unknown rather than confirmed benign, limiting the value of droppedChildren.hasMaliciousChild=false.
- contactedHosts=null means no complete reputation assessment of potential network hosts is available.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- engines.tier1Malicious=0 across 17 tier-1 engines.
- engines.tier1FamilyConsensus.strong=false and detection labels conflict.
- behaviour.hasMaliciousSandboxVerdict=false in one completed sandbox.
- droppedChildren.hasMaliciousChild=false, with no child confirmed malicious.
- externalIntel.yaraify.ruleCount=0, externalIntel.circl.hit=false, and externalIntel.malwareBazaar.hit=false.
- 9/75 antivirus engines reported detections.
- Five detections came from tier-2 engines rather than only low-trust products.
- Sandbox observation included defense-evasion technique T1562.001.
- Archive contents include executable PE files.
- All ten extracted child files remain unclassified.
- No complete contacted-host reputation cross-check is available.
Quarantine the archive and do not execute its contents on a normal system. Keep security protection enabled and replace it with a copy whose hash and origin can be verified through the publisher's official channel.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete9 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Not runNo contacted-host reputation check is recorded.
No timestamp recordedYARA
CompleteRule evaluation completed with no recorded matches.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 5MITRE ATT&CK techniques
- 4spawned processes
- 0network contacts
- 16filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Attempted to impair or bypass security controls.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Note: Collects details about your system.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
MaxALERT_V1.1_RELEASE.zip
92e04f7fcae32e36eb0ddda392eb067e218a5ca00190a52a3da0597e2c5dd2fc
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
C:\Users\<USER>\AppData\Local\Temp\IXP000.TMP\Install.exe
02Isolated runtime analysis - ProcessObserved
Observed process
C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\MaxALERT_V1.1_RELEASE.zip"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
mscoree.dll
C:\Users\<USER>\AppData\Local\Temp\IXP000.TMP\mscoree.dll
04Isolated runtime analysis - Written fileObserved
install.exe
C:\Users\<USER>\AppData\Local\Temp\IXP000.TMP\install.exe
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
5 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\Users\<USER>\AppData\Local\Temp\IXP000.TMP\mscoree.dll
- C:\Users\<USER>\AppData\Local\Temp\IXP000.TMP\install.exe
- C:\Users\<USER>\AppData\Local\Temp\IXP000.TMP\install.res.1033.dll
- C:\Users\<USER>\AppData\Local\Temp\IXP000.TMP\install.res.1025.dll
- C:\Users\<USER>\AppData\Local\Temp\IXP000.TMP\install.res.1028.dll
- SetupWatson_Mutex_Name
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- b4694750c1151663750e…6644e1Never scannednever seen before
- 2ba542658340d0b18e29…93ccc5Never scannednever seen before
- 709936902951fb684d0a…659331Never scannednever seen before
- 42cb26585f6a1ee530c9…faecb0Never scannednever seen before
- a33639bf24853e5d0356…b7dbeeNever scannednever seen before
- cf96e20ee18ea291fc29…c09d68Never scannednever seen before
- 46693d9b74d12454d117…9a0e71Never scannednever seen before
- 16ca09ad70561f413376…49e2aaNever scannednever seen before
- 134160a327410388a2aa…8795d9Never scannednever seen before
- 7d2c65654b759cea2df0…9d1ee4Never scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 0rule hits recorded
- 9 / 75engines flagged
- 49sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
9 of 75 antivirus engines flagged the file, including Bkav and Google.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 02
The hash has been submitted 62 times from 49 sources.
ProvenanceDerivedSourceSaved report factsObserved at - 03
Scanned file: MaxALERT_V1.1_RELEASE.zip — 92e04f7fcae32e36eb0ddda392eb067e218a5ca00190a52a3da0597e2c5dd2fc
ProvenanceObservedSourceUploaded fileObserved at - 04
Observed process — C:\Users\<USER>\AppData\Local\Temp\IXP000.TMP\Install.exe
ProvenanceObservedSourceIsolated runtime analysisObserved at - 05
Observed process — C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\MaxALERT_V1.1_RELEASE.zip"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
File written: mscoree.dll — C:\Users\<USER>\AppData\Local\Temp\IXP000.TMP\mscoree.dll
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: install.exe — C:\Users\<USER>\AppData\Local\Temp\IXP000.TMP\install.exe
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
The available sources did not agree on a named threat category.
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
YARA rules
No matchesThe rule pass completed without a saved public match.
9 of 75 engines flagged this file
View all 75 engine results
PE structure
Not applicablePE structure analysis applies to Windows executable formats, not this file type.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- MaxALERT_V1.1_RELEASE.zip
- Format
- ZIP
- Code signing
- Not applicable to this file type
- Size
- 39.3 MB
- Last analyzed
- Sep 14, 2026, 3:39 AM UTC
92e04f7fcae32e36eb0ddda392eb067e218a5ca00190a52a3da0597e2c5dd2fcSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
We couldn't fully clear this file. Treat it with caution.
- Recovery step 01
Don't open or extract it unless you're certain it came from a source you trust.
- Recovery step 02
Check where you got it — an unexpected attachment or a random download link is a red flag.
- Recovery step 03
If its origin cannot be confirmed, delete this archive and use a fresh copy from a trusted source. Get a fresh copy from the original trusted source and verify its exact hash when possible.
- Recovery step 04
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is MaxALERT_V1.1_RELEASE.zip safe, or is it malware?
What is MaxALERT_V1.1_RELEASE.zip?
How many antivirus engines detected MaxALERT_V1.1_RELEASE.zip?
I already downloaded and opened or extracted MaxALERT_V1.1_RELEASE.zip — what should I do?
How do I remove MaxALERT_V1.1_RELEASE.zip?
What is the SHA-256 hash of MaxALERT_V1.1_RELEASE.zip?
How up to date is this analysis of MaxALERT_V1.1_RELEASE.zip?
Community
Member reviews and reports for this exact file hash.