File scan report
Verdict Safe
Is MSPAINT.
Unsigned but widely submitted Windows executable matching a known Microsoft mspaint path with zero engine detections.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Allow the file if located in standard Windows directories; otherwise replace it from official Microsoft sources.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Zero of the 70 antivirus engines that checked it flagged the file. External intelligence links it to a legitimate Windows system component path. Sandbox behaviour shows some suspicious techniques but no malicious verdicts or children.
The complete absence of malicious detections across major and smaller engines combined with a CIRCL hit pointing to a Microsoft WinSxS mspaint.exe location strongly indicates a legitimate system file. No dropped malicious files it created or malicious sandbox consensus exist. The file therefore aligns with a clean classification despite minor behavioural anomalies.
What We Detected
External CIRCL intelligence matched the file to the Microsoft Windows component path amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.746_none_6c16d1714d60fddf/mspaint.exe. The binary is unsigned and contacted 19 external IPs without using DNS.
Threat Behavior
Sandbox execution recorded MITRE techniques T1003 (OS Credential Dumping) and T1547.001 (Boot or Logon Autostart Execution) plus direct-IP network activity. Ten dropped files were inspected; none were malicious. No persistence mechanisms or registry modifications were observed.
What To Do Now
The file can be treated as a legitimate Windows component. Verify its location against C:\Windows\System32 or WinSxS directories. If the file appears outside expected system paths, replace it from a trusted Windows source.
Where this verdict could be wrong2 caveats
- Unsigned file with direct-IP contacts (19 IPs, 0 domains) and MITRE T1003/could indicate greyware or modified binary despite the CIRCL Microsoft path match.
- Multiple communityComments flag the sample as SUSPICIOUS with tags evasive/greyware, though none cite a malware family.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero malicious engine detections
- CIRCL match to known Microsoft mspaint.exe path
- Common_old prevalence with hundreds of submissions
- No malicious files it created or sandbox verdicts
- Unsigned binary
- Direct-IP network contacts without DNS
- and observed in sandbox
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 18sandbox rule tags
- 3spawned processes
- 5network contacts
- 20filesystem & mutex artifacts
Includes 18 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jul 9, 2026, 9:24 AM UTC
- SHA-256
94aa32a2c9c1d2db78318d9c68262c2f834abe26b6e9a661700324b55fdd5709- SHA-1
2098e4b62eaab213cbee73ba40fe4f1b8901a782- MD5
f221a4ccafec690101c59f726c95b646
About this file
MSPAINT.EXE is a Win32 EXE file of 988.2 kB.
- Type and size
- Win32 EXE · 988.2 kB
- Signer
- UnsignedNo code signature.
- First seen
- Jan 13, 2021On VirusTotal.
- Submitted by
- 351 distinct sources
- Packer
- None detected
- Entropy
- 5.78 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is MSPAINT.EXE safe?
What is MSPAINT.EXE?
How many antivirus engines detected MSPAINT.EXE?
What is the SHA-256 hash of MSPAINT.EXE?
Is it safe to run MSPAINT.EXE?
How up to date is this analysis of MSPAINT.EXE?
Community
Member reviews and reports for this exact file hash.