File scan report
Verdict Safe
Is nw.
This widely distributed NW.js runtime executable, first seen on May 15, 2021, is flagged by none of the 71 antivirus engines that checked it and showed a clean combined sandbox…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
This file can be kept if it came with an application you trust; download such apps only from their original source and keep your antivirus protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged this file, and it has been submitted by thousands of independent sources since May 15, 2021. The sandbox runs produced a clean combined verdict, and the only injection recorded targeted the program's own process, which is normal for Chromium-based app runtimes.
All 18 major antivirus engines and every other reporting engine returned no detection. The file is very common, with 3,650 distinct submitters over more than five years, which is typical of a legitimate runtime component shipped with many applications. The combined sandbox verdict was clean, and the recorded injection only involved the sample's own process rather than a separate system or user process. All 39 contacted hosts were checked against our reputation cache with no malicious or suspicious results, and no external threat database lists the hash. The lack of a code signature is the main gap, but it does not outweigh this body of clean evidence.
What We Detected
None of the 71 antivirus engines that checked it flagged this 64-bit Windows executable, including all 18 major antivirus engines. It has been submitted by 3,650 distinct sources since it was first seen on May 15, 2021, and no public malware database or community rule set lists it. The file is not code-signed.
Threat Behavior
The combined sandbox verdict was clean. One of our behaviour rules noted code injection, but the only target was the program's own process, consistent with how multi-process Chromium-based runtimes such as NW.js operate. Network contacts went to Microsoft and Mozilla infrastructure, and all 39 checked hosts had no malicious or suspicious reputation. No persistence was recorded.
What To Do Now
No action is needed if this file came with an application you installed. As with any unsigned executable, keep it only if you obtained it from the application's original source, and keep your security software enabled.
Where this verdict could be wrong2 caveats
- The file is unsigned, so no publisher identity backs it.
- One of our behaviour rules recorded code injection, though the only target named is the program's own process, which multi-process Chromium-based runtimes routinely do.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file.
- Submitted by 3,650 independent sources since May 15, 2021.
- The combined sandbox verdict was clean.
- All 39 contacted hosts checked had no malicious or suspicious reputation.
- No listing in public malware databases or malware-specific rule sets.
- The executable carries no digital signature identifying its publisher.
- The sandbox recorded the program injecting code into its own process, a pattern that also appears in malware but here names no outside target.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 21sandbox rule tags
- 4spawned processes
- 25network contacts
- 34filesystem & mutex artifacts
Includes the sandbox verdicts, 21 mapped techniques, every process, file, registry and network entry and 3 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 24, 2026, 10:11 PM UTC
- SHA-256
95594fb98d0e77575e1fde1602dfaa8c01cef66b0159db0e7bbe0a0a6f76573b- SHA-1
a2df0c4dc933b3dbc746f41864907a6a22977384- MD5
5721d83bd9e88c5be3a08fc206e0a39d
About this file
nw.exe says it is nwjs, 2.2 MB.
- Claims to be
- nwjsFrom the file's own version information, written by whoever built it.
- Original name
- nw.exeMatches the shared file name.
- Type and size
- Win32 EXE · 2.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- May 15, 2021On VirusTotal.
- Submitted by
- 3,650 distinct sources
- Packer
- None detected
- Entropy
- 6.20 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is nw.exe safe?
What is nw.exe?
How many antivirus engines detected nw.exe?
What is the SHA-256 hash of nw.exe?
Is it safe to run nw.exe?
How up to date is this analysis of nw.exe?
Community
Member reviews and reports for this exact file hash.