File scan report
Verdict Safe
Is Block
No engine detected this unobfuscated PowerShell utility, and the test run found no corroborated injection, hostile host, malicious child, or malware-specific signature.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 49 flagged
- Flagged 0
- No detection 49
- No result 26
- Code signing Unsigned
- Test run Completed
- First seen 6d ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 49 antivirus engines that checked it flagged the script, and the completed observations from the test run produced no malicious verdict or corroborated high-risk action. It can download and execute content and is unsigned and so obtain it from the official project channel and review it before running with administrator rights.
None of the 49 antivirus engines that checked it flagged the script, including the major antivirus engines that returned results. Our static analysis found unobfuscated download-and-run functionality, but no decisive hostile pattern or malware-specific rule. Observations from the test run did not identify a named injection target, persistent mechanism, malicious child, or malicious sandbox result. Reputation checks covering the observed non-background hosts found no hostile entry, and the external intelligence sources produced no match. The main caveats are that the script is unsigned, and designed to alter firewall rules with elevated privileges.
What We Detected
None of the 49 antivirus engines that checked it flagged this PowerShell script. Our static analysis found readable, unobfuscated functionality that can download and execute content, but it found no decisive hostile pattern or malware-specific signature.
Threat Behavior
The observations from the test run produced no malicious result and recorded no named injection target or corroborated high-risk technique. The T1055 mapping lacked an injection target and therefore does not demonstrate process injection. Checks covering the observed non-background hosts found no malicious or suspicious reputation entry.
What To Do Now
Obtain the script only from the official project channel, compare its hash when possible, and inspect the intended firewall changes before execution. Because it requires elevated privileges and changes firewall rules, run it only if you understand and want those changes, while keeping security software enabled.
Where this verdict could be wrong2 caveats
- Our static analysis found that the script can download and execute content, a capability that warrants caution even though it was unobfuscated and no decisive hostile pattern was found.
- The file is unsigned and was first observed very recently, so its origin and broader history are not established.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 49 antivirus engines that checked it flagged the file.
- The script is unobfuscated, and our static analysis found no decisive hostile pattern.
- Observations from the test run produced no malicious result or named injection target.
- Reputation checks covering the observed non-background hosts found no malicious or suspicious entry.
- No malware-specific community rule or public malware-sample database match was found.
- The script is unsigned, so its publisher is not authenticated.
- It was first observed very recently and has only one recorded submitter.
- It can download and execute content.
- It is intended to modify Windows Firewall rules and may be run with administrator privileges.
7 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 11sandbox rule tags
- 1spawned processes
- 1network contact
- 14filesystem & mutex artifacts
Includes 11 mapped techniques, every process, file, registry and network entry and 4 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 49 antivirus engines that checked it flag it; no publisher signature.
What the file contains
We opened the uploaded PowerShell script in an isolated sandbox and read its structure without running it.
- LowT1059.001 · Runs commandsT1105 · Network file transfer
The script downloads content and runs it in the open. Installer and setup one-liners do this too, so on its own it is only a weak signal.
Matched: powershell script; download + run
5 links found. Only domains are shown; paths and query strings are never published.
Checked on Oct 20, 2026 while the file was uploaded. MalwareTips deleted its copy afterwards; VirusTotal keeps the uploaded file.
Sources checked
Every check behind this verdict
7 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 20, 2026, 9:00 AM UTC
- SHA-256
96df1163ea8ed85efe1a83aab99f228d2b21ea921724a4bfbb37d47b47fb27f7- SHA-1
8fd814aee41486684dd45513f802db1484ef6380- MD5
562e0c504d463d9b890a831e4fadd00b
About this file
BlockFolderWindowsFirewall.ps1 is a Powershell file of 30.4 kB.
- Type and size
- Powershell · 30.4 kB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 20, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is BlockFolderWindowsFirewall.ps1 safe?
What is BlockFolderWindowsFirewall.ps1?
How many antivirus engines detected BlockFolderWindowsFirewall.ps1?
What is the SHA-256 hash of BlockFolderWindowsFirewall.ps1?
Is it safe to run BlockFolderWindowsFirewall.ps1?
How up to date is this analysis of BlockFolderWindowsFirewall.ps1?
Community
Member reviews and reports for this exact file hash.