File scan report
Verdict Safe
Is Block
No engine detected this unobfuscated PowerShell utility, and the test run found no corroborated injection, hostile host, malicious child, or malware-specific signature.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 49 flagged
- Flagged 0
- No detection 49
- No result 26
- Code signing Unsigned
- Test run Completed
- First seen 6d ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 49 antivirus engines that checked it flagged the script, and the completed observations from the test run produced no malicious verdict or corroborated high-risk action. It can download and execute content and is unsigned and so obtain it from the official project channel and review it before running with administrator rights.
None of the 49 antivirus engines that checked it flagged the script, including the major antivirus engines that returned results. Our static analysis found unobfuscated download-and-run functionality, but no decisive hostile pattern or malware-specific rule. Observations from the test run did not identify a named injection target, persistent mechanism, malicious child, or malicious sandbox result. Reputation checks covering the observed non-background hosts found no hostile entry, and the external intelligence sources produced no match. The main caveats are that the script is unsigned, and designed to alter firewall rules with elevated privileges.
What We Detected
None of the 49 antivirus engines that checked it flagged this PowerShell script. Our static analysis found readable, unobfuscated functionality that can download and execute content, but it found no decisive hostile pattern or malware-specific signature.
Threat Behavior
The observations from the test run produced no malicious result and recorded no named injection target or corroborated high-risk technique. The T1055 mapping lacked an injection target and therefore does not demonstrate process injection. Checks covering the observed non-background hosts found no malicious or suspicious reputation entry.
What To Do Now
Obtain the script only from the official project channel, compare its hash when possible, and inspect the intended firewall changes before execution. Because it requires elevated privileges and changes firewall rules, run it only if you understand and want those changes, while keeping security software enabled.
Where this verdict could be wrong2 caveats
- Our static analysis found that the script can download and execute content, a capability that warrants caution even though it was unobfuscated and no decisive hostile pattern was found.
- The file is unsigned and was first observed very recently, so its origin and broader history are not established.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 49 antivirus engines that checked it flagged the file.
- The script is unobfuscated, and our static analysis found no decisive hostile pattern.
- Observations from the test run produced no malicious result or named injection target.
- Reputation checks covering the observed non-background hosts found no malicious or suspicious entry.
- No malware-specific community rule or public malware-sample database match was found.
- The script is unsigned, so its publisher is not authenticated.
- It was first observed very recently and has only one recorded submitter.
- It can download and execute content.
- It is intended to modify Windows Firewall rules and may be run with administrator privileges.
7 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 11sandbox rule tags
- 1spawned processes
- 1network contact
- 14filesystem & mutex artifacts
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1069
- T1082· System recon
- T1485
- T1497· Sandbox evasion
- T1518· Checks your AV
- T1562· Disables security
- T1573
- T1574· Execution hijack
Observed activity
Processes started
1Programs the file ran, with their command lines.
powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\Desktop\BlockFolderWindowsFirewall.ps1"
Network contacts
11 host, listed as 1 address. Links show the host and path only.
- IP address
23.11.33.159
Files
13Files the file created, changed or deleted.
- Written
C:\Users\<USER>\Desktop\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SL1J3WDT3BFNEWBHMATX.temp - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF140ad.TMP - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - Written
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Show all 13 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\idxwszcq.ut1.ps1 - Written
C:\Users\<USER>\AppData\Local\Temp\w1z0g1ro.ubv.psm1 - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF140ad.TMP - Deleted
C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update - Deleted
C:\Users\<USER>\AppData\Local\Temp\idxwszcq.ut1.ps1 - Deleted
C:\Users\<USER>\AppData\Local\Temp\w1z0g1ro.ubv.psm1
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
Global\OneSettingQueryMutex+compat+encapsulation
Sandbox background — not the file
10The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
Show all 10 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM host
8.8.8.8 - VM host
199.232.210.172
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 3500b19cfecb03270b58…7d23f4Not checkedno saved verdict
- 168561fb18f8eba8043f…740e3fNot checkedno saved verdict
- 74949e5f5fbb44ca15d2…de1588Not checkedno saved verdict
- 9b3cb225e50034475a21…2f3365Not checkedno saved verdict
Chapter 04
Technical details
None of the 49 antivirus engines that checked it flag it; no publisher signature.
What the file contains
We opened the uploaded PowerShell script in an isolated sandbox and read its structure without running it.
- LowT1059.001 · Runs commandsT1105 · Network file transfer
The script downloads content and runs it in the open. Installer and setup one-liners do this too, so on its own it is only a weak signal.
Matched: powershell script; download + run
5 links found. Only domains are shown; paths and query strings are never published.
Checked on Oct 20, 2026 while the file was uploaded. MalwareTips deleted its copy afterwards; VirusTotal keeps the uploaded file.
Sources checked
Every check behind this verdict
7 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 20, 2026, 9:00 AM UTC
- SHA-256
96df1163ea8ed85efe1a83aab99f228d2b21ea921724a4bfbb37d47b47fb27f7- SHA-1
8fd814aee41486684dd45513f802db1484ef6380- MD5
562e0c504d463d9b890a831e4fadd00b
About this file
BlockFolderWindowsFirewall.ps1 is a Powershell file of 30.4 kB.
- Type and size
- Powershell · 30.4 kB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 20, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 49 engines flagged this file
26 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-111 engines0flagged
- Tier-228 engines0flagged
- Low-trust10 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderNo result
- BitDefenderFalxNo result
- BkavNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCNo result
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaNo result
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSNo result
- TrendMicroNo result
- TrendMicro-HouseCallNo result
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Barely seen in the wild and first surfaced recently. That limits reputation evidence, but rarity alone is not proof of malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is BlockFolderWindowsFirewall.ps1 safe?
What is BlockFolderWindowsFirewall.ps1?
How many antivirus engines detected BlockFolderWindowsFirewall.ps1?
What is the SHA-256 hash of BlockFolderWindowsFirewall.ps1?
Is it safe to run BlockFolderWindowsFirewall.ps1?
How up to date is this analysis of BlockFolderWindowsFirewall.ps1?
Community
Member reviews and reports for this exact file hash.