File scan report
Verdict Safe
Is Greenshot-
This Greenshot installer has a valid signature from Thomas Braun, none of the 71 antivirus engines that checked it flag it, and it is widely submitted.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
This installer can be used as normal; obtain it from the official Greenshot website and confirm the Thomas Braun signature before running it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Thomas Braun
- Test run Completed
- First seen 7mo ago
Chapter 02
Why we think so
0 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
It carries a valid code signature from Thomas Braun, the Greenshot maintainer, and has been submitted by nearly 2,800 distinct sources. The sandbox runs show the expected installer flow: it installs Greenshot, opens the vendor's thank-you page and checks the official update feed.
No engine detects this file, including all 18 major antivirus engines that returned a result. The signature verifies and names Thomas Braun, who publishes Greenshot, though our own history with this signer is limited. Activity in the test run in the combined sandbox summary is typical of an Inno Setup installer: it extracts a temporary setup stage, writes Greenshot program files, launches the app and opens the vendor's website. No injection target or other high-risk technique was recorded. The raw-IP traffic aligns with the browser loading web content, and only part of the contacted hosts were checked against our reputation cache.
What We Detected
None of the 71 antivirus engines that checked it flagged this file. It carries a valid code signature from Thomas Braun and has been seen from about 2,776 distinct sources over 215 days. Community YARA matches are generic compiler and certificate-issuer rules.
Threat Behavior
The sandbox runs show a standard Inno Setup installation. It installs Greenshot and its libraries into the user's program folder, starts Greenshot, opens the vendor's thank-you page in Edge and queries the official update feed. No process injection target, persistence or high-risk technique was recorded. Not every contacted host had a reputation check available.
What To Do Now
The installer appears to be the legitimate Greenshot release. Download it from the official Greenshot site, keep your antivirus enabled, and check that the signature shows Thomas Braun before running it.
Where this verdict could be wrong2 caveats
- Our history holds only one prior sample from this signer, so the signature is not backed by an established track record with us.
- The sandbox recorded traffic to many raw IP addresses, but it fits the browser loading the vendor's thank-you page through content-delivery and Google infrastructure.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file
- Valid code signature from Thomas Braun, the Greenshot maintainer
- Widely submitted by about 2,776 distinct sources over seven months
- Installation behaviour matches a normal Inno Setup installer that contacts the official Greenshot site
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 31sandbox rule tags
- 9spawned processes
- 21network contacts
- 33filesystem & mutex artifacts
Includes 31 mapped techniques, every process, file, registry and network entry and 9 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Thomas Braun.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 11, 2026, 3:25 PM UTC
- SHA-256
9bb4971e729a2ad1612e8aa2fa490b69c33af7f42515f9b642c7d0f80f8c0fd3- SHA-1
aba2ba820d6c0ac326550920faf989d103cdd144- MD5
afd9ccf186d4924c01dcf84c7dcc19d4
About this file
Greenshot-INSTALLER-1.3.315-RELEASE.exe is a Win32 EXE file of 4.0 MB.
- Type and size
- Win32 EXE · 4.0 MB
- Signer
- Thomas BraunValid code signature.
- First seen
- Mar 20, 2026On VirusTotal.
- Submitted by
- 2,776 distinct sources
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Includes every engine result (75), 9 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is Greenshot-INSTALLER-1.3.315-RELEASE.exe safe?
What is Greenshot-INSTALLER-1.3.315-RELEASE.exe?
How many antivirus engines detected Greenshot-INSTALLER-1.3.315-RELEASE.exe?
Is Greenshot-INSTALLER-1.3.315-RELEASE.exe digitally signed?
What is the SHA-256 hash of Greenshot-INSTALLER-1.3.315-RELEASE.exe?
Is it safe to install Greenshot-INSTALLER-1.3.315-RELEASE.exe?
How up to date is this analysis of Greenshot-INSTALLER-1.3.315-RELEASE.exe?
Community
Member reviews and reports for this exact file hash.