File scan report
Verdict Safe
Is torawase.
Only 2 of the 67 antivirus engines that checked it flag this widely seen Windows program, with a single potentially-unwanted 'patched' label and no hostile behaviour across seven…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
The file appears benign; obtain games from official or trusted sources where possible and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 67 flagged
- Flagged 2
- No detection 65
- No result 8
- Code signing Unsigned
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only Ikarus (a potentially unwanted, patched-program label) and one less reliable machine-learning engine flag this file out of 75. It has been seen by 143 submitters since 2023, and seven sandbox runs showed game-engine style activity with no injection, persistence or hostile network contacts.
Two of the 67 antivirus engines that checked it flagged the file: Ikarus with a generic potentially unwanted 'patched' label and Trapmine with a machine-learning score; neither names a malware family. Fourteen other major antivirus engines reported it clean. The file has a long history, first seen in 2023 and submitted by 143 different sources. Seven sandbox runs recorded no high-risk techniques, no injection target and no persistence; the activity, including a YU-RIS engine program markers and Direct3D settings, looks like a visual-novel game. The contacted addresses match analysis background or content-delivery traffic, and none of the 20 checked hosts has a bad reputation.
What We Detected
2 of the 67 antivirus engines that checked it flagged this unsigned Windows executable: Ikarus labels it a potentially unwanted patched program, and Trapmine gives a moderate machine-learning score. No malware family is named, and 14 other major antivirus engines reported it clean. No public malware database or rule set lists it.
Threat Behavior
Seven sandbox runs showed behaviour typical of a game built on the YU-RIS visual-novel engine (its own program markers and Direct3D settings). No process injection target, dropped files or persistence was recorded, and none of the 20 contacted hosts checked has a malicious or suspicious reputation. The 'patched' label suggests the executable may have been modified from its original release, such as a fan translation or crack.
What To Do Now
The file appears benign. If you did not obtain it from the game's official source or a trusted translation project, prefer an official copy, and keep your antivirus enabled.
Where this verdict could be wrong1 caveat
- Ikarus labels the file as a patched program, so it may be a modified or cracked game executable rather than the original publisher's release, and it is unsigned.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 2 of the 67 antivirus engines that checked it flagged it, with no malware family named.
- Seen by 143 different submitters over roughly three years.
- Seven sandbox runs showed no high-risk techniques, injection or persistence.
- None of the 20 contacted hosts checked has a bad reputation.
- No listing in public malware databases or malware-specific rule sets.
- The file is not digitally signed.
- One engine labels it a patched program, suggesting it may be a modified version of the original executable.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 7 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 7isolated sandbox runs
- 16sandbox rule tags
- 2spawned processes
- 5network contacts
- 25filesystem & mutex artifacts
Includes the sandbox verdicts, 16 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
2 of the 67 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The Safe verdict weighed these detections and treats them as non-decisive.
- Ikarus (major engine)PUA.Patched
- Trapminemalicious.moderate.ml.score
File fingerprint
- Last analyzed
- Oct 23, 2026, 1:35 AM UTC
- SHA-256
9bb55dac98d08fa0548c5b63c2725910fbc2433dd34a614a2e8e6788440fe373- SHA-1
3ace1083c0e1243e82e719ce82aa6e05f2456d0d- MD5
15c79341b12e13b0de70da236b9a72fa
About this file
torawase.exe says it is YU-RIS Script Engine, 2.2 MB.
- Claims to be
- YU-RIS Script EngineFrom the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 2.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- Aug 25, 2023On VirusTotal.
- Submitted by
- 143 distinct sources
- Packer
- None detected
- Entropy
- 6.49 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is torawase.exe safe?
What is torawase.exe?
How many antivirus engines detected torawase.exe?
What is the SHA-256 hash of torawase.exe?
Is it safe to run torawase.exe?
How up to date is this analysis of torawase.exe?
Community
Member reviews and reports for this exact file hash.