File scan report
Verdict Safe
Is DS4
Only 2 of the 67 antivirus engines that checked it flagged this archive, both less reliable, while observations from the test run, host checks, and inspected files it created…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 67 flagged
- Flagged 2
- No detection 65
- No result 8
- Code signing Not applicable
- Test run Completed
- First seen 7d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The two generic Trojan detections come exclusively from less reliable engines; none of the higher-trust engines flagged the archive. Completed observations from the test run found no malicious sandbox result or named injection target, and the comprehensive check of observed contacts found no malicious or suspicious host.
Two of the 67 antivirus engines that checked it flagged the archive, and both detections came from less reliable scanners using generic Trojan labels. None of the higher-trust engines supplied supporting detections or a named malware family. The sandbox runs produced no malicious result, and the mapping had no named injection target, so it does not demonstrate process injection. All four observed domain and IP contacts were covered by the reputation check, which found no malicious or suspicious host; the domains were also identified as analysis-environment background traffic. No malicious child, malware-specific community rule, or public sample-database listing corroborated the detections. Because the archive is and rare, obtaining it from the project's verified release channel remains prudent.
What We Detected
Only 2 of the 67 antivirus engines that checked it flagged the archive: MaxSecure and VBA32. Both are less reliable detections with generic Trojan wording, while none of the higher-trust engines identified malware or agreed on a real family.
Threat Behavior
The completed sandbox runs produced no malicious result. A T1055 mapping appeared without any named process receiving injected code, so it does not establish process injection. The host-reputation check covered all four observed domain and IP contacts and found none malicious or suspicious; the two domains were attributed to analysis-environment background activity. No malicious file it created or persistence indicator was recorded.
What To Do Now
The evidence strongly favors false-positive detections. Because this exact archive is and has little prevalence, download a fresh copy from the project's verified release channel and keep security software enabled when extracting and running it.
Where this verdict could be wrong3 caveats
- The archive was first observed on the analysis date and had only one submitter, so it lacks established prevalence.
- MaxSecure and VBA32 applied generic Trojan labels, although neither detection is supported by a higher-trust engine.
- Direct traffic to two IP addresses was recorded, but the complete host-reputation check found neither address malicious or suspicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the higher-trust antivirus engines flagged the archive.
- Completed observations from the test run produced no malicious sandbox result and no named injection target.
- The complete reputation check of all observed contacts found no malicious or suspicious host.
- No inspected child was malicious; three matched known-software reference records.
- No malware-specific rule or public malware-sample listing matched the hash.
- The exact archive is and has only one recorded submitter.
- MaxSecure and VBA32 applied generic Trojan detections.
- The sandbox summary recorded direct-IP traffic, although the covered addresses had no malicious or suspicious reputation.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 13sandbox rule tags
- 15spawned processes
- 2network contacts
- 15filesystem & mutex artifacts
Includes the sandbox verdicts, 13 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
2 of the 67 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- MaxSecureTrojan.Malware.300983.susgen
- VBA32TScope.Trojan.MSIL
File fingerprint
- Last analyzed
- Oct 18, 2026, 6:36 PM UTC
- SHA-256
9e7d5fd265e73b6de78a74564d33987fbd88ee2ea2665b5447b8a9baf6ec809b- SHA-1
81c2c06bbd5146411839ef2bd1eaff106b2f115d- MD5
02f5097de90d23fdb4976a5360b7df89
About this file
DS4Windows.zip is a ZIP file of 4.3 MB.
- Type and size
- ZIP · 4.3 MB
- Signer
- Not applicable
- First seen
- Oct 18, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is DS4Windows.zip safe?
What is DS4Windows.zip?
How many antivirus engines detected DS4Windows.zip?
What is the SHA-256 hash of DS4Windows.zip?
Is it safe to open or extract DS4Windows.zip?
How up to date is this analysis of DS4Windows.zip?
Community
Member reviews and reports for this exact file hash.