File scan report
Verdict Safe
Is tipp7.
Only MaxSecure raised a generic detection among 75 engines, while major antivirus engines, runtime results, host checks, and broader distribution provide no corroboration.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 13d ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 66 antivirus engines that checked it flagged this archive, and that result came from MaxSecure using a generic trojan label; all 17 major antivirus engines were silent. The test run mapped two potentially offensive techniques, but found no injected target, persistence artifact, malicious sandbox result, or known-bad contacted host.
The detection profile is characteristic of a less reliable false positive: MaxSecure alone supplied a generic trojan label, with no major or family consensus. One completed sandbox run did not issue a malicious result, although it mapped process-injection and service-related techniques that merit context. No injected process, persistence indicator, malicious child verdict, or known-bad network destination was identified. The archive was first seen on Oct 13, 2026 but has already appeared from 156 sources across 167 submissions, which reduces concern that it is an isolated payload. Malware-specific external intelligence and prior similar-file evidence are absent, so the conclusion rests primarily on broad engine disagreement, runtime context, host coverage, and prevalence.
What We Detected
MaxSecure was the only engine among 75 to flag the archive, applying the generic label Trojan.Malware.300983.susgen. None of the 17 major antivirus engines detected it, and there was no agreement on a named malware family.
Threat Behavior
One sandbox run mapped T1055 and T1543.002, which can represent process injection and service-related activity. However, no target process was identified as injected, no persistence indicators were recorded, and the sandbox did not return a malicious result. The complete reputation check of 30 distinct observed contacts found no known-malicious or suspicious hosts. Ten extracted files lack saved verdicts, so their individual status remains unconfirmed rather than established as benign.
What To Do Now
Use the archive only if it came from the expected project or distributor, and keep security software enabled. If its source is uncertain, verify its SHA-256 with the publisher or test it in an isolated environment before installation.
Where this verdict could be wrong3 caveats
- The sandbox mapped process injection and system-service behavior, although it identified no injected target or persistence artifact.
- The archive contains executables for several operating systems and ten extracted children have no saved verdict, leaving those components without independent classification.
- MaxSecure applied a generic trojan label, but no other engine corroborated it.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 66 antivirus engines that checked it flagged the archive, and the detection came from a less reliable engine.
- All 17 major antivirus engines returned no detection.
- The completed sandbox run did not produce a malicious result.
- All 30 distinct observed contacts were covered by the host-reputation check, with no known-bad matches.
- The file has already been submitted 167 times by 156 sources.
- The test run mapped possible process-injection and service-related techniques.
- The archive contains executable content for multiple operating systems.
- Ten extracted components do not have individual saved classifications.
- One engine applied a generic trojan detection.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 9spawned processes
- 29network contacts
- 15filesystem & mutex artifacts
Includes the sandbox verdicts, 11 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- MaxSecureTrojan.Malware.300983.susgen
File fingerprint
- Last analyzed
- Oct 18, 2026, 3:19 PM UTC
- SHA-256
9ebadae8c03d072cf3855319b0e908efb71915a827014f2b0701ed9de3ae65e4- SHA-1
89acb62ae986d13068cd88f9ff0369534e8a1cc4- MD5
0c8927f9592170e8735b23b72c41739c
About this file
tipp7.versus-Installer.geode is a ZIP file of 2.1 MB.
- Type and size
- ZIP · 2.1 MB
- Signer
- Not applicable
- First seen
- Oct 13, 2026On VirusTotal.
- Submitted by
- 156 distinct sources
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is tipp7.versus-Installer.geode safe?
What is tipp7.versus-Installer.geode?
How many antivirus engines detected tipp7.versus-Installer.geode?
What is the SHA-256 hash of tipp7.versus-Installer.geode?
Is it safe to open or extract tipp7.versus-Installer.geode?
How up to date is this analysis of tipp7.versus-Installer.geode?
Community
Member reviews and reports for this exact file hash.