File scan report
Verdict Safe
Is tipp7.
Only MaxSecure raised a generic detection among 75 engines, while major antivirus engines, runtime results, host checks, and broader distribution provide no corroboration.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 13d ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 66 antivirus engines that checked it flagged this archive, and that result came from MaxSecure using a generic trojan label; all 17 major antivirus engines were silent. The test run mapped two potentially offensive techniques, but found no injected target, persistence artifact, malicious sandbox result, or known-bad contacted host.
The detection profile is characteristic of a less reliable false positive: MaxSecure alone supplied a generic trojan label, with no major or family consensus. One completed sandbox run did not issue a malicious result, although it mapped process-injection and service-related techniques that merit context. No injected process, persistence indicator, malicious child verdict, or known-bad network destination was identified. The archive was first seen on Oct 13, 2026 but has already appeared from 156 sources across 167 submissions, which reduces concern that it is an isolated payload. Malware-specific external intelligence and prior similar-file evidence are absent, so the conclusion rests primarily on broad engine disagreement, runtime context, host coverage, and prevalence.
What We Detected
MaxSecure was the only engine among 75 to flag the archive, applying the generic label Trojan.Malware.300983.susgen. None of the 17 major antivirus engines detected it, and there was no agreement on a named malware family.
Threat Behavior
One sandbox run mapped T1055 and T1543.002, which can represent process injection and service-related activity. However, no target process was identified as injected, no persistence indicators were recorded, and the sandbox did not return a malicious result. The complete reputation check of 30 distinct observed contacts found no known-malicious or suspicious hosts. Ten extracted files lack saved verdicts, so their individual status remains unconfirmed rather than established as benign.
What To Do Now
Use the archive only if it came from the expected project or distributor, and keep security software enabled. If its source is uncertain, verify its SHA-256 with the publisher or test it in an isolated environment before installation.
Where this verdict could be wrong3 caveats
- The sandbox mapped process injection and system-service behavior, although it identified no injected target or persistence artifact.
- The archive contains executables for several operating systems and ten extracted children have no saved verdict, leaving those components without independent classification.
- MaxSecure applied a generic trojan label, but no other engine corroborated it.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 66 antivirus engines that checked it flagged the archive, and the detection came from a less reliable engine.
- All 17 major antivirus engines returned no detection.
- The completed sandbox run did not produce a malicious result.
- All 30 distinct observed contacts were covered by the host-reputation check, with no known-bad matches.
- The file has already been submitted 167 times by 156 sources.
- The test run mapped possible process-injection and service-related techniques.
- The archive contains executable content for multiple operating systems.
- Ten extracted components do not have individual saved classifications.
- One engine applied a generic trojan detection.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 9spawned processes
- 29network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1033· Reads user info
- T1055· Process injection
- T1064
- T1071· Application protocol
- T1082· System recon
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1543.002· Service install
- T1564.001· Hides artifacts
- T1573
- T1574· Execution hijack
Observed activity
Processes started
9Programs the file ran, with their command lines.
versus-update.exe"C:\Users\<USER>\AppData\Local\Temp\resources/tipp7.versus/versus-update.exe"rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\tipp7.versus.dll",#1zsh/bin/zshunarchiver.exe"C:\Windows\System32\unarchiver.exe" "C:\Users\user\Desktop\tipp7.versus-Installer.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr" "C:\Users\user\Desktop\tipp7.versus-Installer.zip"exo-open/usr/bin/exo-open exo-open /tmp/tipp7.versus-Installer.geode
Show all 9 entries for processes started
exo-open/usr/bin/exo-open -engrampa/usr/bin/engrampa engrampa /tmp/tipp7.versus-Installer.geode7z/usr/lib/p7zip/7z l -slt -bd -y -- /tmp/tipp7.versus-Installer.geode
Network contacts
2929 hosts, listed as 13 domains, 16 addresses, 1 link. Links show the host and path only.
- Domain
cacerts.digicert.com - Domain
ocsp.comodoca.com - Domain
ocsp.comodoca.com.cdn.cloudflare.net - Domain
a2047.dscapi9.akamai.net - Domain
apple-finance.query.yahoo.com - Domain
a1366.dscapi6.akamai.net
Show all 30 entries for network contacts
- Domain
s.mzstatic.com - Domain
e5977.dsce9.akamaiedge.net - Domain
e4805.dsca.akamaiedge.net - Domain
cp10.cloudflare.com - Domain
swdist.apple.com.edgekey.net - Domain
mask.apple-dns.net - Domain
mask-h2.icloud.com - IP address
104.18.38.233 - IP address
23.56.109.38 - IP address
23.56.109.173 - IP address
151.101.3.6 - IP address
23.222.244.213 - IP address
23.11.33.159 - IP address
172.64.149.23 - IP address
23.61.255.144 - IP address
23.37.205.12 - IP address
151.101.131.6 - IP address
23.222.204.202 - IP address
151.101.67.6 - IP address
23.62.54.52 - IP address
23.61.212.236 - IP address
23.56.109.199 - IP address
23.209.92.78 - URL
http://ocsp.comodoca.com/MFcwVaADAgEAME4wTDBKMAkGBSsOAwIaBQAEFOsl2JD%2BJyD0HX1qwV7vds9iz6t4BBR1cacZSBm8nZ3qQUfflMRId5nTeQIRAJjBcnaqg2kI3NxbTvi9QXQ%3D
Files
15Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\resources\tipp7.versus\install.lock - Written
C:\Users\<USER>\AppData\Local\Temp\resources\tipp7.versus\install-status.txt - Written
C:\Users\user\AppData\Local\Temp\unarchiver.log - Written
C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr - Written
C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr\.geode_cache - Written
C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr\about.md
Show all 15 entries for files
- Written
C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr\logo.png - Written
C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr\mod.json - Written
C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr\resources - Written
C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr\resources\tipp7.versus - Written
C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr\resources\tipp7.versus\versus-update.exe - Written
C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr\tipp7.versus.android32.so - Written
C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr\tipp7.versus.android64.so - Written
C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr\tipp7.versus.dll - Written
C:\Users\user\AppData\Local\Temp\zzuquhqk.ibr\tipp7.versus.dylib
Sandbox background — not the file
11The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
dbus-launch/usr/bin/dbus-launch dbus-launch --autolaunch=a39eb3ed78b7401fb6809ed0c562a5b1 --binary-syntax --close-stderr - VM process
gzip/bin/gzip - VM process
sh/bin/sh sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log " - VM process
invoke-rc.d/usr/sbin/invoke-rc.d invoke-rc.d --quiet cups restart - VM process
runlevel/sbin/runlevel
Show all 11 entries for sandbox background — not the file
- VM host
eip-terr-na.cdp1.digicert.com.akahost.net - VM host
8.8.8.8 - VM host
255.255.255.255 - VM host
192.168.64.1 - VM host
192.168.2.1
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 251c22dd3d63de802442…aef885Not checkedno saved verdict
- 0cc9f70d0cc1345b9feb…690b1cNot checkedno saved verdict
- 756cbf88d1330bd7f863…f9b5ebNot checkedno saved verdict
- 03acb07a484f9a86421d…f851a9Not checkedno saved verdict
- 06522500aeea1c2a84a9…e470a3Not checkedno saved verdict
- ff0b2e11d04471abf97c…997184Not checkedno saved verdict
- fa8fd256bf28801b5f59…536064Not checkedno saved verdict
- df094a54855220b9479a…b869b8Not checkedno saved verdict
- b15ff4a8d697306a6022…f340ddNot checkedno saved verdict
- cd87c8eec378f57d076b…a0b019Not checkedno saved verdict
Chapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- MaxSecureTrojan.Malware.300983.susgen
File fingerprint
- Last analyzed
- Oct 18, 2026, 3:19 PM UTC
- SHA-256
9ebadae8c03d072cf3855319b0e908efb71915a827014f2b0701ed9de3ae65e4- SHA-1
89acb62ae986d13068cd88f9ff0369534e8a1cc4- MD5
0c8927f9592170e8735b23b72c41739c
About this file
tipp7.versus-Installer.geode is a ZIP file of 2.1 MB.
- Type and size
- ZIP · 2.1 MB
- Signer
- Not applicable
- First seen
- Oct 13, 2026On VirusTotal.
- Submitted by
- 156 distinct sources
First scanned
Antivirus consensus
1 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust13 engines1flagged
View all 75 engine results
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is tipp7.versus-Installer.geode safe?
What is tipp7.versus-Installer.geode?
How many antivirus engines detected tipp7.versus-Installer.geode?
What is the SHA-256 hash of tipp7.versus-Installer.geode?
Is it safe to open or extract tipp7.versus-Installer.geode?
How up to date is this analysis of tipp7.versus-Installer.geode?
Community
Member reviews and reports for this exact file hash.