File scan report
Verdict Safe
Is Week
Only 1 of the 70 antivirus engines that checked it flagged this installer, while four sandbox runs, host checks, and stronger antivirus engines found no corroborating threat…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 70 flagged
- Flagged 1
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The lone APEX detection appears likely to be a false positive: none of the stronger engines flagged the file, and four sandbox runs produced a combined clean result. All observed hosts were checked without a hostile reputation match, though the executable is unsigned and its internal code was not independently examined.
Only 1 of the 70 antivirus engines that checked it flagged the installer, and that generic result came from APEX without support from stronger engines. Four completed sandbox runs produced a combined clean verdict, recorded no named injection target, and showed activity consistent with an installer launching its application and embedded web component. All five distinct observed network hosts were covered by the reputation check, with no malicious or suspicious result. No malware-specific community rules, public malware-sample listing, malicious child, packing, or high-entropy code corroborated the detection. The unsigned status and lack of our static analysis warrant ordinary caution, but the available evidence strongly favors a false positive.
What We Detected
Only 1 of the 70 antivirus engines that checked it flagged the installer. APEX supplied a generic malicious label, while none of the stronger engines reported a detection and no engine identified a malware family.
Threat Behavior
Four completed sandbox runs produced a combined clean verdict. They recorded the installer starting its application and an embedded web component, but no named injection target or other high-risk technique was corroborated. All five distinct observed hosts were checked, and none had a malicious or suspicious reputation.
What To Do Now
The evidence indicates that the isolated detection is probably a false positive. Because the executable is unsigned and our static analysis was unavailable, obtain it from the project's official release channel, verify its hash when one is published, and keep security software enabled while installing it.
Where this verdict could be wrong3 caveats
- The executable is unsigned, so there is no verified publisher identity anchoring its origin.
- APEX labeled the file malicious, although no other engine corroborated that generic result.
- The file was not uploaded for our static analysis, so its internal code and installer contents were not independently examined.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the stronger antivirus engines flagged the file.
- Four completed sandbox runs produced a combined clean verdict and no named injection target.
- All five distinct observed hosts were covered by the reputation check without a malicious or suspicious match.
- No malware-specific community rule, public malware-sample listing, malicious child, packer, or high-entropy code was found.
- The file has been submitted 379 times by 362 distinct sources.
- The Windows executable is unsigned, so its publisher identity cannot be verified.
- APEX issued a generic malicious detection.
- Our static analysis was unavailable because the file bytes were not uploaded.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 23sandbox rule tags
- 8spawned processes
- 5network contacts
- 32filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
23MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1059.001· Runs commands
- T1064
- T1070· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1202
- T1485
- T1497· Sandbox evasion
- T1518· Checks your AV
- T1562· Disables security
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1574· Execution hijack
Observed activity
Processes started
8Programs the file ran, with their command lines.
WeekBox-2.5.3-windows-x64-setup.exe"C:\Users\<USER>\Desktop\WeekBox-2.5.3-windows-x64-setup.exe"WeekBox-2.5.3-windows-x64-setup.tmp"C:\Users\<USER>\AppData\Local\Temp\is-XDSGKP9RO9.tmp\WeekBox-2.5.3-windows-x64-setup.tmp" /SL5="$4003C,7650370,1376256,C:\Users\<USER>\Desktop\WeekBox-2.5.3-windows-x64-setup.exe"WeekBox-win_x64.exe"C:\Users\<USER>\AppData\Local\WeekBox\WeekBox-win_x64.exe"msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WeekBox-win_x64.exe --webview-exe-version=2.5.3 --user-data-dir="C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=PreloadMediaEngagementData,MediaEngagementBypassAutoplayPolicies --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4632.1792.12553210757988010458msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.129 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView…a35e42bb486fc22dd3e688e1c345d396f3d887f4c789be1b0f5b3dd3495f7e73.exeC:\Users\<USER>\AppData\Local\Temp\is-ORE44Z7TKW.tmp\a35e42bb486fc22dd3e688e1c345d396f3d887f4c789be1b0f5b3dd3495f7e73.tmp /SL5=$301E0,7650370,1376256,C:\Users\<USER>\Downloads\a35e42bb486fc22dd3e688e1c345d396f3d887f4c789be1b0f5b3dd3495f7e73.exe
Show all 8 entries for processes started
WeekBox-2.5.3-windows-x64-setup.exe"C:\Users\user\Desktop\WeekBox-2.5.3-windows-x64-setup.exe"WeekBox-2.5.3-windows-x64-setup.tmp"C:\Users\user\AppData\Local\Temp\is-JIZUAP3LTG.tmp\WeekBox-2.5.3-windows-x64-setup.tmp" /SL5="$20494,7650370,1376256,C:\Users\user\Desktop\WeekBox-2.5.3-windows-x64-setup.exe"
Network contacts
55 hosts, listed as 1 domain, 4 addresses. Links show the host and path only.
- Domain
api.github.com - IP address
108.177.121.95 - IP address
104.17.25.14 - IP address
140.82.114.6 - IP address
74.125.202.94
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\is-XDSGKP9RO9.tmp\WeekBox-2.5.3-windows-x64-setup.tmp - Written
\Device\ConDrv\Connect - Written
C:\Users\<USER>\AppData\Roaming\com.weekbox.app\neutralinojs.log - Written
C:\Users\<USER>\AppData\Local\WeekBoxLibrary\settings.json - Written
C:\Users\<USER>\AppData\Roaming\com.weekbox.app\.storage\weekbox-settings-data-path-v2.neustorage - Written
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Crashpad\throttle_store.dat
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Crashpad\settings.dat - Written
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\BrowserMetrics\BrowserMetrics-6AAE0208-408.pma - Written
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\lockfile - Written
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Variations - Written
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\55750078-b885-4408-a4f3-c4944c5ba6ec.tmp - Written
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Local State - Written
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\ShaderCache\index - Written
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\ShaderCache\data_0 - Written
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\ShaderCache\data_1 - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\BrowserMetrics-spare.pma - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\55750078-b885-4408-a4f3-c4944c5ba6ec.tmp - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Default\Site Characteristics Database\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Default\Extension Rules\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Default\Extension State\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\BrowserMetrics\BrowserMetrics-6AAE0208-408.pma - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Default\4fdbdeaa-8e31-4126-b79c-28f6c7f8f321.tmp - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Local State~RF19c5a.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Local State~RF2142a.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Default\Preferences~RF216d9.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Local State~RF28785.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\WeekBox-win_x64.exe\EBWebView\Default\Preferences~RF28c09.TMP
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\dr - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\StabilityMetrics\user_experience_metrics.stability.exited_cleanly - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\usagestats - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\urlstats - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\media.cdm.origin_data - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\media.storage_id_salt
Show all 15 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.account_id - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.last_username - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\default_search_provider_data.template_url_data - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\safebrowsing.incidents_sent - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\pinned_tabs - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\search_provider_overrides - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.last_account_id - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\session.startup_urls - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\session.restore_on_startup
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
Local\ChromeProcessSingletonStartup!__OMADM_NAMED_MUTEX__
Sandbox background — not the file
6The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 988cf9af2f9c0ff5d458…40e30dNot checkedno saved verdict
- 88c612db7334b4d5a762…027d11Not checkedno saved verdict
- b7640f7727a4e41803df…638292Not checkedno saved verdict
- 0a6398329ca0381e4b2a…f0a95dNot checkedno saved verdict
- f35ec48e3402ae2504ef…f75557Not checkedno saved verdict
- e83d7ae0bc95d345b05c…bc4187Not checkedno saved verdict
- fd7dd52fff3628b48ea9…119613Not checkedno saved verdict
- 711e713e454ead7931e5…a6ef34Not checkedno saved verdict
- 611b5b6fe905ab18cf36…d10836Not checkedno saved verdict
- 1826d0a7c0d02813f91b…c698efNot checkedno saved verdict
Chapter 04
Technical details
1 of the 70 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- APEXMalicious
File fingerprint
- Last analyzed
- Nov 4, 2026, 12:36 AM UTC
- SHA-256
a35e42bb486fc22dd3e688e1c345d396f3d887f4c789be1b0f5b3dd3495f7e73- SHA-1
4ff1c767784424536b38d85616d5b5c48f653509- MD5
f9d16bf96ce67caa61197e424c54300b
About this file
WeekBox-2.5.3-windows-x64-setup.exe says it is WeekBox Setup (WeekBox), 9.8 MB.
- Claims to be
- WeekBox Setup (WeekBox)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 9.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Sep 18, 2026On VirusTotal.
- Submitted by
- 362 distinct sources
- Packer
- None detected
- Entropy
- 5.76 of 8
First scanned
Antivirus consensus
1 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- APEXMalicious: Malicious
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is WeekBox-2.5.3-windows-x64-setup.exe safe?
What is WeekBox-2.5.3-windows-x64-setup.exe?
How many antivirus engines detected WeekBox-2.5.3-windows-x64-setup.exe?
What is the SHA-256 hash of WeekBox-2.5.3-windows-x64-setup.exe?
Is it safe to install WeekBox-2.5.3-windows-x64-setup.exe?
How up to date is this analysis of WeekBox-2.5.3-windows-x64-setup.exe?
Community
Member reviews and reports for this exact file hash.