File scan report

Verdict Suspicious

Analyzed Sep 7, 20261 month ago

Is sims-4-updater-v2.4.11.exe safe? Treat it as suspicious.

Two less reliable engines flagged the file while 17 major antivirus engines remained silent.

Why Suspicious? 2 antivirus engines flag it, but no major engine agrees; nothing else confirms it.

Limited evidence · One sign points to a problem; nothing else confirms it.

Don't run it until you know where it came from

Treat as untrusted; do not run without additional verification from official Sims-4-updater channels or updated vendor signatures.

What to do now4 steps

Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.

What to do

Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.

If you already ran it

Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.

Not sure what to do?

Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.

Paste this report's link in your topic so helpers can see what was found.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

2 of 70 flagged

Flagged 2
No detection 68
No result 4

Filesims-4-updater-v2.4.11.exe21.1 MBSHA-256 a48ef2d0d7a9…e746d3

Code signing Signer not verified
Test run Completed
First seen 10mo ago

2 of the 70 antivirus engines that checked it flag it, including APEX and Webroot.

Chapter 02

Why we think so

2 points against it and 3 in its favour, checked against the scan evidence.

Analyst conclusion

The engine profile matches an AV-on-AV false-positive pattern, but the absence of any trusted-publisher history and the presence of offensive MITRE techniques prevent a clean verdict. Prevalence data indicates the binary has circulated for months among many users, lowering the chance of a targeted attack. Without a completed host-reputation check or corroborating major detections, the evidence remains mixed.

Where this verdict could be wrong2 caveats

communityComments contain mixed researcher verdicts (two 'Malicious', one 'Clean', one 'Suspicious') — no consensus.
contactedHosts is null; no complete host-reputation cross-check available for the single IP 104.21.52.91.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

15sandbox rule tags
8spawned processes
1network contact
30filesystem & mutex artifacts

What the test run showed

What the file did on a test computer

Confirmed in the test run

Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).

Sandbox labels we could not confirm (common in safe files too)

Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: Showed activity a sandbox rule links to file encryption; no ransomware behaviour was confirmed.

This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.

Recorded behavior

What happened in the test

Grouped by step. The order is not a timeline.

Seen in the test runWorked out from other results

Input file
The submitted object
1
1. Evidence 1 of 6: FileSeen in the test run
  sims-4-updater-v2.4.11.exe
  a48ef2d0d7a9d5d5ca9dea6e7017140e682b0eb6d15c33ace93c7f8666e746d3
  Uploaded file
Processes
What ran
2
1. Evidence 2 of 6: ProcessSeen in the test run
  software.exe
  "C:\Users\<USER>\Desktop\software.exe"
  Test run
2. Evidence 3 of 6: ProcessSeen in the test run
  NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\<USER>\Desktop\updater_readme.txt
  Test run
3. +1 more recorded observation
Files
Created or changed
2
1. Evidence 4 of 6: Written fileSeen in the test run
  mfc140u.dll
  C:\Users\<USER>\AppData\Local\Temp\_MEI54922\Pythonwin\mfc140u.dll
  Test run
2. Evidence 5 of 6: Written fileSeen in the test run
  win32ui.pyd
  C:\Users\<USER>\AppData\Local\Temp\_MEI54922\Pythonwin\win32ui.pyd
  Test run
3. +1 more recorded observation
Network
Hosts contacted
1
1. Evidence 6 of 6: Contacted hostSeen in the test run
  104.21.52.91
  Contacted during the test run.
  Test run

6 facts from the test run. See the full activity list.

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1027· Obfuscated code
T1027.002· Obfuscated code
T1055· Process injection
T1059· Runs commands
T1070.006· Covers its tracks
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1129· Loads modules
T1485
T1486· File encryption
T1497· Sandbox evasion
T1497.001· Sandbox evasion
T1539
T1560

Observed activity

Processes started

Programs the file ran, with their command lines.

software.exe"C:\Users\<USER>\Desktop\software.exe"
NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\<USER>\Desktop\updater_readme.txt
sims-4-updater-v2.4.11.exe
a48ef2d0d7a9d5d5ca9dea6e7017140e682b0eb6d15c33ace93c7f8666e746d3.exe
sims-4-updater-v2.4.11.exe"C:\Users\user\Desktop\sims-4-updater-v2.4.11.exe"
program.exe"C:\Users\user\Desktop\program.exe"

Show all 8 entries

file.exe"C:\Users\user\Desktop\file.exe"
executable.exe"C:\Users\user\Desktop\executable.exe"

Network contacts

1 host, listed as 1 address. Links show the host and path only.

IP address104.21.52.91

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\Pythonwin\mfc140u.dll
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\Pythonwin\win32ui.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\VCRUNTIME140.dll
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\VCRUNTIME140_1.dll
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\_asyncio.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\_bz2.pyd

Show all 30 entries

WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\_cffi_backend.cp310-win_amd64.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\_ctypes.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\_decimal.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\_hashlib.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\_lzma.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\_multiprocessing.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\_overlapped.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\_queue.pyd
WrittenC:\Users\<USER>\AppData\Local\Temp\_MEI54922\_socket.pyd
DeletedC:\Users\<USER>\AppData\Local\Temp\bd2mhudb
DeletedC:\Users\<USER>\Desktop\tmp_file_0
DeletedC:\Users\<USER>\Desktop\updater_remote.cache_tmp
DeletedC:\Users\<USER>\Desktop\updater_tmp\downloading\Base Game 1.119.109.1020 0.zip.001.aria2
DeletedC:\Users\<USER>\Desktop\updater_tmp\downloading\Base Game 1.119.109.1020 0.zip.001.aria2_partial
DeletedC:\Users\<USER>\Desktop\updater_tmp\downloading\Base Game 1.119.109.1020 0.zip.002.aria2
DeletedC:\Users\<USER>\Desktop\updater_tmp\downloading\Base Game 1.119.109.1020 0.zip.002.aria2_partial
DeletedC:\Users\<USER>\Desktop\updater_tmp\downloading\Base Game 1.119.109.1020 0.zip.003.aria2
DeletedC:\Users\<USER>\Desktop\updater_tmp\downloading\Base Game 1.119.109.1020 0.zip.003.aria2_partial
DeletedC:\Users\<USER>\Desktop\updater_tmp\downloading\Base Game 1.119.109.1020 0.zip.004.aria2
DeletedC:\Users\<USER>\Desktop\updater_tmp\downloading\Base Game 1.119.109.1020 0.zip.004.aria2_partial
DeletedC:\Users\<USER>\Desktop\updater_tmp\downloading\Base Game 1.119.109.1020 0.zip.005.aria2
DeletedC:\Users\<USER>\Desktop\updater_tmp\downloading\Base Game 1.119.109.1020 0.zip.005.aria2_partial
DeletedC:\Users\<USER>\Desktop\updater_tmp\downloading\Base Game 1.119.109.1020 0.zip.006.aria2
DeletedC:\Users\<USER>\Desktop\updater_tmp\downloading\Base Game 1.119.109.1020 0.zip.006.aria2_partial

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processservices.exeC:\Windows\system32\services.exe
VM processsvchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p
VM processsvchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
VM processlsass.exeC:\Windows\system32\lsass.exe
VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

21baa6669389d8284059…14844dNot checked
no saved verdict
360b2c9242365d6c0fda…be3d9aNot checked
no saved verdict
cd2f60075064dfc2e65c…356b08Not checked
no saved verdict
2f4d915840c287c54188…066384Not checked
no saved verdict
036c32dc38a30a7f09ce…68d72dNot checked
no saved verdict
ef59713151ac9ee78e13…470e48Not checked
no saved verdict
1947f8b188ab4ab6aa72…368fb7Not checked
no saved verdict
4a9d4a76514f399a9652…e2336dNot checked
no saved verdict
d2a7999e234e33828888…723b6fNot checked
no saved verdict
34048abaa070ecc13b31…8c8b32Not checked
no saved verdict

Chapter 04

Technical details

2 of the 70 antivirus engines that checked it flag it; a signature that did not verify.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 74 enginesComplete2 of 70 engines flagged it · 4 gave no result DetailsJul 21, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsOct 18, 2026

Contacted hostsMalwareTips URL scannerPartial1 host contacted in the test run had no completed reputation check DetailsOct 18, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsOct 18, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedOct 18, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchOct 18, 2026

Engines that flagged it 2

APEXMalicious
WebrootW32.Hack.Tool

File fingerprint

Last analyzed: Sep 7, 2026, 6:05 PM UTC

SHA-256: a48ef2d0d7a9d5d5ca9dea6e7017140e682b0eb6d15c33ace93c7f8666e746d3
SHA-1: 3c4c6e8701ff4cf723b64ede89dfe867925d2183
MD5: 52b234520c47115173fa9fc33395b551

About this file

sims-4-updater-v2.4.11.exe is a Win32 EXE file of 21.1 MB.

Type and size: Win32 EXE · 21.1 MB
Signer: Sims4Updater (unverified signature)Worth noting: Malware sometimes copies or steals a company's signature, so this does not mean that company made it.
First seen: Dec 29, 2025On VirusTotal.
Submitted by: 1,125 distinct sources
Packer: None detected
Entropy: 8.00 of 8

First scanned Sep 7, 2026Updated Oct 18, 2026

Antivirus consensus

2 of 70 engines flagged this file

2 malicious0 suspicious68 not flagged4 no result

4 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-235 engines
0flagged
Low-trust17 engines
2flagged

View all 74 engine results

APEXMalicious: Malicious
WebrootMalicious: W32.Hack.Tool
AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 8.00Unpacked

Section entropy7 sections

.text

6.48

.rdata

5.82

.data

1.81

.pdata

5.23

_RDATA

2.73

.rsrc

7.21

.reloc

5.26

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

1,125

Hundreds of people have uploaded this — common.

Total submissions

1,293

Includes repeat uploads by the same source.

First seen

10mo ago

Dec 29, 2025

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is sims-4-updater-v2.4.11.exe safe, or is it malware?

sims-4-updater-v2.4.11.exe is rated Suspicious: some signs point to a problem, but nothing confirms it is harmful. 2 of the 70 antivirus engines that checked it flag it. Don't run it unless you're sure where it came from. If you need the program, download it again from the publisher's own website.

What is sims-4-updater-v2.4.11.exe?

sims-4-updater-v2.4.11.exe is a Windows program, about 21.1 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Dec 29, 2025.

How many antivirus engines detected sims-4-updater-v2.4.11.exe?

2 of the 70 antivirus engines that checked it flag sims-4-updater-v2.4.11.exe, including APEX and Webroot. We weigh which engines flagged it and what else the scan found, not just the count.

What should I do if I already ran sims-4-updater-v2.4.11.exe?

No infection is confirmed: the rating is a caution, not a malware finding. 1) Check where it came from. If you can't confirm the source, delete it. 2) Run a full scan with your security software. 3) If the scan finds something, follow its removal steps and change passwords you typed on the device since then.

Is sims-4-updater-v2.4.11.exe digitally signed?

It carries a signature in the name of Sims4Updater that could not be verified. Malware sometimes copies or steals a company's signature, so this does not mean that company made it.

What is the SHA-256 hash of sims-4-updater-v2.4.11.exe?

The SHA-256 fingerprint of sims-4-updater-v2.4.11.exe is a48ef2d0d7a9d5d5ca9dea6e7017140e682b0eb6d15c33ace93c7f8666e746d3, and its MD5 is 52b234520c47115173fa9fc33395b551. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

How up to date is this analysis of sims-4-updater-v2.4.11.exe?

This report reflects the scan on Sep 7, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is sims-4-updater-v2.4.11.exe safe? Treat it as suspicious.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What the test run showed

Confirmed in the test run

Sandbox labels we could not confirm (common in safe files too)

What happened in the test

Input file

Processes

Files

Network

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

Engines that flagged it 2

File fingerprint

About this file

2 of 70 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is sims-4-updater-v2.4.11.exe safe? Treat it as suspicious.

What We Detected

Threat Behavior

What To Do Now

Test run summary

What the test run showed

Confirmed in the test run

Sandbox labels we could not confirm (common in safe files too)

What happened in the test

Input file

Processes

Files

Network

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Sandbox background — not the file

Engines that flagged it 2

File fingerprint

About this file

Related file reports