File scan report
Verdict Malicious
Is Build EAX.
Ten of the 63 antivirus engines that checked it flagged this unsigned executable, and three malware-specific YARA rules provide strong corroboration despite one uneventful…
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already ran it, follow the steps below.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't run it
Don't run this file. Delete it, then empty the Recycle Bin.
If you already ran it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
If you typed passwords on the device after running it, change them from another device you trust.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
10 of 63 flagged
- Flagged 10
- No detection 53
- No result 12
- Code signing Unsigned
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
5 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Ten of the 63 antivirus engines that checked it flagged the file, including two major antivirus engines and six independent detection sources. Three malware-specific YARA rules add strong static corroboration, while the unsigned status leaves no publisher identity to counter those findings. One sandbox run showed no offensive behavior, but that limited observation does not outweigh the combined detections.
The executable drew 10 detections among 75 engines, with two major detections and six independent flagging sources. Several vendors use generic labels, and there is no strong major agreement on a single family, so the precise family remains uncertain. More importantly, three malware-specific YARA rules matched, including a rule associated with Xeno Executor or Meduza Stealer hunting, providing independent static corroboration. The file is unsigned and has no established publisher history. One completed sandbox run returned clean and showed no high-risk techniques, but a single uneventful execution can miss conditional or evasive behavior. No complete reputation result is available for observed hosts, although the only recorded IP was identified as analysis-environment background traffic.
What We Detected
Ten of the 63 antivirus engines that checked it flagged the executable. Two major antivirus engines detected it, and the results represent six independent flagging sources after related products were consolidated. Emsisoft used a GenericKDQ trojan label, while Fortinet reported a possible threat; the labels do not establish a reliable named family.
Static research rules add substantial corroboration: three malware-specific YARA rules matched, including Win32_Malware_Xeno_Executor_Master_Hunting, TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE, and dgaagas. The executable is also unsigned, so there is no verified publisher identity or trusted signer history to offset these findings.
Threat Behavior
One completed sandbox run did not produce a malicious verdict or any high-risk MITRE techniques. It opened a Microsoft page requesting the .NET 8 runtime, and the recorded IP contact was identified as background activity from the analysis environment rather than sample traffic. This limited run is meaningful counter-evidence, but it cannot exclude dormant, conditional, or environment-aware behavior. No complete host-reputation cross-check is available.
What To Do Now
Do not execute or load this file on a production system. Keep security software enabled, let your antivirus remove the file, and obtain a fresh copy only from a verified official source. If it has already run, perform a full endpoint scan and review recent processes, persistence locations, credentials, and outbound activity.
Where this verdict could be wrong3 caveats
- One completed sandbox run returned clean and recorded no high-risk techniques.
- No packing or high-entropy code was identified.
- Two previous files with the same import-table fingerprint received safe outcomes, although neither had a matching signer and import-table fingerprint collisions can arise from shared build frameworks.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- One completed sandbox run did not identify offensive behavior.
- Eleven major antivirus engines reported no detection.
- The code sections did not appear packed or unusually high in entropy.
- The file has moderate distribution rather than being and extremely rare.
- Ten of the 63 antivirus engines that checked it reported a threat, including two major antivirus engines.
- Six independent detection sources flagged the executable.
- Three malware-specific research rules matched the file.
- The Windows executable is unsigned and has no established publisher history.
- Several detections describe a generic trojan or possible threat.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 7sandbox rule tags
- 2spawned processes
- 0network contacts
- 5filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Checked whether it was running on a test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
Build EAX.dll
a663d067c9a60273a2d16d854c4eac257791b16559e38688508c1efb465025ff
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
Build EAX.exe
"C:\Users\user\Desktop\Build EAX.exe"
Test run - Evidence 3 of 5: ProcessSeen in the test run
chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=8.0.0&arch=x64&rid=win-x64&os=win10&gui=true
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
Microsoft Compatibility Appraiser
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser
Test run - Evidence 5 of 5: Written fileSeen in the test run
History
C:\Users\user\AppData\Local\Microsoft\Windows\History
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
7MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1497.001· Sandbox evasion
Observed activity
Processes started
2Programs the file ran, with their command lines.
Build EAX.exe"C:\Users\user\Desktop\Build EAX.exe"chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=8.0.0&arch=x64&rid=win-x64&os=win10&gui=true
Files
4Files the file created, changed or deleted.
- Written
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - Written
C:\Users\user\AppData\Local\Microsoft\Windows\History - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\DBWinMutex
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
162.159.36.2
Chapter 04
Technical details
10 of the 63 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 10
- Emsisoft (major engine)QD:Trojan.GenericKDQ.C4CB505215 (B)
- Fortinet (major engine)W32/PossibleThreat
- GData (major engine)QD:Trojan.GenericKDQ.C4CB505215
- ALYacQD:Trojan.GenericKDQ.C4CB505215
- Antiy-AVLTrojan/MSIL.Kryptik
- ArcabitQD:Trojan.GenericQ.C4CB505215
- CTXexe.trojan.generic
- McAfeeDti!A663D067C9A6
File fingerprint
- Last analyzed
- Oct 13, 2026, 1:02 PM UTC
- SHA-256
a663d067c9a60273a2d16d854c4eac257791b16559e38688508c1efb465025ff- SHA-1
16eccb10267e500cb0f947178993f8cf21480216- MD5
0d706a28cd5bc0df1ff25c77e3e13732
About this file
Build EAX.dll is a Win32 EXE file of 42.3 MB.
- Type and size
- Win32 EXE · 42.3 MB
- Signer
- UnsignedNo code signature.
- First seen
- Aug 18, 2026On VirusTotal.
- Submitted by
- 40 distinct sources
- Packer
- None detected
- Entropy
- 6.01 of 8
First scanned
Antivirus consensus
10 of 63 engines flagged this file
12 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 10 detections come from 5 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-114 engines2flagged3 vendors sharing 2 engines
- Tier-233 engines3flagged5 vendors sharing 3 engines
- Low-trust16 engines2flagged
View all 75 engine results
- ALYacMalicious: QD:Trojan.GenericKDQ.C4CB505215
- Antiy-AVLMalicious: Trojan/MSIL.Kryptik
- ArcabitMalicious: QD:Trojan.GenericQ.C4CB505215
- CTXMalicious: exe.trojan.generic
- EmsisoftMalicious: QD:Trojan.GenericKDQ.C4CB505215 (B)
- FortinetMalicious: W32/PossibleThreat
- GDataMalicious: QD:Trojan.GenericKDQ.C4CB505215
- McAfeeDMalicious: ti!A663D067C9A6
- SkyhighMalicious: Artemis
- VIPREMalicious: QD:Trojan.GenericKDQ.C4CB505215
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- APEXClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderNo result
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticNo result
- ESET-NOD32Clean
- F-SecureClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaNo result
- RisingClean
- SangforClean
- SentinelOneClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
- dgaagas
- TH_AntiVM_MassHunt_Win_Malware_2026_CYFAREgeneric
- Win32_Malware_Xeno_Executor_Master_Hunting
- CP_Script_Inject_Detectorgeneric
- DebuggerCheck__APIgeneric
- DetectEncryptedVariantsgeneric
- golang_bin_JCorn_CSC846generic
- NETgeneric
- pe_detect_tls_callbacksgeneric
- Sus_CMD_Powershell_Usagegeneric
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is Build EAX.dll a virus?
What is Build EAX.dll?
How many antivirus engines detected Build EAX.dll?
What should I do if I already ran Build EAX.dll?
How do I remove Build EAX.dll?
What kind of malware is Build EAX.dll?
What is the SHA-256 hash of Build EAX.dll?
How up to date is this analysis of Build EAX.dll?
Community
Member reviews and reports for this exact file hash.