File scan report
Verdict Safe
Is Terraria. exe safe? Yes, no threats found.
Widely submitted 14-year-old Terraria game executable with zero engine detections.
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 59 flagged
- Flagged 0
- No detection 59
- No result 15
- Code signing Unsigned
- Test run Completed
- First seen 14y ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Zero of the 59 antivirus engines that checked it flagged the file. The sample matches the well-known Terraria game, has been submitted by 397 sources since 2012, and shows no malicious sandbox behaviour.
The complete absence of detections across 74 engines, combined with the file's age and prevalence, strongly indicates a legitimate game binary. Community annotations confirm the file is Terraria version 1.0.4. While the executable is unsigned and one rule noted direct-no complete contacted-host reputation result was available engine results and long submission history. The mixed RAG verdicts reflect framework collisions rather than actual similarity to the current sample.
What We Detected
74 engines scanned the file with zero malicious detections. The sample is an unsigned Win32 executable named Terraria.exe, first submitted in 2012 and seen by 397 sources.
Threat Behavior
One sandbox execution recorded direct-IP connections and several routine system interactions, but no malicious verdict was returned. Two dropped files were inspected and found clean. No persistence mechanisms or registry modifications were observed.
What To Do Now
The file can be considered safe for execution. Keep security software enabled as a general precaution when running any downloaded executable.
Where this verdict could be wrong3 caveats
- The file is unsigned — unsigned executable reduces trust for a 14-year-old file
- similarHashes shows 4/5 prior import-table fingerprint matches returned suspicious or malicious verdicts
- triggeredHeuristics[0] fired on direct-IP traffic pattern
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero detections across 74 engines
- Common_old prevalence with 480 submissions
- Community annotations identify it as Terraria game
- No malicious sandbox verdict or dropped malicious files it created
- File is unsigned
- Direct-IP network traffic observed in sandbox
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 13sandbox rule tags
- 1spawned processes
- 5network contacts
- 27filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
13MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1071· Application protocol
- T1071.001· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1106
- T1222
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1562.001· Disables security
- T1564.003· Hides artifacts
Observed activity
Processes started
1Programs the file ran, with their command lines.
a803086e90166a64cc978be7bf9e44c7022feff2410222973f75ca52d8bd257d.exe%SAMPLEPATH%\a803086e90166a64cc978be7bf9e44c7022feff2410222973f75ca52d8bd257d.exe
Network contacts
55 hosts, listed as 5 addresses. Links show the host and path only.
- IP address
23.216.147.78 - IP address
23.34.172.65 - IP address
104.98.118.160 - IP address
23.101.168.44 - IP address
23.216.147.75
Files
24Files the file created, changed or deleted.
- Written
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll - Written
C:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD53.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD53.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF19.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF19.tmp.WERInternalMetadata.xml
Show all 24 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF78.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF78.tmp.xml - Written
C:\Users\user\AppData\Local\DBG - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERECD1.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERED9D.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2A.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6A.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD7B.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3478.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER349C.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER34AC.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD53.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD53.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF19.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF19.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF78.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF78.tmp.xml
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5732\Sessions\1\BaseNamedObjects\Global\AmiProviderMutex_InventoryApplicationFile\Sessions\1\BaseNamedObjects\Global\f0a72f7f-41af-4a8a-a59e-feff6271ad7d
Sandbox background — not the file
9The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\SysWOW64\WerFault.exe - VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google2084_581042200\bin\updater.exe - VM host
20.99.184.37 - VM host
192.229.211.108
Show all 9 entries for sandbox background — not the file
- VM host
23.196.145.221 - VM host
192.168.0.6 - VM host
23.55.140.42
Files this sample writes at runtime
This file drops 2 children at runtime. None are currently flagged malicious in our cache. 2 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 026a5c3dd0e7a447cab6…5281b9Not checkedno saved verdict
- eaced9e2b35a42997bf5…324de6Not checkedno saved verdict
Chapter 04
Technical details
None of the 59 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 6, 2026, 6:49 AM UTC
- SHA-256
a803086e90166a64cc978be7bf9e44c7022feff2410222973f75ca52d8bd257d- SHA-1
e359e01a3c83100a8f0d981bbf5cee17dd4e4767- MD5
040564bde6b3535a24ed9d315f324e6f
About this file
Terraria.exe is a Win32 EXE file of 1.9 MB.
- Type and size
- Win32 EXE · 1.9 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jan 17, 2012On VirusTotal.
- Submitted by
- 397 distinct sources
- Packer
- None detected
- Entropy
- 5.42 of 8
First scanned
Antivirus consensus
0 of 59 engines flagged this file
15 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-111 engines0flagged
- Tier-232 engines0flagged
- Low-trust16 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderNo result
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureNo result
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaNo result
- RisingNo result
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Terraria.exe safe?
What is Terraria.exe?
How many antivirus engines detected Terraria.exe?
What is the SHA-256 hash of Terraria.exe?
Is it safe to run Terraria.exe?
How up to date is this analysis of Terraria.exe?
Community
Member reviews and reports for this exact file hash.