File scan report
Verdict Safe
Is Crazy-
None of the 67 antivirus engines that checked it flagged this older game archive, and its completed sandbox run and fully covered host checks produced no corroborating threat…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 67 flagged
- Flagged 0
- No detection 67
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
One sandbox run mapped two potentially offensive techniques, but it issued no malicious finding, identified no explicit persistence indicator, and the complete host-reputation check found no known harmful contacts.
The strongest evidence is the absence of detections across 76 engines, including all 18 reporting major antivirus engines. A completed sandbox run launched an installer-like executable, wrote game and uninstaller files, and did not return a malicious finding. It mapped startup-persistence and security-impairment techniques, but recorded no explicit persistence indicator or injected process, so those mappings lack behavioral corroboration. Reputation checks covered every distinct observed domain, IP, and URL and found no known malicious or suspicious host. The archive is uncommon and its ten extracted files lack saved individual verdicts, which limits assurance but does not outweigh the clean engine and evidence from the test run.
What We Detected
None of the 67 antivirus engines that checked it flagged the ZIP as malicious or suspicious. This includes 18 major antivirus engines reporting no detection, and no engine supplied a malware-family label. MalwareBazaar and YARAify also provided no family-specific corroboration.
Threat Behavior
One completed sandbox run extracted and launched a Crazy Duck Hunter executable, created a Program Files directory, and wrote standard Inno Setup uninstall records. The run mapped T1547.001 and T1562.001, but recorded no explicit persistence indicator, no process injection, and no malicious sandbox finding. Reputation checks covered all 34 distinct observed domains, IPs, and URLs, with no known malicious or suspicious matches.
What To Do Now
The evidence supports ordinary use if the archive came from a source you intended to trust. Because it is uncommon and the ten extracted files have no saved individual verdicts, keep security software enabled and rescan the extracted executable before running it if provenance is uncertain.
Where this verdict could be wrong3 caveats
- The sandbox mapped startup persistence and security-impairment techniques, although it recorded no explicit persistence indicators and issued no malicious verdict.
- Only one submission from one source is recorded, so prevalence provides little independent assurance.
- Ten extracted files have no saved verdict, leaving their individual status unresolved.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 67 antivirus engines that checked it flagged the archive, including 18 major antivirus engines reporting no detection.
- The completed sandbox run did not issue a malicious finding and recorded no process injection.
- Every distinct observed network contact received a reputation check, with no known malicious or suspicious match.
- No malware-family match was returned by MalwareBazaar or YARAify.
- The archive has been submitted only once, so it has little prevalence-based reputation.
- The sandbox mapped startup-persistence and security-impairment techniques, although no explicit persistence or protection-disabling action was recorded.
- Ten extracted files do not have saved individual verdicts, leaving incomplete file it created coverage.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 15sandbox rule tags
- 11spawned processes
- 34network contacts
- 30filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
15MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1046
- T1056· Keylogging
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1095· Custom network
- T1105· Network file transfer
- T1129· Loads modules
- T1497· Sandbox evasion
- T1547.001· Auto-start
- T1562.001· Disables security
- T1573
Observed activity
Processes started
11Programs the file ran, with their command lines.
Crazy Duck Hunter.exe"C:\Users\<USER>\AppData\Local\Temp\Crazy Duck Hunter.exe"is-NVL18.tmp"C:\Users\<USER>\AppData\Local\Temp\is-AQK7Q.tmp\is-NVL18.tmp" /SL4 $1F011E "C:\Users\<USER>\AppData\Local\Temp\Crazy Duck Hunter.exe" 8421147 50688Crazy Duck Hunter.exeC:\Users\<USER>\AppData\Local\Temp\is-MJV4A.tmp\is-A3D1M.tmp /SL4 $60150 C:\Users\<USER>\Downloads\Crazy Duck Hunter.exe 8421147 50688unarchiver.exeC:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\Crazy-Duck-Hunter_Win_EN.zip7za.exeC:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\hlmft4ox.tih" "C:\Users\user\Desktop\Crazy-Duck-Hunter_Win_EN.zipcmd.exeC:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\hlmft4ox.tih\Crazy Duck Hunter.exe
Show all 11 entries for processes started
Crazy Duck Hunter.exeC:\Users\user\AppData\Local\Temp\hlmft4ox.tih\Crazy Duck Hunter.exeis-TC41E.tmp"C:\Users\user\AppData\Local\Temp\is-HAS93.tmp\is-TC41E.tmp" /SL4 $303E2 "C:\Users\user\AppData\Local\Temp\hlmft4ox.tih\Crazy Duck Hunter.exe" 8421147 50688website.exeC:\Program Files (x86)\Crazy Duck Hunter\website.exechrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.twinno.com/crazyducks/thankyou/chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,9166072538010975814,15979227009725881987,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 /prefetch:8
Network contacts
3434 hosts, listed as 20 domains, 14 addresses, 2 links. Links show the host and path only.
- Domain
wpad.local - Domain
www.twinno.com - Domain
www.godaddy.com - Domain
img6.wsimg.com - Domain
service.force.com - Domain
location.force.com
Show all 36 entries for network contacts
- Domain
location.l.force.com - Domain
gui.godaddy.com - Domain
img1.wsimg.com - Domain
events.api.godaddy.com - Domain
csp.godaddy.com - Domain
utqyhche.local - Domain
ztszxebzfkyhpn.local - Domain
jjfbemifm.local - Domain
edgedl.me.gvt1.com - Domain
clientservices.googleapis.com - Domain
translate.googleapis.com - Domain
www.googletagmanager.com - Domain
pagead2.googlesyndication.com - Domain
www.gstatic.com - IP address
13.248.169.48 - IP address
66.102.1.84 - IP address
142.251.143.142 - IP address
161.71.1.165 - IP address
2.22.248.22 - IP address
2.19.192.8 - IP address
142.251.143.195 - IP address
23.33.66.135 - IP address
142.251.143.200 - IP address
23.79.88.222 - IP address
104.91.3.39 - IP address
142.251.143.194 - IP address
142.251.143.170 - IP address
142.251.143.163 - URL
http://www.twinno.com/crazyducks/thankyou/ - URL
http://www.twinno.com/lander
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\is-MJV4A.tmp\is-A3D1M.tmp - Written
C:\Program Files (x86)\Crazy Duck Hunter - Written
C:\Program Files (x86)\Crazy Duck Hunter\is-16M6S.tmp - Written
C:\Program Files (x86)\Crazy Duck Hunter\is-8HQFT.tmp - Written
C:\Program Files (x86)\Crazy Duck Hunter\is-A0DB3.tmp - Written
C:\Program Files (x86)\Crazy Duck Hunter\is-IQN56.tmp
Show all 30 entries for files
- Written
C:\Program Files (x86)\Crazy Duck Hunter\is-LJVBG.tmp - Written
C:\Program Files (x86)\Crazy Duck Hunter\unins000.dat - Written
C:\ProgramData - Written
C:\ProgramData\Microsoft\Windows\Start Menu - Written
C:\ProgramData\Microsoft\Windows\Start Menu\Programs - Written
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crazy Duck Hunter - Written
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crazy Duck Hunter\Crazy Duck Hunter.lnk - Written
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crazy Duck Hunter\Game Instructions.lnk - Written
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crazy Duck Hunter\Uninstall Crazy Duck Hunter.lnk - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6492CDF8-17B0.pma - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-662D27DB-104.pma - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old~RF69ea4.TMP - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF69f8e.TMP - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index~RF6ef44.TMP - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG.old~RF691e2.TMP - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old~RF6933a.TMP - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0 - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ar - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ar\messages.json - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\bg - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\bg\messages.json
Registry and auto-start
13Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Crazy Duck Hunter_is1 - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Crazy Duck Hunter_is1\Inno Setup: Setup Version - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Crazy Duck Hunter_is1\Inno Setup: App Path - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Crazy Duck Hunter_is1\InstallLocation - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Crazy Duck Hunter_is1\Inno Setup: Icon Group - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Crazy Duck Hunter_is1\Inno Setup: User
Show all 13 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Crazy Duck Hunter_is1\DisplayName - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Crazy Duck Hunter_is1\DisplayIcon - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Crazy Duck Hunter_is1\UninstallString - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Crazy Duck Hunter_is1\QuietUninstallString - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Crazy Duck Hunter_is1\NoModify - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Crazy Duck Hunter_is1\NoRepair - Deleted
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
239.255.255.250 - VM host
0.0.0.0
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 9884e9d1b4f8a873ccbd…360d87Not checkedno saved verdict
- ab0982c120a65adc3aa8…9d8f5aNot checkedno saved verdict
- f126c123ac8aef8ddecd…bd98d5Not checkedno saved verdict
- 89441660327101a51cfa…3935eaNot checkedno saved verdict
- cd1ea9647bd2fab8620b…001483Not checkedno saved verdict
- 01eba8e0934e8c67b46e…4a1a28Not checkedno saved verdict
- f299c5d32da4f92d6573…fc3f67Not checkedno saved verdict
- 517560a3318f6c48396d…c656cfNot checkedno saved verdict
- ae813718f86f6f93a681…b5ea23Not checkedno saved verdict
- 1ed81fa8dfb6999a9fed…8de184Not checkedno saved verdict
Chapter 04
Technical details
None of the 67 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 13, 2026, 4:48 AM UTC
- SHA-256
aaa67f01c592e553e2a96d45475c7c284d76382e4758b228a2068f68ac1ecba9- SHA-1
b009e3e48059d656f8f23969df703bec17912d1a- MD5
b35b1469b32e1bb7376553e7d3f4a52e
About this file
Crazy-Duck-Hunter_Win_EN.zip is a ZIP file of 8.6 MB.
- Type and size
- ZIP · 8.6 MB
- Signer
- Not applicable
- First seen
- Apr 27, 2024On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 67 engines flagged this file
9 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-238 engines0flagged
- Low-trust11 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BitDefenderThetaClean
- BkavNo result
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MAXClean
- MaxSecureClean
- McAfeeClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Crazy-Duck-Hunter_Win_EN.zip safe?
What is Crazy-Duck-Hunter_Win_EN.zip?
How many antivirus engines detected Crazy-Duck-Hunter_Win_EN.zip?
What is the SHA-256 hash of Crazy-Duck-Hunter_Win_EN.zip?
Is it safe to open or extract Crazy-Duck-Hunter_Win_EN.zip?
How up to date is this analysis of Crazy-Duck-Hunter_Win_EN.zip?
Community
Member reviews and reports for this exact file hash.