File scan report
Verdict Suspicious
Is preserve.
Eleven of the 71 antivirus engines that checked it flagged this unsigned executable, while generic family labels, a clean sandbox run, and broad circulation leave material…
Read the whole reasonShow less
Why Suspicious? 11 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
11 of 71 flagged
- Flagged 11
- No detection 60
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Two major antivirus engines and six deduplicated engine sources flagged the executable, and runtime mapping includes possible process injection and defense impairment. However, the labels are generic, the only completed sandbox run returned clean, and no external malware-specific intelligence corroborated a family, so the file should remain isolated pending verification.
Eleven of the 71 antivirus engines that checked it flagged the executable, including two major detections and six deduplicated detection sources. The labels mostly describe a generic trojan and do not establish a coherent named family; several listed products also share underlying scan technology. One completed sandbox run returned clean, but it mapped activity to and T1562.001, which warrants caution even though no injected target, persistence, or file it created was recorded. The executable is unsigned and lacks publisher history, weakening identity-based reassurance. Broad recent circulation, lack of packing indicators, and no malware-specific external-intelligence hit are meaningful counter-signals, but they do not outweigh the detection count enough to justify execution.
What We Detected
Eleven of the 71 antivirus engines that checked it flagged the file, with six deduplicated detection sources. BitDefender and GData used the generic label Trojan.GenericKD.81571119, while TrendMicro-HouseCall used TROJ_GEN.R002H09IS26. These labels indicate concern but do not provide strong agreement on a recognized malware family.
Threat Behavior
The completed sandbox run returned clean and recorded no persistence, dropped files, or identified injected process. The only recorded IP contact was marked as analysis-environment background traffic, and no complete contacted-host reputation check is available.
What To Do Now
Do not run the executable on a production system. Keep security software enabled, verify the file through its expected publisher or official distribution channel, and quarantine or remove it if its origin cannot be established.
Where this verdict could be wrong4 caveats
- The only completed sandbox run returned clean and recorded no persistence, dropped files, or identified injected process.
- Most engines did not flag the sample, including Kaspersky, ESET-NOD32, Fortinet, Avast, AVG, and Avira.
- The file has broad recent circulation, and static PE analysis found neither a recognized packer nor high-entropy code.
- No malware-specific YARAify rule or MalwareBazaar record corroborated the generic antivirus labels.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The only completed sandbox run returned clean and recorded no persistence or files it created.
- The file was submitted by 466 sources a total of 596 times, indicating broad recent circulation.
- Static PE analysis found no recognized packer, likely packing, or high-entropy code.
- No malware-specific YARA rule or MalwareBazaar record corroborated the detections.
- Fourteen major antivirus engines reported no detection.
- Eleven of the 71 antivirus engines that checked it flagged the executable, including two major detections.
- Six deduplicated antivirus sources contributed detections, so the result is not limited to one scanner lineage.
- The executable is unsigned and has no established publisher history.
- The test run mapped possible process injection and impairment of defenses.
- No complete reputation check is available for sample-attributed network hosts.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 5sandbox rule tags
- 1spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 2: FileSeen in the test run
preserve.exe
ab381c03b071193a6a62d69555b523d64c43d4b701715e6345b2960ec156693f
Uploaded file
- 1
Processes
What ran
- Evidence 2 of 2: ProcessSeen in the test run
preserve.exe
"C:\Users\user\Desktop\preserve.exe"
Test run
2 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 5 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
11 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 11
- BitDefender (major engine)Trojan.GenericKD.81571119
- GData (major engine)Trojan.GenericKD.81571119
- TrendMicro-HouseCall (major engine)TROJ_GEN.R002H09IS26
- alibabacloudSuspicious
- ALYacTrojan.GenericKD.81571119
- ArcabitTrojan.Generic.D4DCAD2F
- CTXexe.trojan.generic
- GridinsoftTrojan.Win64.Gen.cl
File fingerprint
- Last analyzed
- Oct 11, 2026, 9:38 PM UTC
- SHA-256
ab381c03b071193a6a62d69555b523d64c43d4b701715e6345b2960ec156693f- SHA-1
675e58a12be424b6d5cadb1002bf2432f34ed996- MD5
77a56d73a832f50664d1725a66a2d7bf
About this file
preserve.exe is a Win32 EXE file of 11.9 MB.
- Type and size
- Win32 EXE · 11.9 MB
- Signer
- UnsignedNo code signature.
- First seen
- Sep 22, 2026On VirusTotal.
- Submitted by
- 466 distinct sources
- Packer
- None detected
- Entropy
- 6.42 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is preserve.exe safe, or is it malware?
What is preserve.exe?
How many antivirus engines detected preserve.exe?
I already downloaded and ran preserve.exe — what should I do?
What is the SHA-256 hash of preserve.exe?
How up to date is this analysis of preserve.exe?
Community
Member reviews and reports for this exact file hash.