File scan report
Verdict Safe
Is 7b8e79daee3205f24efe7ae1690295ef.
No antivirus engine flagged this established ZIP archive, and its completed sandbox run found no offensive behavior, malicious verdict, or harmful extracted child.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 66 flagged
- Flagged 0
- No detection 66
- No result 8
- Code signing Not applicable
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 66 antivirus engines that checked it left the archive unflagged, including 17 major antivirus engines. One completed sandbox run produced no malicious verdict or offensive technique, while external intelligence supplied no malware match; however, the six extracted children lack affirmative individual classifications.
The strongest evidence is complete agreement across 74 antivirus engines, with zero malicious or suspicious detections and 17 major antivirus engines reporting no detection. A completed sandbox run produced no malicious verdict, no offensive technique, and no observed network contacts. None of six inspected extracted children was identified as harmful, although their individual verdicts remain unknown. Researcher-curated intelligence returned no matching malware entry or YARA rule. The archive has also circulated for more than three years across 35 sources, reducing concern that it is an untested new sample.
What We Detected
No engine among 74 flagged the ZIP archive, and all 17 reporting major antivirus engines—including BitDefender, ESET-NOD32, Kaspersky, and Microsoft—left it undetected. No named threat family or suspicious engine label was reported.
Threat Behavior
One completed sandbox run recorded no malicious verdict and no offensive MITRE technique. It observed two techniques common in legitimate software, T1518.001 and T1564.001, but no contacted domains, IP addresses, or URLs. Six extracted children were inspected without any being identified as harmful, although their individual classifications remain unknown. No complete contacted-host reputation result was saved.
What To Do Now
The available evidence supports ordinary use from a trusted source. Because this is an archive with unclassified extracted files, scan the extracted contents before opening them and keep security software enabled.
Where this verdict could be wrong3 caveats
- The six extracted children have unknown individual verdicts despite the absence of a known-malicious dropped file, so their contents are not affirmatively established as benign.
- The missing contacted-host reputation result means no saved host-reputation cross-check is available, although the completed sandbox run recorded no contacted domains, IPs, or URLs.
- The archive carries detect-debug-environment and sets-process-name tags, but no offensive techniques were mapped and no engine associated them with malware.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/66 engines reported a malicious or suspicious detection.
- 17 major antivirus engines reported no detection.
- One completed sandbox run had no malicious verdict and zero offensive techniques.
- No inspected child was identified as malicious.
- No CIRCL, MalwareBazaar, or YARAify match was found.
- Six extracted children have unknown individual verdicts.
- No complete contacted-host reputation cross-check was saved.
- Tags include detect-debug-environment and sets-process-name, though no harmful activity corroborated them.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 2sandbox rule tags
- 0spawned processes
- 0network contacts
- 22filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
2MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1518.001· Checks your AV
- T1564.001· Hides artifacts
Observed activity
Files
22Files the file created, changed or deleted.
- Written
/root/.cache/dconf/user - Written
/var/lib/fwupd/gnupg/.#lk0x00005557f6064b80.buffalo.3454 - Written
/var/lib/fwupd/gnupg/.#lk0x00005580d86c2b80.buffalo.3466 - Written
/var/lib/fwupd/gnupg/.#lk0x00005601099a4b80.buffalo.3458 - Written
/var/lib/fwupd/gnupg/.#lk0x00005601129f7b80.buffalo.3460 - Written
/var/lib/fwupd/gnupg/.#lk0x0000564e32b59b80.buffalo.3462
Show all 22 entries for files
- Written
/var/lib/fwupd/gnupg/.#lk0x00005654ffaa1b80.buffalo.3456 - Written
/var/lib/fwupd/gnupg/pubring.kbx.tmp - Deleted
/var/lib/fwupd/gnupg/.#lk0x00005557f6064b80.buffalo.3454 - Deleted
/var/lib/fwupd/gnupg/.#lk0x00005557f6064b80.buffalo.3454x - Deleted
/var/lib/fwupd/gnupg/.#lk0x00005580d86c2b80.buffalo.3466 - Deleted
/var/lib/fwupd/gnupg/.#lk0x00005580d86c2b80.buffalo.3466x - Deleted
/var/lib/fwupd/gnupg/.#lk0x00005601099a4b80.buffalo.3458 - Deleted
/var/lib/fwupd/gnupg/.#lk0x00005601099a4b80.buffalo.3458x - Deleted
/var/lib/fwupd/gnupg/.#lk0x00005601129f7b80.buffalo.3460 - Deleted
/var/lib/fwupd/gnupg/.#lk0x00005601129f7b80.buffalo.3460x - Deleted
/var/lib/fwupd/gnupg/.#lk0x0000564e32b59b80.buffalo.3462 - Deleted
/var/lib/fwupd/gnupg/.#lk0x0000564e32b59b80.buffalo.3462x - Deleted
/var/lib/fwupd/gnupg/.#lk0x00005654ffaa1b80.buffalo.3456 - Deleted
/var/lib/fwupd/gnupg/.#lk0x00005654ffaa1b80.buffalo.3456x - Deleted
/var/lib/fwupd/gnupg/pubring.kbx.lock - Deleted
/var/lib/fwupd/gnupg/pubring.kbx.tmp
Files this sample writes at runtime
This file drops 6 children at runtime. None are currently flagged malicious in our cache. 6 have no saved verdict and were not checked; that is missing coverage, not a finding.
- d75271bec4f19bc5acd3…375b86Not checkedno saved verdict
- 71e7cee56bae9ae07d22…07536dNot checkedno saved verdict
- 7a564f833b755c7aad7c…af4a0dNot checkedno saved verdict
- cd3b802a32e1353bcae0…03a10aNot checkedno saved verdict
- 7f20a89656baa93e0122…7f6fcaNot checkedno saved verdict
- e055868e070818fb2386…401a7dNot checkedno saved verdict
Chapter 04
Technical details
None of the 66 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 4, 2026, 11:55 PM UTC
- SHA-256
ad016cfcf95ef46429c392e7b9e4ab80f1c2e698605eef134f872582d66233d4- SHA-1
881cada70e4009b89b599b1ecbed62d9d7764574- MD5
eef146d0bc698848993c945d23107ecc
About this file
7b8e79daee3205f24efe7ae1690295ef.zip is a ZIP file of 8.0 MB.
- Type and size
- ZIP · 8.0 MB
- Signer
- Not applicable
- First seen
- Mar 15, 2023On VirusTotal.
- Submitted by
- 35 distinct sources
First scanned Updated
Antivirus consensus
0 of 66 engines flagged this file
8 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust13 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is 7b8e79daee3205f24efe7ae1690295ef.zip safe?
What is 7b8e79daee3205f24efe7ae1690295ef.zip?
How many antivirus engines detected 7b8e79daee3205f24efe7ae1690295ef.zip?
What is the SHA-256 hash of 7b8e79daee3205f24efe7ae1690295ef.zip?
Is it safe to open or extract 7b8e79daee3205f24efe7ae1690295ef.zip?
How up to date is this analysis of 7b8e79daee3205f24efe7ae1690295ef.zip?
Community
Member reviews and reports for this exact file hash.