File scan report
Verdict Safe
Is qbert.
An archive first seen on Oct 27, 2007 that none of the 65 antivirus engines that checked it flagged, with no hostile techniques or network contacts recorded during its sandbox run.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 19y ago
Chapter 02
Why we think so
0 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 65 antivirus engines that checked it flagged this archive, including all 18 of the major ones, and it has been circulating since Oct 27, 2007 across 13 submitting sources. Nothing in the evidence suggests malicious content in the container itself.
This is a ZIP container of about 26 KB, first seen on Oct 27, 2007 and submitted 55 times from 13 distinct sources. Every engine that returned a result cleared it: 0 of 75 flagged the file, with the major antivirus engines such as BitDefender, Kaspersky, ESET-NOD32, Microsoft, Avira and Fortinet all silent. The public reference databases and community rule sets hold no entry for this hash, which removes the most common source of hidden-signal alerts on archive files. A sandbox run was completed and produced no rare high-risk techniques, no named injection targets, no contacted domains, addresses or URLs, and no dropped files; the only registry activity recorded was browser toolbar state, which is ordinary shell interaction. There is no signature or build metadata to weigh because a ZIP has neither. The main gap is that our own inspection never opened the archive's contents, so the clean results describe the container rather than anything stored inside it.
What We Detected
The file is a small ZIP archive. None of the 65 antivirus engines that checked it flagged it, and all 18 major antivirus engines returned a clean result. No public malware database, malware-specific rule set or known-software reference holds this hash.
Threat Behavior
A sandbox run was completed and recorded no high-risk techniques, no process injection targets, no persistence indicators and no outbound network activity. The only changes noted were browser toolbar state under the user hive, which is typical of opening a shell or browser window rather than of malware. No files it created were observed being written to disk.
What We Could Not Check
The archive's contents were never extracted and examined in our own inspection, so the engine results apply to the compressed container; anything stored inside it has not been individually reviewed here. A reputation lookup for contacted hosts was also not completed, so no host-level judgement exists in either direction. Neither gap produced any hostile finding.
What To Do Now
No action is needed. Keep your security software enabled and, as with any archive, open it only when you recognise where it came from, since compressed files can carry executables or documents that individual engine verdicts on the container do not describe.
Where this verdict could be wrong2 caveats
- Nobody opened this archive's contents in our own inspection, so the clean engine results describe the container; anything stored inside it has not been individually examined here.
- The reputation cross-check for hosts the file might contact was not completed, so no host-level result is available either way.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 65 antivirus engines that checked it flagged the archive, and all 18 major antivirus engines cleared it.
- No malware-database entry, no malware-specific community rule and no known-software conflict for this hash.
- The sandbox run showed no high-risk techniques, no injected processes, no persistence and no network contacts.
- The archive has been in circulation since Oct 27, 2007 with no hostile reports attached to it.
- No brand impersonation, packed-binary traits or filename disguise indicators apply to this container.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 1 isolated test; no test environment rated what it did as risky.
Test run summary
Capture complete- 1isolated sandbox run
- 0spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Observed activity
Registry and auto-start
4Settings the file changed, including ways to start again after a restart.
- Set
HKU\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked - Set
HKU\S-1-5-21-575823232-3065301323-1442773979-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Count - Set
HKU\S-1-5-21-575823232-3065301323-1442773979-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Type - Set
HKU\S-1-5-21-575823232-3065301323-1442773979-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Time
Chapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 6, 2026, 11:09 PM UTC
- SHA-256
b2671a6a18ae26b634f0e810e3d00f44bf4de8f9671bd8bc43046e4f3f0bc327- SHA-1
04ad21a1d7acb8fce7714164680e1c5471d9d9eb- MD5
09cce0c0b707d39844b329bb0424c6d8
About this file
qbert.zip is a ZIP file of 25.9 kB.
- Type and size
- ZIP · 25.9 kB
- Signer
- Not applicable
- First seen
- Oct 27, 2007On VirusTotal.
- Submitted by
- 13 distinct sources
First scanned
Antivirus consensus
0 of 65 engines flagged this file
10 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is qbert.zip safe?
What is qbert.zip?
How many antivirus engines detected qbert.zip?
What is the SHA-256 hash of qbert.zip?
Is it safe to open or extract qbert.zip?
How up to date is this analysis of qbert.zip?
Community
Member reviews and reports for this exact file hash.