File scan report
Verdict Suspicious
Is LMAOBOXLOADER.
The executable draws substantial concern: 17 of the 71 antivirus engines that checked it flagged it, including three major antivirus engines, and the sandbox mapped defense…
Read the whole reasonShow less
Why Suspicious? 17 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
17 of 71 flagged
- Flagged 17
- No detection 54
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 11mo ago
Chapter 02
Why we think so
4 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The major labels do not identify a consistent family, and the completed sandbox run did not issue a malware verdict, so the evidence remains mixed.
Seventeen of the 71 antivirus engines that checked it flagged the executable, and all 17 represent OEM-deduplicated independent detections. Three major antivirus engines raised concerns, but their labels diverge between malicious behavior, MSIL injector/riskware, and generic unwanted program rather than converging on a named family. The executable is unsigned, leaving no verified publisher identity to counterbalance those detections. Observation from the test run mapped T1562.001, attempted impairment of defenses, but the sandbox produced no malicious verdict and its recorded domains were analysis-environment background traffic rather than sample activity. Broad circulation, silence from 14 major antivirus engines, and the absence of malware-specific external-intelligence matches leave a meaningful false-positive possibility.
What We Detected
Seventeen of the 71 antivirus engines that checked it flagged the executable. Three major antivirus engines contributed detections: Fortinet reported malicious behavior, GData identified an MSIL injector/riskware pattern, and Ikarus used a generic unwanted program label. Several additional engines reported generic malware, obfuscator, or Trojan patterns, but no strong family consensus emerged.
Threat Behavior
The completed sandbox run mapped T1562.001, which represents attempted impairment of defenses and is a material risk indicator. The three contacted domains were explicitly attributed to analysis-environment background traffic, not to the sample, and the complete host cross-check found no cached malicious or suspicious hosts among them.
Context and Limitations
The executable has no digital signature or established publisher history. Conversely, it has appeared from 258 sources, 14 major antivirus engines did not flag it, and neither MalwareBazaar nor malware-specific YARAify rules matched it.
What To Do Now
Do not launch the file on a production system. Keep security software enabled, let your antivirus remove the executable, and obtain a fresh copy only from a verified official source if the software is genuinely required.
Where this verdict could be wrong4 caveats
- Fourteen major antivirus engines did not flag the file, and the three major detections disagree between behavioral malware, injector/riskware, and generic unwanted program labels.
- The completed sandbox run produced no malicious sandbox verdict and showed no sample-attributed network contacts; all three recorded domains were identified as analysis-environment background traffic.
- No MalwareBazaar record or malware-specific YARAify rule matched the sample.
- The file has circulated through 258 sources over roughly ten months, which is less typical of a newly deployed targeted threat.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Fourteen major antivirus engines did not flag the file.
- All recorded network contacts were attributed to analysis-environment background activity, and the complete host check found no cached malicious or suspicious hosts.
- No MalwareBazaar entry or malware-specific YARA rule matched the sample.
- The file has been submitted 285 times by 258 sources rather than remaining narrowly distributed.
- Seventeen of the 71 antivirus engines that checked it raised detections, including three major antivirus engines.
- The executable is unsigned and has no established publisher history.
- Sandbox data mapped attempted impairment of defenses.
- Multiple products described MSIL injection, obfuscation, Trojan, or high-confidence malicious patterns.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 7sandbox rule tags
- 2spawned processes
- 0network contacts
- 6filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Unpacked hidden content while it ran.
Moderate concern: Checked whether it was running on a test computer.
Note: Listed the programs running on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
LMAOBOXLOADER.exe
b27477d43fcc96e9a22a2526e24fee34e5588ce195d793bcc895ed7afc514b99
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
LMAOBOXLOADERx64-1-4-15.exe
"C:\Users\<USER>\Desktop\LMAOBOXLOADERx64-1-4-15.exe"
Test run - Evidence 3 of 5: ProcessSeen in the test run
LMAOBOXLOADERx64-1-4-15.exe
"C:\Users\user\Desktop\LMAOBOXLOADERx64-1-4-15.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
Logs
C:\ProgramData\Microsoft\Windows Security Health\Logs
Test run - Evidence 5 of 5: Written fileSeen in the test run
Roaming
C:\Users\user\AppData\Roaming
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
Includes 7 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
17 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 17
- Fortinet (major engine)Malicious_Behavior.SB
- GData (major engine)MSIL.Riskware.Injector.KW
- Ikarus (major engine)PUA.Generic
- TrellixENS (major engine)Artemis!5683342F17CE
- BkavW32.Malware.8FDBA2A7
- CrowdStrikewin/malicious_confidence_100% (W)
- CylanceUnsafe
- DeepInstinctMALICIOUS
File fingerprint
- Last analyzed
- Oct 11, 2026, 9:36 AM UTC
- SHA-256
b27477d43fcc96e9a22a2526e24fee34e5588ce195d793bcc895ed7afc514b99- SHA-1
b1d5d155ceaa10efc217245ef4cbbff6fc166617- MD5
5683342f17ce5b160bb67a94be03cb71
About this file
LMAOBOXLOADER.exe is a Win32 EXE file of 246.8 kB.
- Type and size
- Win32 EXE · 246.8 kB
- Signer
- UnsignedNo code signature.
- First seen
- Nov 23, 2025On VirusTotal.
- Submitted by
- 258 distinct sources
- Packer
- None detected
- Entropy
- 5.06 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is LMAOBOXLOADER.exe safe, or is it malware?
What is LMAOBOXLOADER.exe?
How many antivirus engines detected LMAOBOXLOADER.exe?
I already downloaded and ran LMAOBOXLOADER.exe — what should I do?
What is the SHA-256 hash of LMAOBOXLOADER.exe?
How up to date is this analysis of LMAOBOXLOADER.exe?
Community
Member reviews and reports for this exact file hash.