File scan report
Verdict Suspicious
Is Sugar Lust -
Unsigned executable with two YARA rule hits and direct-IP traffic but zero AV detections.
Why Suspicious? Unsigned Win32 executable.
Limited evidence · One sign points to a problem; nothing else confirms it.
Treat the file as suspicious pending further host-reputation data or additional sandbox runs; keep all security software active.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
4 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No antivirus engine flagged the file, yet two community YARA rules matched and the sample contacted 14 IPs without domain resolution. The unsigned status and missing host-reputation data leave the risk unresolved.
Zero detections across 76 engines and major silence argue against active malware classification. However, the YARAify matches on a Cobalt Strike rule and a debugger-check rule, combined with direct-IP traffic and an unsigned PE, create conflicting signals. The file is widely seen and long established with 225 submitters, yet the absence of a contactedHosts reputation check prevents confirming whether the IPs are malicious. Similar import-table fingerprint matches were inconclusive because they lacked signer correlation. These mixed indicators place the sample in the suspicious band.
What We Detected
76 engines scanned the sample; none returned a malicious result. Two YARA rules from YARAify matched: cobalt_strike_tmp01925d3f and DebuggerCheck__API. The executable is unsigned and contacted 14 IP addresses directly without domain names.
Threat Behavior
One sandbox recorded techniques common in legitimate software (T1071, T1082, T1083, T1129, T1574.002) but no offensive MITRE techniques and no malicious sandbox verdict. No files it created or persistence indicators were observed. Host reputation for the contacted IPs is unavailable.
What To Do Now
Do not execute the file. Keep security software enabled. If the file must be used, run it in an isolated environment and monitor outbound connections to the listed IPs.
Where this verdict could be wrong2 caveats
- YARAify hit on cobalt_strike_tmp01925d3f could indicate Cobalt Strike loader, but no engine detection and unsigned status leave the signal ambiguous.
- No complete contacted-host reputation result was available; without contactedHosts reputation the a control server hypothesis cannot be confirmed.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/71 engines flagged malicious
- widely seen and long established prevalence (225 sources)
- no malicious sandbox verdict
- Unsigned Win32 executable
- YARA rule match on cobalt_strike_tmp01925d3f
- Direct-IP traffic to 14 addresses
- contactedHosts reputation check unavailable
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 5sandbox rule tags
- 2spawned processes
- 1network contact
- 0filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 4: FileSeen in the test run
Sugar Lust - Hentai Harem.exe
b30dc819d0d632439b16ba324645d03d9d61e3e06fad1d0918f2d5aa35307b31
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 4: ProcessSeen in the test run
b30dc819d0d632439b16ba324645d03d9d61e3e06fad1d0918f2d5aa35307b31.exe
Test run - Evidence 3 of 4: ProcessSeen in the test run
file.exe
"C:\Users\user\Desktop\file.exe"
Test run - +1 more recorded observation
- 1
Network
Hosts contacted
- Evidence 4 of 4: Contacted hostSeen in the test run
20.75.60.91
Contacted during the test run.
Test run
4 facts from the test run. See the full activity list.
Includes 5 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jul 26, 2026, 1:52 AM UTC
- SHA-256
b30dc819d0d632439b16ba324645d03d9d61e3e06fad1d0918f2d5aa35307b31- SHA-1
bff1b152e015349c2dab43c43e5de2aaebe483e3- MD5
c666eaa18eaed0b032a1922acbb9ae60
About this file
Sugar Lust - Hentai Harem.exe is a Win32 EXE file of 672.3 kB.
- Type and size
- Win32 EXE · 672.3 kB
- Signer
- UnsignedNo code signature.
- First seen
- May 11, 2024On VirusTotal.
- Submitted by
- 225 distinct sources
- Packer
- None detected
- Entropy
- 4.30 of 8
First scanned
Includes every engine result (76), 2 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Sugar Lust - Hentai Harem.exe safe, or is it malware?
What is Sugar Lust - Hentai Harem.exe?
How many antivirus engines detected Sugar Lust - Hentai Harem.exe?
What should I do if I already ran Sugar Lust - Hentai Harem.exe?
What is the SHA-256 hash of Sugar Lust - Hentai Harem.exe?
How up to date is this analysis of Sugar Lust - Hentai Harem.exe?
Community
Member reviews and reports for this exact file hash.