MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Safe

Unsigned ZIP named 4n4lDetectorV3.5.zip matches research tool profile with anti-analysis behaviors flagged heuristically by our antivirus network.

Trust score82Moderate trust
4n4lDetectorV3.5.zip
6.2 MB
b311912a1d481a7010…3f3c70b2ee
Antivirus engines
10 of 76 flagged
Code signing
Unsigned
Age
First seen 3mo ago
MT AI Engine · Verdict analysis

The reasoning behind this verdict

The MT AI Engine weighs every signal from this scan — antivirus detections, sandbox behaviour, code signing, prevalence and historical matches — to reach a single, evidence-based verdict.

82%Confidence
High
Reasoning

Filename and heuristics align with research tools that perform anti-analysis to evade sandboxes, explaining MITRE T1055 injection and direct IP contact. Tier-1 engines flag it as riskware or generic trojan, but lack family agreement and are outweighed by clean sandbox behavior and absence of malicious children/hosts. No signing or prevalence history, but no adversarial flags or external intel hits contradict the safe research tool shape. We lean safe per established patterns for such unsigned tools.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. Fortinet (tier1): Riskware/4N4LDetector

  2. Panda (tier2): PUP/Hacktool (labelFlags.hacktool=true)

  3. triggeredHeuristics['security_tool_classifier']: fired=true, evidence['dominantLabels=Riskware/4N4LDetector|PUP/Hacktool']

  4. behaviour.processes: rundll32.exe loading capstone.dll + Qt5Core.dll

  5. file.tags: ['detect-debug-environment']

Points in its favour
  • Research tool heuristics fired
  • Capstone.dll + Qt libs (legit for analysis tools)
  • No malicious sandbox verdict
  • No bad dropped children or hosts
Points against
  • Unsigned executable
  • Rare new file (1 submission)
  • Process injection (T1055)
  • Direct IP contact (no DNS)
Recommended action

This is a safe research tool despite heuristic flags. Extract and run in a VM if testing anti-analysis features, but no deletion needed.

What to do now

This file looks safe based on everything we checked.

  1. This file is safe to use.

  2. Good habit: only download files from the official website or an app store.

  3. Keep your antivirus and Windows updates switched on so you stay protected.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
9

Adversary techniques mapped to the MITRE ATT&CK framework.

T1027· Obfuscated codeT1027.002· Obfuscated codeT1055· Process injectionT1057· Lists programsT1071· Remote server (C2)T1082· System reconT1497· Sandbox evasionT1539T1562.001· Disables security
Spawned processes
15
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\4N4LDetector.exe"
$(unnamed)
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Qt5Core.dll",#1
$(unnamed)
C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 744
$(unnamed)
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Qt5Script.dll",#1
$(unnamed)
C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 740
$(unnamed)
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\UTypes.dll",#1
$(unnamed)
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\capstone.dll",#1
$(unnamed)
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\diedll.dll",#1
+7 more processes captured.
Network activity
1
IP addresses1
  • 162.159.36.2
Filesystem & mutexes
40
Files written15
  • C:\Users\<USER>\AppData\Local\Temp\Add4n4lMenu.reg
  • C:\Users\<USER>\AppData\Local\Temp\~DF0DC143667F9DB458.TMP
  • C:\Users\<USER>\AppData\Local\Temp\config\m
  • C:\Users\<USER>\AppData\Local\Temp\config\vtapi
  • C:\Users\<USER>\AppData\Local\Temp\config\filelen
+10 more
Files deleted15
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER5704.tmp
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A9F.tmp
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER5BAA.tmp
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER5704.tmp.dmp
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A9F.tmp.WERInternalMetadata.xml
+10 more
Mutexes created10
  • Local\WERReportingForProcess5876
  • Global\AmiProviderMutex_InventoryApplicationFile
  • Global\117af6e2-fd96-4985-90b6-95abd3871b61
  • Local\WERReportingForProcess6844
  • Global\dcb1141b-e7ce-4adc-a837-50332c304b4f
+5 more
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • 684ea699ebaf3c6898eb…94b722Never scanned
    never seen before
  • 87b0725412223a031106…147e02Never scanned
    never seen before
  • 1a58668650dc0c4d2b2f…b9bdfdNever scanned
    never seen before
  • 00fc609a673f9fc40bca…d86f21Never scanned
    never seen before
  • 50e9f2ddfcaaba8bcaeb…aaf4aaNever scanned
    never seen before
  • 2e3467ed57feac1aa468…e17008Never scanned
    never seen before
  • 9120049e1b26d8fa9287…05b263Never scanned
    never seen before
  • 151ee604e3751a4a3613…68266bNever scanned
    never seen before
  • 9c40eb51646a75e8b5c8…4de0b7Never scanned
    never seen before
  • 89f9cec60dd3a6dcfb7a…54584eNever scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA & heuristic rule matches

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

2 synthesis
MITRE ATT&CK profile
Defense evasion× 1C2× 1
MalwareTips synthesis rules
Our own detection rules, applied to the scan data and sandbox behaviour
  • ProcessInjection
    T1055
    high

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    "C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Qt5Core.dll",#1
  • DirectIpC2
    T1071
    medium

    Sample contacted 1 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    162.159.36.2
Antivirus engine breakdown

10 detections across 76 engines

10 malicious0 suspicious66 clean
Tier-117 engines
2flag
Top commercial AVs (low FP rate)
Tier-241 engines
4flag
Mainstream engines with mixed FP rates
Low-trust18 engines
4flag
Heuristic / generic-AI engines (high FP rate)
Antiy-AVL
malicious
Trojan/Win32.Agent
DeepInstinct
malicious
MALICIOUS
Fortinet
malicious
Riskware/4N4LDetector
MaxSecure
malicious
Trojan.Malware.300983.susgen
Panda
malicious
PUP/Hacktool
Rising
malicious
Trojan.VBCode!8.1B9B2 (CLOUD)
Sangfor
malicious
Trojan.Win32.Save.a
SentinelOne
malicious
Static AI - Malicious Archive
TrendMicro-HouseCall
malicious
Trojan.Win32.Gen.TL0101DJ26YK
VBA32
malicious
TScope.Trojan.VB
Hash b311912a1d48… cross-referenced against 76 AV engines via our AV network.
Prevalence

How widely this file has been seen

Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.

Rare & new
Unique uploaders
1
Very few people have ever uploaded this — rare.
Total submissions
1
Includes repeat uploads by the same source.
First seen
3mo ago
Apr 23, 2026
Prevalence quadrant
here
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
4/23/2026, 3:21:44 PM
First seen (MalwareBazaar)
—
Last analysis (VT)
4/23/2026, 3:21:44 PM
Scanned here
4/24/2026, 1:15:15 AM
File name
4n4lDetectorV3.5.zip
Size
6.18 MB
MIME type
application/x-zip-compressed
Detected type
ZIP
SHA-256
b311912a1d481a701085c52f06309f3fadf5961c39c1246f5b19ec3f3c70b2ee
MD5
e8cdc9dde0fb3970dbeafa5726d6dd65
SHA-1
f39e297600617799c8fcf8a56cc1ced6e742e08c
First seen (VT)
4/23/2026, 3:21:44 PM
Last analysis (VT)
4/23/2026, 3:21:44 PM
First scan (MalwareTips)
4/23/2026, 3:22:51 PM
Last scan (MalwareTips)
4/24/2026, 1:15:15 AM
Behavior tags
contains-pezipdetect-debug-environmentlong-sleeps
Frequently asked

Safety FAQ

Common questions about 4n4lDetectorV3.5.zip, answered from the scan data above.

  • 4n4lDetectorV3.5.zip appears safe. 66 of 76 antivirus engines report it clean, with only 10 low-confidence detections that read as false positives. As a habit, only open files you downloaded from the official source, since attackers sometimes distribute trojanised copies of legitimate software under the same name.
  • 4n4lDetectorV3.5.zip is a compressed archive (application/x-zip-compressed), about 6.2 MB. Our analysis found no threat indicators for it. A file's name can be reused by different files, so we identify it by its cryptographic hash (below).
  • 10 of 76 antivirus engines flagged 4n4lDetectorV3.5.zip, 10 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.
  • The SHA-256 hash of 4n4lDetectorV3.5.zip is b311912a1d481a701085c52f06309f3fadf5961c39c1246f5b19ec3f3c70b2ee, and its MD5 is e8cdc9dde0fb3970dbeafa5726d6dd65. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
  • Based on this scan, yes — 4n4lDetectorV3.5.zip shows no threat indicators. The important caveat is source: make sure you downloaded it from the official website or a trusted store, because attackers sometimes distribute malware-laced copies under a legitimate file's name. If your own antivirus flags it while we report it clean, that is most often a false positive, but verify the source before overriding your antivirus.
  • This report reflects the scan run on April 23, 2026. Because a file's hash never changes, the identity of 4n4lDetectorV3.5.zip is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scanned by
harlan4096Staff
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.