File scan report
Verdict Suspicious
Is 4n4l
This archive appears to hold a malware-analysis utility that 10 of the 67 antivirus engines that checked it flag, mostly with generic labels, while two major antivirus engines…
Read the whole reasonShow less
Why Suspicious? 10 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or extract it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already opened or extracted it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
10 of 67 flagged
- Flagged 10
- No detection 57
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 6mo ago
Chapter 02
Why we think so
4 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Fortinet labels it riskware named after the analysis tool itself, and TrendMicro uses a generic trojan label. The sandbox runs show the program loading its own bundled libraries, with no recorded injection target. The file was submitted by a single source, so we cannot confirm it is an unmodified copy.
Two major antivirus engines flagged the archive, but they disagree. Fortinet calls it riskware named after the 4N4LDetector tool, while TrendMicro gives a generic trojan label. The other detections are generic buckets or machine-learning verdicts from engines such as DeepInstinct, SentinelOne and several less reliable engines, and none names a malware family. The file name and label pattern match a security research tool, and analysis tools are often flagged by rule-based engines. The sandbox runs show the program loading its own bundled libraries and writing configuration files, with no named injection target and no high-risk techniques confirmed. Because the archive was first seen on Apr 23, 2026 and submitted by only one source, we cannot verify it came from the original author.
What We Detected
10 of the 67 antivirus engines that checked it flagged this ZIP archive. Fortinet reports Riskware/4N4LDetector and TrendMicro-HouseCall reports a generic trojan label. Panda, DeepInstinct, SentinelOne, Sangfor and several less reliable engines also flagged it, all with generic or machine-learning labels. Fifteen major antivirus engines did not flag it, and no malware family is named.
Threat Behavior
The sandbox runs show the bundled program starting from the temporary folder and loading its own libraries, including Qt, capstone and a detection engine library. It also wrote configuration files and a registry file for adding a context-menu entry. No injection into another process was recorded. No complete host-reputation result is available.
What To Do Now
If you need this analysis tool, download it only from its original author's official release page and compare the files. Otherwise, do not run this copy. Keep your antivirus enabled while handling it.
Where this verdict could be wrong2 caveats
- Fortinet names the analysis tool itself as riskware rather than malware. The observed processes match that tool loading its own bundled libraries, which points toward a false positive on a genuine research utility.
- Fifteen major antivirus engines, including BitDefender, ESET-NOD32, Avira and DrWeb, did not flag the archive.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Fortinet's label names the analysis tool itself as riskware rather than a malware family.
- No malware family was named by any engine.
- Fifteen major antivirus engines did not flag it.
- The sandbox runs recorded no injection into other processes.
- Two major antivirus engines flagged the archive, one with a generic trojan label.
- Ten engines in total detected it.
- The file is rarely seen and was submitted by only one source, so its origin cannot be confirmed.
- It contains an unsigned executable.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 9spawned processes
- 0network contacts
- 40filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Checked whether it was running on a test computer.
Note: Listed the programs running on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
4n4lDetectorV3.5.zip
b311912a1d481a701085c52f06309f3fadf5961c39c1246f5b19ec3f3c70b2ee
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
4N4LDetector.exe
"C:\Users\<USER>\AppData\Local\Temp\4N4LDetector.exe"
Test run - Evidence 3 of 5: ProcessSeen in the test run
rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Qt5Core.dll",#1
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
Add4n4lMenu.reg
C:\Users\<USER>\AppData\Local\Temp\Add4n4lMenu.reg
Test run - Evidence 5 of 5: Written fileSeen in the test run
~DF0DC143667F9DB458.TMP
C:\Users\<USER>\AppData\Local\Temp\~DF0DC143667F9DB458.TMP
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1055· Process injection
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1497· Sandbox evasion
- T1539
- T1562.001· Disables security
Observed activity
Processes started
9Programs the file ran, with their command lines.
4N4LDetector.exe"C:\Users\<USER>\AppData\Local\Temp\4N4LDetector.exe"rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Qt5Core.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Qt5Script.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\UTypes.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\capstone.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\diedll.dll",#1
Show all 9 entries for processes started
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\msvbvm60.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\msvcp120.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\msvcr120.dll",#1
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\Add4n4lMenu.reg - Written
C:\Users\<USER>\AppData\Local\Temp\~DF0DC143667F9DB458.TMP - Written
C:\Users\<USER>\AppData\Local\Temp\config\m - Written
C:\Users\<USER>\AppData\Local\Temp\config\vtapi - Written
C:\Users\<USER>\AppData\Local\Temp\config\filelen - Written
C:\Users\<USER>\AppData\Local\Temp\config\cnf
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\config\heur - Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\168cb618-9b05-4462-b8fc-b7e472d599e5 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\2083aca5-d1cc-4dcc-a5b8-002dc6d2f57b - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\ec1645fd-90fb-492c-bf27-82657157b05b - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\87348603-3470-4fe6-9d23-8a7e0a733138 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\e0be8b5b-7cb8-4fbb-84d4-e8b9d8294cd4 - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5704.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A9F.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5BAA.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5704.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A9F.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5BAA.tmp.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CFF.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER602D.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER60DA.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CFF.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER602D.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER60DA.tmp.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B07.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DE6.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F5E.tmp
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\WERReportingForProcess5876Global\AmiProviderMutex_InventoryApplicationFileGlobal\117af6e2-fd96-4985-90b6-95abd3871b61Local\WERReportingForProcess6844Global\dcb1141b-e7ce-4adc-a837-50332c304b4fLocal\WERReportingForProcess3852
Show all 10 entries for mutexes
Global\5aa9939d-c007-4bf5-9565-1153298b552aLocal\WERReportingForProcess5768Global\88f87881-3783-433d-ab53-5d30ac99834eLocal\WERReportingForProcess3100
Sandbox background — not the file
7The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 744 - VM process
WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 740 - VM process
WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 728 - VM process
WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 796 - VM process
WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 708 - VM process
WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 712
Show all 7 entries for sandbox background — not the file
- VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 684ea699ebaf3c6898eb…94b722Not checkedno saved verdict
- 87b0725412223a031106…147e02Not checkedno saved verdict
- 1a58668650dc0c4d2b2f…b9bdfdNot checkedno saved verdict
- 00fc609a673f9fc40bca…d86f21Not checkedno saved verdict
- 50e9f2ddfcaaba8bcaeb…aaf4aaNot checkedno saved verdict
- 2e3467ed57feac1aa468…e17008Not checkedno saved verdict
- 9120049e1b26d8fa9287…05b263Not checkedno saved verdict
- 151ee604e3751a4a3613…68266bNot checkedno saved verdict
- 9c40eb51646a75e8b5c8…4de0b7Not checkedno saved verdict
- 89f9cec60dd3a6dcfb7a…54584eNot checkedno saved verdict
Chapter 04
Technical details
10 of the 67 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 10
- Fortinet (major engine)Riskware/4N4LDetector
- TrendMicro-HouseCall (major engine)Trojan.Win32.Gen.TL0101DJ26YK
- Antiy-AVLTrojan/Win32.Agent
- DeepInstinctMALICIOUS
- MaxSecureTrojan.Malware.300983.susgen
- PandaPUP/Hacktool
- RisingTrojan.VBCode!8.1B9B2 (CLOUD)
- SangforTrojan.Win32.Save.a
File fingerprint
- Last analyzed
- Apr 24, 2026, 5:15 AM UTC
- SHA-256
b311912a1d481a701085c52f06309f3fadf5961c39c1246f5b19ec3f3c70b2ee- SHA-1
f39e297600617799c8fcf8a56cc1ced6e742e08c- MD5
e8cdc9dde0fb3970dbeafa5726d6dd65
About this file
4n4lDetectorV3.5.zip is a ZIP file of 6.5 MB.
- Type and size
- ZIP · 6.5 MB
- Signer
- Not applicable
- First seen
- Apr 23, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned Updated
Verdict history
- Malicious
- Suspiciousafter a new scan
- Maliciousafter a new scan
- Not fully confirmedafter a new scan
- Safeafter a new scan
- Suspiciousafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
10 of 67 engines flagged this file
9 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines2flagged
- Tier-236 engines4flagged
- Low-trust14 engines4flagged
View all 76 engine results
- Antiy-AVLMalicious: Trojan/Win32.Agent
- DeepInstinctMalicious: MALICIOUS
- FortinetMalicious: Riskware/4N4LDetector
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- PandaMalicious: PUP/Hacktool
- RisingMalicious: Trojan.VBCode!8.1B9B2 (CLOUD)
- SangforMalicious: Trojan.Win32.Save.a
- SentinelOneMalicious: Static AI - Malicious Archive
- TrendMicro-HouseCallMalicious: Trojan.Win32.Gen.TL0101DJ26YK
- VBA32Malicious: TScope.Trojan.VB
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSNo result
- TrendMicroClean
- TrustlookClean
- VaristClean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is 4n4lDetectorV3.5.zip safe, or is it malware?
What is 4n4lDetectorV3.5.zip?
How many antivirus engines detected 4n4lDetectorV3.5.zip?
I already downloaded and opened or extracted 4n4lDetectorV3.5.zip — what should I do?
What is the SHA-256 hash of 4n4lDetectorV3.5.zip?
How up to date is this analysis of 4n4lDetectorV3.5.zip?
Community
Member reviews and reports for this exact file hash.
