File scan report
Verdict Suspicious
Is OMNITUBE_
A backdoor detection from a major antivirus engine and one hostile sandbox result raise concern, but sparse detections, a clean sandbox run, and non-hostile contacts prevent…
Read the whole reasonShow less
Why Suspicious? 4 antivirus engines flag it and one sandbox test run rated it malicious while another found nothing.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already installed it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
4 of 69 flagged
- Flagged 4
- No detection 65
- No result 6
- Code signing Unsigned
- Test run Completed
- First seen 13d ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Four of the 69 antivirus engines that checked it flagged this unsigned, installer, including Kaspersky with a generic Python backdoor label. One sandbox reported hostile activity and mapped several offensive techniques, while another sandbox was clean and the fully covered host check found no suspicious destinations, leaving substantial uncertainty.
The strongest concern is Kaspersky's generic Python backdoor detection, supported by three less reliable detections using broadly similar labels. Evidence from the test run is mixed: one sandbox returned a malicious result and mapped T1055, T1485, T1486, T1548, and T1562.001, but another sandbox returned clean. The file is unsigned and was observed from only three submitters, so there is little publisher or prevalence evidence to offset those warnings. Conversely, 71 of the 69 antivirus engines that checked it did not flag it, there is no major family consensus, and the complete host-reputation check found no hostile destinations among the observed contacts. No malware-specific research rules or saved malicious files it created provide independent confirmation, so the evidence supports caution rather than a definitive malware-family attribution.
What We Detected
Four of the 69 antivirus engines that checked it flagged the installer. Kaspersky identified a generic Python Agent backdoor pattern, while Alibaba and Rising also used generic backdoor labels; Trapmine supplied a machine-learning warning. The remaining detections do not establish a named family, and 16 other major antivirus engines did not flag the file.
Threat Behavior
One of two sandbox runs returned a malicious result and mapped process injection, data destruction, ransomware-like impact, privilege elevation, and security-control impairment techniques. However, the other sandbox run returned clean, no injected target process was recorded, and some observed activity—creating a Python environment and contacting Python package infrastructure—can occur during legitimate installation. The host-reputation check covered every distinct observed non-background contact and found no malicious or suspicious destination.
What To Do Now
Do not run the installer on a production or personal system until its publisher and official download channel can be independently verified. Keep security software enabled, and if analysis is necessary, use an isolated disposable environment without sensitive data or credentials.
Where this verdict could be wrong5 caveats
- Only 4 of the 69 antivirus engines that checked it flagged the file, and 16 major antivirus engines did not flag it; there is no major family consensus.
- The second sandbox returned clean, so runtime verdicts do not agree.
- All distinct observed non-background contacts were covered by the host-reputation check, with no malicious or suspicious host matches.
- No malware-specific YARA rules matched, and none of the ten dropped files has a saved malicious verdict.
- The observed Python environment setup and package-download activity could belong to a legitimate application installer.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only four of the 69 antivirus engines that checked it flagged the file, and most major antivirus engines did not.
- A second sandbox run returned clean, making the runtime verdicts inconclusive.
- The complete host-reputation check found no malicious or suspicious destinations among the observed contacts.
- No malware-specific research rules matched the sample.
- None of the inspected dropped files has a saved malicious verdict, although all ten remain unclassified.
- The executable is unsigned, so its publisher and integrity cannot be authenticated through code signing.
- It is and has appeared from only three submitters.
- Kaspersky and three additional engines flagged it, with three detections describing backdoor-like behavior.
- One sandbox returned a malicious result and mapped several offensive techniques, including process injection and security-control impairment.
- The filename resembles security software, but the file lacks an established signer history supporting that presentation.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; 1 test environment rated what it did as risky.
Test run summary
Capture complete- 29sandbox rule tags
- 11spawned processes
- 6network contacts
- 40filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
High concern: Encrypted files on the test computer, as ransomware does.
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Downloaded a file during the test run.
Moderate concern: Unpacked hidden content while it ran.
Moderate concern: Checked whether it was running on a test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Read the user name of the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
OMNITUBE_Setup_1.4.2.exe
bb57fd5c2e2babf29e1617c8477e2bb626f7e3367003b4345a3b211902a444e4
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
uv.exe
C:\OMNITUBE\runtime\uv.exe venv C:\OMNITUBE\.venv --python C:\OMNITUBE\runtime\python\cpython-3.12.14-windows-x86_64-none\python.exe --seed
Test run - Evidence 3 of 7: ProcessSeen in the test run
python.exe
"C:\OMNITUBE\runtime\python\cpython-3.12.14-windows-x86_64-none\python.exe" -I -B -c "import sys; sys.path = [\"C:\\OMNITUBE\\runtime\\cache\\.tmpJyDThq\"] + sys.path; from python.get_interpreter_info import main; main()"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
CACHEDIR.TAG
C:\OMNITUBE\runtime\cache\CACHEDIR.TAG
Test run - Evidence 5 of 7: Written fileSeen in the test run
.gitignore
C:\OMNITUBE\runtime\cache\.gitignore
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
releases.astral.sh
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostWorked out from other results
pypi.org
Older reputation report (safe), not counted as current evidence.
Contacted-host cross-check - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 29 mapped techniques, every process, file, registry and network entry and 1 dropped file.
Show the technical evidenceChapter 04
Technical details
4 of the 69 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 4
- Kaspersky (major engine)HEUR:Backdoor.Python.Agent.gen
- AlibabaBackdoor:Application/ython.e95d7493
- RisingBackdoor.Agent!8.C5D (CLOUD)
- Trapminesuspicious.low.ml.score
File fingerprint
- Last analyzed
- Oct 14, 2026, 1:37 PM UTC
- SHA-256
bb57fd5c2e2babf29e1617c8477e2bb626f7e3367003b4345a3b211902a444e4- SHA-1
8e26f18d2605529d94e526ade45cdc38234d880d- MD5
4f4e4f54e671f96fe2b17e2d09d64e13
About this file
OMNITUBE_Setup_1.4.2.exe is a Win32 EXE file of 42.2 MB.
- Type and size
- Win32 EXE · 42.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 13, 2026On VirusTotal.
- Submitted by
- 3 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 6.36 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is OMNITUBE_Setup_1.4.2.exe safe, or is it malware?
What is OMNITUBE_Setup_1.4.2.exe?
How many antivirus engines detected OMNITUBE_Setup_1.4.2.exe?
What should I do if I already installed OMNITUBE_Setup_1.4.2.exe?
What is the SHA-256 hash of OMNITUBE_Setup_1.4.2.exe?
How up to date is this analysis of OMNITUBE_Setup_1.4.2.exe?
Community
Member reviews and reports for this exact file hash.