File scan report
Verdict Safe
Is SMITSC.
Only 2 of the 72 antivirus engines that checked it flagged this long-observed executable, both with less reliable generic labels unsupported by higher-quality engines, sandbox…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 72 flagged
- Flagged 2
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 12y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The two generic detections are likely false positives: neither came from a major antivirus engine, and no recognized malware family was identified. The test run found no malicious outcome, named injection target, persistence, or sample-attributed network activity, while external intelligence supplied no corroboration.
Eighteen major antivirus engines reported no detection, and no engine consensus identified a real malware family. Four sandbox runs produced no malicious verdict, named injection target, persistence indicator, or network activity attributable to the sample. The mapping lacks an injection target and therefore does not show that process injection occurred. Host-reputation checks found no malicious or suspicious result among the seven inspected contacts, all of which were identified as analysis-environment background traffic. The file is unsigned, but that absence of publisher provenance does not outweigh the broader evidence supporting false positives.
What We Detected
Only 2 of the 72 antivirus engines that checked it flagged the executable. MaxSecure and Rising used generic trojan labels, while the major antivirus engines reported no detection and no recognized malware family emerged.
Threat Behavior
Four sandbox runs produced no malicious verdict. No named process-injection target, persistence mechanism, file it created, or sample-attributed network contact was recorded. A T1055 mapping appeared without the artifact needed to demonstrate process injection. The seven inspected contacts were analysis-environment background traffic, and none had malicious or suspicious reputation.
What To Do Now
The detections appear consistent with false positives. Keep security software enabled and obtain the executable from its original trusted source; if its origin is uncertain or it behaves unexpectedly, avoid running it and request publisher verification.
Where this verdict could be wrong2 caveats
- MaxSecure and Rising each produced a generic trojan detection, so a malicious interpretation cannot be ruled out solely from antivirus results.
- The executable is unsigned, leaving no verified publisher identity to provide additional provenance.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- All 18 major antivirus engines reported no detection.
- Four sandbox runs produced no malicious verdict or corroborated high-risk behavior.
- No sample-attributed network contact or malicious dropped file was observed.
- No malware-specific community rule or public malware-database match was found.
- The executable is not packed and has no high-entropy code indication.
- Two engines produced generic trojan detections.
- The executable has no verified digital signature.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 6sandbox rule tags
- 1spawned processes
- 0network contacts
- 14filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
6MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1055· Process injection
- T1057· Lists programs
- T1082· System recon
- T1083· Scans your files
- T1543.003· Service install
- T1569.002
Observed activity
Processes started
1Programs the file ran, with their command lines.
befdd4ec75cf71bf57af7057a8fab41110efea819155af31cf3ebe4006ac23f6.exe%SAMPLEPATH%\befdd4ec75cf71bf57af7057a8fab41110efea819155af31cf3ebe4006ac23f6.exe
Files
14Files the file created, changed or deleted.
- Written
\Device\ConDrv\\Connect - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE53.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2D.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER27A7.tmp.WERInternalMetadata.xml
Show all 14 entries for files
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER27B9.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER27BA.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C6C.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D37.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D57.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER315C.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER315D.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER316E.tmp.txt
Sandbox background — not the file
9The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM host
20.99.132.105 - VM host
23.216.147.64 - VM host
a83f:8110:2800:1800:4000:1800:1800:100 - VM host
20.99.186.246 - VM host
192.229.211.108
Show all 9 entries for sandbox background — not the file
- VM host
20.99.184.37 - VM host
131.253.33.203 - VM host
20.99.185.48
Chapter 04
Technical details
2 of the 72 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- MaxSecureTrojan.Malware.300983.susgen
- RisingTrojan.Generic@AI.84 (RDML:/QuQhebzGRB3/kA95zrdkQ)
File fingerprint
- Last analyzed
- Oct 20, 2026, 6:08 PM UTC
- SHA-256
befdd4ec75cf71bf57af7057a8fab41110efea819155af31cf3ebe4006ac23f6- SHA-1
6e91bf847149955d6443fac69a67101c9acfefc2- MD5
b53e83ac67b8f93a4b3ed01bca328e4c
About this file
SMITSC.exe is a Win32 EXE file of 13.3 kB.
- Type and size
- Win32 EXE · 13.3 kB
- Signer
- UnsignedNo code signature.
- First seen
- Nov 1, 2013On VirusTotal.
- Submitted by
- 20 distinct sources
- Packer
- None detected
- Entropy
- 4.72 of 8
First scanned
Antivirus consensus
2 of 72 engines flagged this file
4 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-238 engines0flagged
- Low-trust16 engines2flagged
View all 76 engine results
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- RisingMalicious: Trojan.Generic@AI.84 (RDML:/QuQhebzGRB3/kA95zrdkQ)
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BitDefenderThetaClean
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CybereasonClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MAXClean
- McAfeeClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is SMITSC.exe safe?
What is SMITSC.exe?
How many antivirus engines detected SMITSC.exe?
What is the SHA-256 hash of SMITSC.exe?
Is it safe to run SMITSC.exe?
How up to date is this analysis of SMITSC.exe?
Community
Member reviews and reports for this exact file hash.