File scan report
Verdict Safe
Is dxball.
A 2019 game archive that none of the 66 antivirus engines that checked it flagged, that four sandbox runs ran without a hostile verdict, and whose dropped files match known good…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
No action is needed; the engine results, the sandbox runs and the reference-database checks all point the same way. Keep your protection enabled and only extract archives received from senders or sites you trust.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 66 flagged
- Flagged 0
- No detection 66
- No result 8
- Code signing Not applicable
- Test run Completed
- First seen 7y ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This ZIP archive, first seen on Jan 14, 2019 and submitted by 37 distinct sources, produced no detections from any of the 74 engines and no suspicious labels. Its extracted executable ran in the sandbox without a hostile verdict, no blocked network destinations or malicious dropped files were found, and the archive matches nothing in the public malware databases we check.
The archive is old and widely circulated: first seen on Jan 14, 2019, submitted by 37 distinct sources, and every one of the 66 antivirus engines that checked it returned nothing, including all 18 major antivirus engines. That absence is backed by evidence from the test run rather than standing alone, because the extracted program was run in the sandbox and the combined verdict across the runs was clean. The only network contact recorded during those runs is the analysis machine's own background traffic to a Microsoft content host, not activity from the file, and the one host that was cross-checked against our reputation data came back with no malicious or suspicious entry. None of the dropped files is hostile; four of them resolve to known-software reference entries.
What We Detected
Nothing. All 66 antivirus engines that checked it in our network returned an empty result for this archive, including the 18 highest-trust engines, and there is no family consensus of any kind. Our reference-database and community-rule lookups also came back empty, and the file is not listed in any public malware sample database we consult.
The archive contains an executable, which the sandbox extracted and launched. That program ran to completion in the analysis environments and the combined verdict across the runs was clean.
Threat Behavior
The behavioural summary records only ordinary activity: file extraction, self-execution, and general system queries that installers and games routinely make.
The single network contact in the run belongs to the analysis machine's own background traffic, not to the file. The one host that was cross-checked against our reputation cache returned no malicious or suspicious entry. Files written during the run ended up in the temporary folder, and four of the dropped components resolve to known-software reference entries; none of them is hostile.
What To Do Now
Nothing in the evidence calls for action. Keep normal protection enabled and open the archive only if it came from a source you trust, since even a clean archive can be re-packed with different contents elsewhere.
Where this verdict could be wrong2 caveats
- Nobody inspected the bytes inside the archive; the clean picture rests on engine verdicts and sandbox behaviour of the extracted program, not on a static look at its contents.
- The archive first appeared in 2019 and has been submitted by 37 distinct sources, so the clean history is well established, though an old file can still have been replaced with different content elsewhere.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 66 antivirus engines that checked it flagged the file, and every major antivirus engine reported it clean.
- The extracted program ran in the sandbox and the combined verdict across the runs was clean, with no split between runs.
- No malicious or suspicious network destination and no malicious dropped file were found; four dropped components match known-software reference entries.
- The file has been in circulation since Jan 14, 2019 and has been submitted by 37 distinct sources without a detection.
- The archive carries an executable that starts when the contents are extracted and run, so its safety rests on the engine and sandbox results for that program rather than on the archive being inert.
- Nobody inspected the code inside the archive byte by byte; the assessment is based on engine verdicts and on how the extracted program behaved in the sandbox.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 8sandbox rule tags
- 4spawned processes
- 0network contacts
- 25filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
8MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1036
- T1055· Process injection
- T1057· Lists programs
- T1070.004· Covers its tracks
- T1082· System recon
- T1083· Scans your files
- T1497· Sandbox evasion
- T1562.001· Disables security
Observed activity
Processes started
4Programs the file ran, with their command lines.
unarchiver.exeC:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\sample.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\2akmii3h.jr4" "C:\Users\user\Desktop\sample.zip"cmd.exeC:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2akmii3h.jr4\dxball19.exe"dxball19.exeC:\Users\user\AppData\Local\Temp\2akmii3h.jr4\dxball19.exe
Files
25Files the file created, changed or deleted.
- Written
C:\Windows\~GLH0000.TMP - Written
C:\Users\<USER>\AppData\Local\Temp\GL_70EB.EXE - Written
C:\Users\<USER>\AppData\Local\Temp\GLG74D5.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\~GLH0001.TMP - Written
C:\Users\<USER>\AppData\Local\Temp\~GLH0002.TMP - Written
C:\Windows\system32\GLBSINST.%$D
Show all 25 entries for files
- Written
C:\Users\user\AppData\Local\Temp - Written
C:\Users\user\AppData\Local\Temp\2akmii3h.jr4 - Written
C:\Users\user\AppData\Local\Temp\2akmii3h.jr4\dxball19.exe - Written
C:\Users\user\AppData\Local\Temp\GLBC252.tmp - Written
C:\Users\user\AppData\Local\Temp\GLFC2B2.tmp - Written
C:\Users\user\AppData\Local\Temp\GLFC35F.tmp - Written
C:\Users\user\AppData\Local\Temp\GLGC2B1.tmp - Written
C:\Users\user\AppData\Local\Temp\GL_BCC3.EXE - Written
C:\Users\user\AppData\Local\Temp\GL_BCC3.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\GL_70EB.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\GLB74D4.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\GLF74E6.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\GLF74F6.tmp - Deleted
C:\Windows\system32\GLBSINST.%$D - Deleted
C:\Users\user\AppData\Local\Temp\GLBC252.tmp - Deleted
C:\Users\user\AppData\Local\Temp\GLFC2B2.tmp - Deleted
C:\Users\user\AppData\Local\Temp\GLFC35F.tmp - Deleted
C:\Users\user\AppData\Local\Temp\GL_BCC3.tmp - Deleted
C:\Windows\SysWOW64\GLBSINST.%$D
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
assets.msn.com
Files this sample writes at runtime
This file drops 8 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 2472a555ba5cbda459f6…81ae77Not checkedno saved verdict
- 3b6ca4475c020f6e5a16…309377Cleantrust 85known-software reference set · not scanned here
- cd6f14a5348d963c2736…cf3b7dCleantrust 85known-software reference set · not scanned here
- 36cf6aa1ea0815a66b53…257cdcNot checkedno saved verdict
- 8d5a22b087854fe891a6…c06896Not checkedno saved verdict
- 4acecc5980b01104d0c9…4d8db1Not checkedno saved verdict
- 770fbe170453b9a893e6…bd59c3Cleantrust 85known-software reference set · not scanned here
- 79a6d0024d14a70d7f73…72a427Cleantrust 85known-software reference set · not scanned here
Chapter 04
Technical details
None of the 66 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 7, 2026, 3:05 AM UTC
- SHA-256
c228f0fd2868f901480a485c24252a1073a6d104af0d417f2734d78bb405bd81- SHA-1
37e3d984366cdd683c3ad509d4df298521ab303b- MD5
dce5e25eda6e5d6b2b96a5f37fbe5ad5
About this file
dxball.zip is a ZIP file of 826.9 kB.
- Type and size
- ZIP · 826.9 kB
- Signer
- Not applicable
- First seen
- Jan 14, 2019On VirusTotal.
- Submitted by
- 37 distinct sources
First scanned
Antivirus consensus
0 of 66 engines flagged this file
8 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust13 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is dxball.zip safe?
What is dxball.zip?
How many antivirus engines detected dxball.zip?
What is the SHA-256 hash of dxball.zip?
Is it safe to open or extract dxball.zip?
How up to date is this analysis of dxball.zip?
Community
Member reviews and reports for this exact file hash.