File scan report
Verdict Suspicious
Is Vectorworks.
This unsigned, heavily protected executable is flagged by 17 of the 72 antivirus engines that checked it, six of them major, but the labels mostly point to the Themida protector…
Read the whole reasonShow less
Why Suspicious? 17 antivirus engines flag it and one of our detection rules matched it.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
Avoid running this copy and get the software from the official vendor instead. If you have already run it, scan your system with up-to-date security software.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
17 of 72 flagged
- Flagged 17
- No detection 55
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
4 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
17 of the 72 antivirus engines that checked it flag this file, including ESET, Ikarus, Microsoft, Sophos, Symantec and Fortinet. Their labels describe Themida packing, machine-learning or reputation verdicts rather than a known malware family. The file is unsigned and rarely seen, and observation from the test run showed no hostile activity. It cannot be cleared.
Six major antivirus engines flag the file, which is too much to treat as noise. However, none of them names a malware family. Their labels refer to the Themida protector, generic reputation or machine-learning scores. The file is wrapped in both Themida and Obsidium protectors and carries no digital signature, so the claim to be Vectorworks software cannot be confirmed. The sandbox run recorded no high-risk techniques, network contacts or process injection, and no threat-intelligence database lists the hash. Taken together, the evidence is mixed and leans cautious.
What We Detected
17 of the 72 antivirus engines that checked it flag this executable. Six of them are major antivirus engines: ESET (Packed.Themida variant), Ikarus (Trojan.Win64.Themida), Microsoft (Wacapew machine-learning detection), Sophos (generic reputation unwanted program), Symantec (machine-learning) and Fortinet (behaviour-based). None of the labels names a known malware family. The file is unsigned, protected with Themida/WinLicense and Obsidium, and has been submitted by only two sources since it was first seen on Mar 22, 2021.
Threat Behavior
The sandbox run recorded no high-risk techniques, no network connections and no process injection. Heavy protection can hide behaviour from analysis, so this absence does not prove the file is harmless. No threat-intelligence database lists the file.
What To Do Now
Do not run this copy. If you need Vectorworks, download it directly from the official vendor, and keep your antivirus protection enabled.
Where this verdict could be wrong2 caveats
- Most detections name the Themida protector or are machine-learning or reputation verdicts. Licensed commercial software is commonly wrapped in Themida, so these could be false positives triggered by the packing alone.
- The sandbox run recorded no high-risk techniques, network contacts or injection, and no threat-intelligence database lists the file.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Observation from the test run showed no high-risk techniques, network contacts or injection.
- No threat-intelligence database or malware rule lists this file.
- No engine names a specific malware family.
- Six major antivirus engines flag the file.
- The file has no digital signature, so the claimed product cannot be verified.
- It is wrapped in two commercial protectors (Themida and Obsidium) that hide its code.
- It is rarely seen, with only two submitters.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 1 isolated test; no test environment rated what it did as risky.
Test run summary
Capture complete- 1isolated sandbox run
- 0spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
Includes every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
17 of the 72 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 17
- ESET-NOD32 (major engine)a variant of Win64/Packed.Themida.KX
- Fortinet (major engine)Malicious_Behavior.SB
- Ikarus (major engine)Trojan.Win64.Themida
- Microsoft (major engine)Program:Win32/Wacapew.C!ml
- Sophos (major engine)Generic Reputation PUA (PUA)
- Symantec (major engine)ML.Attribute.HighConfidence
- BkavW64.AIDetectMalware
- CrowdStrikewin/malicious_confidence_60% (D)
File fingerprint
- Last analyzed
- Oct 24, 2026, 4:52 PM UTC
- SHA-256
c96377aec692ed023d1f03ffe3a1cb37e7400b2f9542562b296353311bd7d2fd- SHA-1
d0d54c2872a6ce8e264d05c4844ba694fd16414e- MD5
c9887a71b8e3a7daaf57fa5f8a50f86b
About this file
Vectorworks.EXE says it is Vectorworks 2021 Application (Vectorworks 2021), 38.2 MB.
- Claims to be
- Vectorworks 2021 Application (Vectorworks 2021)From the file's own version information, written by whoever built it.
- Original name
- Vectorworks.EXEMatches the shared file name.
- Type and size
- Win32 EXE · 38.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 22, 2021On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- Obsidium (DetectItEasy protector), Themida/Winlicense 3.XX (DetectItEasy protector)Packing hides code; legitimate installers use it too.
- Entropy
- 7.95 of 8A code section is highly compressed or encrypted.
First scanned
Includes every engine result (76), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Vectorworks.EXE safe, or is it malware?
What is Vectorworks.EXE?
How many antivirus engines detected Vectorworks.EXE?
I already downloaded and ran Vectorworks.EXE — what should I do?
What is the SHA-256 hash of Vectorworks.EXE?
How up to date is this analysis of Vectorworks.EXE?
Community
Member reviews and reports for this exact file hash.