File scan report
Verdict Malicious
Is malie.
Ten of the 69 antivirus engines that checked it flagged this unsigned executable, two major antivirus engines identified trojan activity, and the completed sandbox run returned a…
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already ran it, follow the steps below.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't run it
Don't run this file. Delete it, then empty the Recycle Bin.
If you already ran it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
If you typed passwords on the device after running it, change them from another device you trust.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
10 of 69 flagged
- Flagged 10
- No detection 59
- No result 6
- Code signing Unsigned
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
5 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Microsoft named the Yomal family, TrendMicro-HouseCall reported a Win32 trojan, and eight additional independent engines also flagged the file. The only completed sandbox run produced a malware/evader finding and mapped possible process injection under T1055, so the file should not be executed.
The detection pattern is substantial: 10 of the 69 antivirus engines that checked it flagged the executable, and all 10 represent independent detections. Microsoft identifies Yomal, while TrendMicro-HouseCall independently reports a generic Win32 trojan, satisfying the requirement that two major detections not be treated as benign. The only completed sandbox run returned a malware/evader finding, with no clean sandbox run creating a split. Evidence from the test run also mapped T1055, although no injection target was recorded, so that technique is supporting rather than conclusive evidence by itself. The unsigned status removes publisher assurance, while the clear contacted-host cache and absent external-intelligence hits are meaningful but insufficient counter-signals.
What We Detected
Ten of the 69 antivirus engines that checked it flagged the executable, representing ten independent detections. Microsoft identified Trojan:Win32/Yomal!rfn, while TrendMicro-HouseCall reported Trojan.Win32.Gen.TL0101FJ26ZG. Other engines described generic trojan, dropper, or malware characteristics. The file is unsigned and therefore has no verified publisher identity.
Threat Behavior
The only completed sandbox run returned a malware/evader finding, and no clean run contradicted it. Runtime mapping included T1055, which supports possible process injection, but no target process or exact injection method was captured. The host-reputation check covered the three listed contacts and found no cached malicious or suspicious hosts; however, this does not outweigh the engine and sandbox findings. Three dropped files were observed, but no saved verdict is available for any of them.
What To Do Now
Do not run the file. Keep security software enabled, quarantine or remove the sample, and scan the system if it was already executed. If execution occurred, review recent processes, scheduled tasks, and other persistence locations, and consider resetting sensitive credentials from a separate trusted device if unexplained activity is found.
Where this verdict could be wrong4 caveats
- Most engines did not flag the file, including 14 reporting major antivirus engines.
- The three fully inspected contacted hosts had no cached malicious or suspicious reputation.
- No malware-specific YARAify rules or MalwareBazaar record corroborated the detections.
- The three dropped files have no saved verdicts, so they neither confirm nor refute harmful activity.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Most antivirus engines did not flag the file, including 14 reporting major antivirus engines.
- The fully covered host-reputation check found no cached malicious or suspicious contacts.
- No malware-specific researcher rules or known sample record corroborated the file.
- No inspected file it created has a saved harmful verdict.
- Ten independent antivirus detections include two major antivirus engines.
- Microsoft identifies the Yomal trojan family.
- The completed sandbox run reported malware and evasion behavior.
- The test run mapped possible process injection under T1055.
- The Windows executable is unsigned and lacks publisher history.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; 1 test environment rated what it did as risky.
Test run summary
Capture complete- 19sandbox rule tags
- 2spawned processes
- 1network contact
- 37filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Checked whether it was running on a test computer.
Note: Listed the programs running on the test computer.
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 6: FileSeen in the test run
malie.exe
c994cc734c0c1a926e8ac1c2167903b160d21c17c64b29b1625b84e83c11c52e
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 6: ProcessSeen in the test run
software.exe
"C:\Users\<USER>\Desktop\software.exe"
Test run - Evidence 3 of 6: ProcessSeen in the test run
malie.exe
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 6: Written fileSeen in the test run
Microsoft-Windows-DiskDiagnosticDataCollector
C:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector
Test run - Evidence 5 of 6: Written fileSeen in the test run
Microsoft Compatibility Appraiser
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser
Test run - +1 more recorded observation
- 1
Network
Hosts contacted
- Evidence 6 of 6: Contacted hostSeen in the test run
13.107.4.52
Contacted during the test run.
Test run
6 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 19 mapped techniques, every process, file, registry and network entry and 3 dropped files.
Show the technical evidenceChapter 04
Technical details
10 of the 69 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 10
- Microsoft (major engine)Trojan:Win32/Yomal!rfn
- TrellixENS (major engine)Artemis!B9C926B8FAA4
- TrendMicro-HouseCall (major engine)Trojan.Win32.Gen.TL0101FJ26ZG
- DeepInstinctMALICIOUS
- GridinsoftTrojan.Heur!.03A520A1
- Paloaltogeneric.ml
- SentinelOneStatic AI - Suspicious PE
- SkyhighBehavesLike.Win32.Dropper.tc
File fingerprint
- Last analyzed
- Oct 10, 2026, 7:11 PM UTC
- SHA-256
c994cc734c0c1a926e8ac1c2167903b160d21c17c64b29b1625b84e83c11c52e- SHA-1
df5009551c2257e617e5cc2af3d44091811d0c24- MD5
b9c926b8faa4af480c1b9638e6cbdf72
About this file
malie.exe is a Win32 EXE file of 5.3 MB.
- Type and size
- Win32 EXE · 5.3 MB
- Signer
- UnsignedNo code signature.
- First seen
- Nov 30, 2022On VirusTotal.
- Submitted by
- 9 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- Possibly packedPacking hides code; legitimate installers use it too.
- Entropy
- 7.81 of 8A code section is highly compressed or encrypted.
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is malie.exe a virus?
What is malie.exe?
How many antivirus engines detected malie.exe?
What should I do if I already ran malie.exe?
How do I remove malie.exe?
What kind of malware is malie.exe?
What is the SHA-256 hash of malie.exe?
How up to date is this analysis of malie.exe?
Community
Member reviews and reports for this exact file hash.