File scan report
Verdict Safe
Is digdug.
This small ZIP archive from 2013 drew no detections from any of the 74 engines, and one completed sandbox run recorded no malicious activity, no network contacts and no dropped…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
No action is required on the basis of this scan, but since the archive contents were not opened here, extract it only if you trust its source and let your security software scan the extracted files before running anything. Keep your protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 13y ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 65 antivirus engines that checked it flagged this archive, and all 18 of the highest-reliability engines that analysed it returned a clean result. A completed sandbox run showed no hostile behaviour, no outbound connections and no dropped files, and the public malware databases hold no entry for it. The archive's contents were not opened by our own tooling, so extracting it with current protection enabled remains the sensible habit.
The file is a 28 KB ZIP archive first seen on May 27, 2013 and submitted 53 times by 14 distinct sources, which points to an old, widely circulated package rather than something freshly seeded. Not one of the 65 antivirus engines that checked it returned a detection, and the 18 highest-reliability engines all cleared it. One completed sandbox run recorded no high-risk techniques, no injected processes, no outbound domains or URLs, no files written and no persistence indicators; the only registry values it touched were Internet Explorer extension counters in the user's own hive. There is no MalwareBazaar listing, no community YARA rule match and no known-good reference entry either way. Our own tooling never received the bytes, so the archive contents were not inspected, and a host-reputation cross-check for the run was not completed — both are gaps in coverage rather than findings. On the available evidence there is no hostile signal to act on.
What We Detected
This is a small ZIP archive, roughly 28 KB, first seen on May 27, 2013 and submitted 53 times by 14 distinct sources. Every engine that analysed it returned a clean result: zero detections out of 74, with the 18 highest-reliability engines among those that cleared it. No external reference database, including the public malware-sample databases and community rule sets, holds an entry for this hash.
Threat Behavior
A completed sandbox run produced no high-risk technique mappings, no injected processes, no outbound domains, IP addresses or URLs, no written or dropped files, and no persistence indicators. The only writes recorded were four Internet Explorer extension-counter values inside the test account's own registry hive, which is ordinary browser bookkeeping rather than an install routine. The archive is unsigned, but code signing does not apply to a ZIP container.
What Was Not Checked
The bytes were never sent to our own inspection service, so the files inside the archive were not catalogued, and the host-reputation cross-check for the run was not completed. Neither gap is a finding against the file — they simply mean the clean result describes the container rather than its contents.
What To Do Now
Nothing in this scan calls for alarm, and no action is urgent. Because archive contents were not opened here, extract it only if you know where it came from and let your security software scan the extracted files first. Keep your protection enabled and avoid running anything from an archive you cannot account for.
Where this verdict could be wrong2 caveats
- The archive contents were never opened for inspection by our own tooling and no host-reputation cross-check was completed, so a clean engine result rests on the antivirus network's view of the container rather than on what is inside it.
- A 28 KB archive from 2013 could carry a payload that older engine signatures no longer weight heavily, although nothing in this scan's runtime or reference-database results supports that possibility.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero detections out of 74 engines, including a clean result from all 18 of the highest-reliability engines that analysed it.
- The sandbox run recorded no high-risk techniques, no injected processes, no network contacts and no files dropped.
- No listing in any public malware-sample database and no match against malware-specific community rules.
- First seen in 2013 and circulated across 14 distinct submitters without ever acquiring a detection.
- The archive's contents were never opened for inspection by our own tooling, so its payload files were not catalogued.
- A host-reputation cross-check for the sandbox run was not completed, so outbound contact coverage is incomplete rather than confirmed clean.
- The archive carries no digital signature and no publisher identity to trace.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 1 isolated test; no test environment rated what it did as risky.
Test run summary
Capture complete- 1isolated sandbox run
- 0spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
Includes every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 6, 2026, 11:24 PM UTC
- SHA-256
c9a12fa0a8b19b33a3c826ef368f2a9f808fa6fea2cfda7880025ffb242b6dbc- SHA-1
d9df25bc4e6e50078ab2e027c1191286d5c791f0- MD5
2ec55c0c819930098aae3fd7295d3b43
About this file
digdug.zip is a ZIP file of 28.5 kB.
- Type and size
- ZIP · 28.5 kB
- Signer
- Not applicable
- First seen
- May 27, 2013On VirusTotal.
- Submitted by
- 14 distinct sources
First scanned
Includes every engine result (74) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is digdug.zip safe?
What is digdug.zip?
How many antivirus engines detected digdug.zip?
What is the SHA-256 hash of digdug.zip?
Is it safe to open or extract digdug.zip?
How up to date is this analysis of digdug.zip?
Community
Member reviews and reports for this exact file hash.