Safe
A small 64-bit Windows driver (viruz.sys) with an invalid signature, flagged malicious by only 2 out of 76 engines including Bkav and McAfee, while top engines like BitDefender and Kaspersky see nothing wrong.
ce5b7aad9b51a3df9b…462f6333a7The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file presents as a 6904-byte Win32 executable disguised as a .sys driver, first seen in early 2025, with PE tags showing it's 64-bit, has an overlay, and an invalid signature. Our antivirus network ran 76 scans: just 2 malicious hits from Bkav's AI generic detection and McAfee's hash-based alert, while tier-1 engines like BitDefender, Kaspersky, ESET, Avast, and others report it undetected. This low detection count (2/76) points to a likely false positive, especially with no consensus on a specific threat family. If run, it might attempt generic malicious behavior due to the detections, but the disagreement suggests it's probably safe. Quarantine or delete it to be cautious.
- 70 out of 76 engines report undetected, including all tier-1 like BitDefender, Kaspersky, ESET.
- No popular threat labels or named families from our analysis.
- No suspicious or PUA detections.
- Small file size consistent with some legit drivers.
- Invalid digital signature on a .sys driver file, which drivers shouldn't have.
- Suspicious name 'viruz.sys' evoking 'virus'.
- Bkav detects it as W64.AIDetectMalware (generic AI-based malware alert).
- McAfeeD flags it via hash (ti!CE5B7AAD9B51), indicating behavioral suspicion.
- PE overlay data, often used to hide malicious payloads.
- Recently first seen (2025), low reputation.
Immediately delete or quarantine viruz.sys and run a full system scan with your antivirus. Avoid running unknown .sys files, as they can load at boot with high privileges.
2 contradictions resolved by the scoring engine
2 detections across 76 engines
Forensic fingerprint
- File name
- viruz.sys
- Size
- 6.7 KB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- ce5b7aad9b51a3df9bbaff5526c1addcb844ed7aeb1fca368d7b41462f6333a7
- MD5
- b69d358dd6971f7969942576e85cdc7f
- SHA-1
- 0b1dd0b32b8056302d7151182e06788cefa89978
- PE imphash
- 153145b9975a097e9b9f0bc04730ffd7
- First seen (VT)
- 1/23/2025, 4:54:47 PM
- Last analysis (VT)
- 4/4/2026, 5:55:10 AM
- First scan (MalwareTips)
- 4/20/2026, 6:37:36 AM
- Last scan (MalwareTips)
- 4/20/2026, 2:30:10 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.