File scan report
Verdict Safe
Is Clam
None of the 70 antivirus engines that checked it flagged this small Visual C++ program, the sandbox runs came back clean, and it has been publicly circulating since June 2021.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Nothing in this file calls for action beyond normal caution: keep it only if you know where it came from, and leave your antivirus and other protection enabled. If you did not expect the file, delete it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
1 point against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No engine detected anything in this 52 KB executable, and the combined sandbox result was clean with no injection, no dropped files and no unusual techniques. It has been submitted by 100 different sources since it first appeared on Jun 7, 2021, and the only network contacts recorded were ordinary Microsoft data addressed by the analysis machine itself. Nothing hostile appears in the file.
The antivirus results are uniformly quiet: none of the 70 antivirus engines that checked it flagged this executable, and the 17 major antivirus engines that produced a result all cleared it, with no family consensus and no single-engine outlier to interpret. The runtime picture matches the static one — the sandbox runs finished with a clean combined verdict, no processes were injected into, no files were written and no techniques rare in legitimate software were recorded, while the handful of ordinary techniques observed are the same ones ordinary Windows programs show. The network side is similarly uneventful: every host reputation lookup that was completed came back clean, and the domains and addresses recorded are Microsoft devices that the analysis environment itself contacts. Structural analysis shows low entropy across all sections, no packer and no signer, which is typical of a small plain compiler build rather than something obfuscated. A file submitted by 100 distinct sources over more than four years without a single detection or hostile behaviour is consistent with an ordinary utility rather than malware.
What We Detected
This is a small 32-bit Windows executable of roughly 52 KB, built with Microsoft Visual C++. None of the 70 antivirus engines that checked it in our network flagged it, including every major antivirus engine that returned a result. Its sections have low entropy, there is no packer and no obfuscation layer, and the resource section holds the bulk of the file's content.
Threat Behavior
The sandbox runs produced a clean combined verdict. No processes were injected into, no files were dropped, no persistence mechanisms were registered, and no techniques rare in legitimate software were recorded. What was logged is ordinary: a few registry keys used by Windows performance and backup components, which ordinary installers and system utilities touch routinely. The only network contacts recorded were Microsoft devices that the analysis environment itself reaches out to, and every host reputation lookup that completed came back without a malicious or suspicious finding.
Reputation and History
The file first appeared on Jun 7, 2021, and has since been submitted 142 times by 100 distinct sources. It appears in no public malware sample database and no malware-specific detection rule matched it.
What To Do Now
Nothing about this file indicates harm. Keep it only if you intended to obtain it and you know its origin; if you did not expect it, deleting it is always reasonable. Keep your antivirus protection and other security software enabled — it does not need to be turned off for this file.
Where this verdict could be wrong2 caveats
- The file carries no digital signature, so its origin cannot be confirmed from the binary itself; the clean result rests on engine agreement, sandbox runs and its long submission history.
- No similarity comparison with previously reviewed files was available for this hash, so there is no historical verdict trail to reinforce the result.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it flagged it, with 17 major antivirus engines reporting clean.
- The sandbox runs completed with a clean combined verdict — no injection, no dropped files and no persistence.
- It has been submitted by 100 different sources since it first appeared on Jun 7, 2021, without any hostile finding.
- Host reputation lookups found no known-malicious or suspicious contacts, and the recorded contacts are Microsoft devices.
- The file is not packed and shows no obfuscation, consistent with an ordinary small compiled utility.
- The file is not digitally signed, so its author and origin cannot be confirmed from the binary itself.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 7 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 7isolated sandbox runs
- 4sandbox rule tags
- 2spawned processes
- 3network contacts
- 15filesystem & mutex artifacts
Includes the sandbox verdicts, 4 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 7, 2026, 4:27 PM UTC
- SHA-256
cf3f26cd319dc1e58eee91c752c02a737849fa6d28dd11f7c297ac72152ece8d- SHA-1
a41141828364387a9fd95421fd7f76f27de486c0- MD5
191551178d0f362f463ffd3c4462afaf
About this file
ClamWin.exe says it is ClamWin Antivirus, 53.2 kB.
- Claims to be
- ClamWin AntivirusFrom the file's own version information, written by whoever built it.
- Original name
- ClamWin.exeMatches the shared file name.
- Type and size
- Win32 EXE · 53.2 kB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 7, 2021On VirusTotal.
- Submitted by
- 100 distinct sources
- Packer
- None detected
- Entropy
- 5.08 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ClamWin.exe safe?
What is ClamWin.exe?
How many antivirus engines detected ClamWin.exe?
What is the SHA-256 hash of ClamWin.exe?
Is it safe to run ClamWin.exe?
How up to date is this analysis of ClamWin.exe?
Community
Member reviews and reports for this exact file hash.