File scan report
Verdict Malicious
Is Informaal
Twenty-one of the 67 antivirus engines that checked it flagged this rarely submitted ZIP, including four major antivirus engines, with labels spanning trojan, downloader, and…
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already opened or extracted it, follow the steps below.
What to do now3 steps
This ZIP archive is harmful. Don't open or extract it, and delete it.
If you haven't opened or extracted it
Don't open or extract this archive. Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash.
If you already opened or extracted it
If you already extracted it, delete the extracted files too and run a full antivirus scan.
If a page it opened asked for a password or card details and you entered them, change that password and call your bank.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
21 of 67 flagged
- Flagged 21
- No detection 46
- No result 8
- Code signing Not applicable
- Test run Not run
- First seen Today
Chapter 02
Why we think so
5 points against it and 2 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The archive drew 21 detections among 75 engines, including four major antivirus engines and 18 independently counted detections. Although the labels do not agree on a specific family, their volume and quality, combined with the archive's extremely limited history, make execution or extraction unsafe.
Twenty-one of the 67 antivirus engines that checked it flagged the archive, and those results represent 18 independently counted detections. Four major antivirus engines raised alerts, with Ikarus identifying downloader behavior and Avast and Avira applying trojan labels. Other engines described a potentially unwanted game tool, so the evidence does not establish one specific malware family. The archive was first seen on Nov 1, 2026 and was submitted by only one source, providing no mature distribution history to offset the alerts. No completed observation from the test run or inspection of the archive's contents is available, but the antivirus evidence is already strong enough to warrant blocking it.
What We Detected
Twenty-one of the 67 antivirus engines that checked it flagged this ZIP archive. The detections represent 18 independently counted results, including alerts from four major antivirus engines. Ikarus identified a downloader-style Agent trojan, Avast and Avira reported Evo-style trojan labels, while ESET-NOD32 and Malwarebytes described potentially unsafe or unwanted game-tool software.
Threat Behavior
No completed observation from the test run is available, so there is no direct record of what the archive would do when extracted or launched. Our static analysis was also unavailable because the bytes were not uploaded for inspection. The archive contains Windows executable material according to the antivirus metadata, but the conflicting generic labels do not support assigning a specific malware family.
What To Do Now
Do not extract or run the archive on a normal system. Keep security software enabled, quarantine or remove the file, and obtain the software only from a verified official release channel if it is required.
Where this verdict could be wrong3 caveats
- Several engines, including BitDefender, Fortinet, DrWeb, and GData, did not flag the archive.
- Some detections describe a potentially unwanted game tool rather than unequivocal malware, and no runtime or static inspection is available to resolve that disagreement.
- MalwareBazaar, CIRCL, and YARAify returned no matching intelligence, although absence from those databases does not establish safety.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Several major antivirus engines, including BitDefender, Fortinet, DrWeb, and GData, did not flag the archive.
- No matching entry was found in the checked public sample databases or community malware-rule collection.
- Twenty-one of the 67 antivirus engines that checked it raised alerts, including four major antivirus engines.
- The alerts represent 18 independently counted detections rather than repeated branding of only one scanning engine.
- Several engines applied trojan or downloader labels.
- The archive was first seen on Nov 1, 2026 and has only one known submitting source.
- No completed observation from the test run or inspection of the archive's contents is available.
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
No completed test run is saved for this file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Chapter 04
Technical details
21 of the 67 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 21
- Avast (major engine)Win64:Evo-gen [Trj]
- AVG (major engine)Win64:Evo-gen [Trj]
- Avira (major engine)TR/W64.Evo
- ESET-NOD32 (major engine)Win64/Agent.N potentially unsafe application
- F-Secure (major engine)Trojan.TR/W64.Evo
- Ikarus (major engine)Trojan-Downloader.Win64.Agent
- AhnLab-V3Trojan/Win.Generic.R800095
- Antiy-AVLGrayWare/Win32.Wacapew
File fingerprint
- Last analyzed
- Nov 1, 2026, 9:19 PM UTC
- SHA-256
d1cf82fe3a30abdbd3f8d0a0ce94386d4a49216c106b622e20044097ed81e610- SHA-1
6d6d6342829a3173a264d68f14ef5288d80edf7f- MD5
91a59d432d796501f3d683160c0ff5a3
About this file
InformaalFrog_Adventures_v0.14.36_yonathan.zip is a ZIP file of 28.2 MB.
- Type and size
- ZIP · 28.2 MB
- Signer
- Not applicable
- First seen
- Nov 1, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is InformaalFrog_Adventures_v0.14.36_yonathan.zip malware?
What is InformaalFrog_Adventures_v0.14.36_yonathan.zip?
How many antivirus engines detected InformaalFrog_Adventures_v0.14.36_yonathan.zip?
I already downloaded and opened or extracted InformaalFrog_Adventures_v0.14.36_yonathan.zip — what should I do?
How do I remove InformaalFrog_Adventures_v0.14.36_yonathan.zip?
What kind of malware is InformaalFrog_Adventures_v0.14.36_yonathan.zip?
What is the SHA-256 hash of InformaalFrog_Adventures_v0.14.36_yonathan.zip?
How up to date is this analysis of InformaalFrog_Adventures_v0.14.36_yonathan.zip?
Community
Member reviews and reports for this exact file hash.