File scan report
Verdict Suspicious
Is Ai
Six of the 72 antivirus engines that checked it flagged this unsigned executable, but no major antivirus engines detected it and the conflicting labels lack behavioral or family…
Read the whole reasonShow less
Why Suspicious? 6 antivirus engines flag it, but no major engine agrees; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
6 of 72 flagged
- Flagged 6
- No detection 66
- No result 4
- Code signing Unsigned
- Test run Not run
- First seen 6mo ago
Community members disagree: 2 say this is a false positive. MalwareTips staff have not confirmed this. Read their report
Chapter 02
Why we think so
3 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Six of the 72 antivirus engines that checked it raised alerts, including two file-coder labels, but none of the major antivirus engines detected the executable and the reported families conflict. Because it is unsigned and no runtime or static inspection is available to resolve those signals, avoid running it until its origin can be verified.
The antivirus results are mixed: 6 of the 72 antivirus engines that checked it flagged the executable, while all 18 reporting major antivirus engines remained silent. Huorong and Rising used file-coder labels, but Kingsoft identified a mining worm and Alibaba Cloud named a different trojan, so there is no coherent family attribution. The executable is unsigned, leaving no publisher identity to support its security-themed name. No completed observation from the test run or first-party static inspection is available, and no malware-specific community rule or public sample-database entry corroborates the alerts. These facts support caution without establishing that the file performs ransomware or other malware activity.
What We Detected
Six of the 72 antivirus engines that checked it flagged the executable. Huorong and Rising used file-coder labels, Kingsoft reported WannaMine, and Alibaba Cloud reported Lakaboy; the disagreement prevents a reliable family identification. None of the 18 major antivirus engines that supplied results raised an alert.
Threat Behavior
No completed observation from the test run is available, so file encryption, propagation, mining, or other harmful behavior was not observed. Our static analysis was also unavailable, meaning the code was not independently inspected for ransomware logic or other decisive patterns. A complete contacted-host reputation result is not available.
What To Do Now
Do not run the executable unless it came from a source you can independently verify. Keep security software enabled, obtain a fresh copy from the software publisher's official channel, and compare its cryptographic hash or valid digital signature before use.
Where this verdict could be wrong2 caveats
- All 18 major antivirus engines that reported results were clean, including Avast, BitDefender, ESET-NOD32, Fortinet, and Kaspersky.
- Four of the six detections came from less reliable engines, and the remaining two smaller labels disagree about whether the file resembles ransomware or a mining worm.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 18 reporting major antivirus engines raised an alert.
- The detection labels disagree substantially and do not establish one malware family.
- No malware-specific community rules or public sample-database listing corroborated the alerts.
- Six antivirus engines raised alerts, including two that used file-coder labels.
- The executable is unsigned, so its publisher cannot be verified.
- No completed observation from the test run or first-party static inspection is available to resolve the conflicting detections.
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
6 of the 72 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 6
- alibabacloudTrojan:Win/Lakaboy.LY
- APEXMalicious
- huorongRansom/Filecoder.c
- KingsoftWin32.Worm.WannaMine.i
- Paloaltogeneric.ml
- RisingRansom.Filecoder!8.1BA3F (CLOUD)
File fingerprint
- Last analyzed
- Apr 22, 2026, 7:47 PM UTC
- SHA-256
d6a0a37ba8d07bbca3606c1ef06dea7f7b49b88c51f46bccfd7d33f3295f916b- SHA-1
f1594b9a646b7b7b4af1f3cfac6e87d92627a4ac- MD5
995a85d89832468412be2def7ea21951
About this file
AiDefend.exe is a Win32 EXE file of 4.6 MB.
- Type and size
- Win32 EXE · 4.6 MB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 31, 2026On VirusTotal.
First scanned Updated
Verdict history
- Malicious
- Suspiciousafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Includes every engine result (76).
Show the technical evidenceChapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is AiDefend.exe safe, or is it malware?
What is AiDefend.exe?
How many antivirus engines detected AiDefend.exe?
What should I do if I already ran AiDefend.exe?
What is the SHA-256 hash of AiDefend.exe?
How up to date is this analysis of AiDefend.exe?
Community
Member reviews and reports for this exact file hash.
