File scan report
Verdict Suspicious
Is Famous Dogg Goal Celebrations Tool v1.
This rarely submitted game-mod archive is flagged by 8 of the 61 antivirus engines that checked it, including two independent major antivirus engines with generic crypter labels…
Read the whole reasonShow less
Why Suspicious? 8 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Treat this mod archive with caution: only use it if it comes from a source you trust, and keep your antivirus enabled while scanning the extracted files.
What to do now5 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or extract it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
It is only 1 day old. If you're unsure, scan it again in a few days; antivirus engines often catch up on new files.
If you already opened or extracted it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
8 of 61 flagged
- Flagged 8
- No detection 53
- No result 14
- Code signing Not applicable
- Test run Completed
- First seen 1d ago
Chapter 02
Why we think so
5 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The archive appears to be a Pro Evolution Soccer 2017 celebration mod tool, first seen on Oct 25, 2026 and submitted by only three sources. Eight of the 61 antivirus engines that checked it flag it, including Ikarus and Avira, but only with generic packer or crypter labels. The combined sandbox verdict was clean, so these signals point both ways.
Eight of the 61 antivirus engines that checked it flag the archive, and two of the votes come from major antivirus engines: Ikarus, and Avira together with F-Secure, which runs Avira's engine. All the labels are generic crypter or packer names, and none of them identifies a real malware family. The combined sandbox verdict was clean, with no high-risk techniques and no injection target. The recorded activity, such as writing the game's settings file and loading Steam-related libraries, fits a game modding tool. Those libraries are often flagged by antivirus engines. Because the file is rare, has no trusted signature or reference-database entry, and no complete host-reputation result is available, the detections cannot be dismissed.
What We Detected
8 of the 61 antivirus engines that checked it flagged this RAR archive. Avira and F-Secure, which share one engine, report a generic crypter label. Ikarus reports 'Trojan.Win32.Crypt'. DeepInstinct, NANO-Antivirus, Varist and two less reliable engines also flag it. No named malware family appears in any label.
Threat Behavior
The combined sandbox verdict was clean. They recorded the extraction of a Pro Evolution Soccer 2017 mod tool, a write to the game's settings file, and the loading of Steam-related libraries. No high-risk techniques, injection targets or persistence were observed. No complete reputation check of contacted hosts is available.
What To Do Now
Only run this tool if you obtained it from the mod author's known distribution page. Keep your antivirus enabled, and scan the extracted files before use. If you have any doubt about the source, delete the archive.
Where this verdict could be wrong2 caveats
- The combined sandbox verdict was clean, and the observed activity matches a game modding tool rather than malware.
- Every engine label is a generic packer or crypter bucket rather than a named family. Steam-emulation libraries in game mods are a frequent false-positive source.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The sandbox runs produced a clean combined verdict, with no high-risk techniques observed.
- No injection into other processes and no persistence were recorded.
- The archive is not listed in public malware sample databases.
- Two independent major antivirus engines flag the archive with crypter-style labels.
- Eight of the 61 antivirus engines that checked it detect it in total.
- It is rarely submitted and was first seen on Oct 25, 2026.
- There is no trusted signature or known-software reference entry to vouch for it.
- The package includes game-emulation libraries of the kind often bundled with unofficial game modifications.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 13sandbox rule tags
- 8spawned processes
- 0network contacts
- 11filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Read the user name of the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
Famous Dogg Goal Celebrations Tool v1.2.rar
d8b2336d624e2ca0df1710940d895462e3842c910d28b218d3163d4f28eaa239
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
FamousDogg_Celebrations_Tool.exe
"C:\Users\<USER>\AppData\Local\Temp\Famous Dogg Goal Celebrations Tool v1.2/FamousDogg_Celebrations_Tool.exe"
Test run - Evidence 3 of 5: ProcessSeen in the test run
rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Famous Dogg Goal Celebrations Tool v1.2/OPTIONAL- USE THIS VERSION OF PES2017/sdkencryptedappticket.dll",#1
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
settings.dat
C:\Users\<USER>\Documents\KONAMI\Pro Evolution Soccer 2017\settings.dat
Test run - Evidence 5 of 5: Written fileSeen in the test run
Settings.exe.log
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Settings.exe.log
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 13 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
8 of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 8
- Avira (major engine)TR/Crypt.ZPACK.Gen
- F-Secure (major engine)Trojan.TR/Crypt.ZPACK.Gen
- Ikarus (major engine)Trojan.Win32.Crypt
- BkavW32.Malware.80781CB2
- CynetMalicious (score: 99)
- DeepInstinctMALICIOUS
- NANO-AntivirusVirus.Win32.Gen.ccmw
- VaristW32/FakeAlert.5!Maximus
File fingerprint
- Last analyzed
- Oct 26, 2026, 8:44 PM UTC
- SHA-256
d8b2336d624e2ca0df1710940d895462e3842c910d28b218d3163d4f28eaa239- SHA-1
87ee85cc68a191f8c33c3c29b68ca2fd4f1ff666- MD5
9f728b9121477889be03fada0472b561
About this file
Famous Dogg Goal Celebrations Tool v1.2.rar is an RAR file of 73.3 MB.
- Type and size
- RAR · 73.3 MB
- Signer
- Not applicable
- First seen
- Oct 25, 2026On VirusTotal.
- Submitted by
- 3 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Famous Dogg Goal Celebrations Tool v1.2.rar safe, or is it malware?
What is Famous Dogg Goal Celebrations Tool v1.2.rar?
How many antivirus engines detected Famous Dogg Goal Celebrations Tool v1.2.rar?
I already downloaded and opened or extracted Famous Dogg Goal Celebrations Tool v1.2.rar — what should I do?
What is the SHA-256 hash of Famous Dogg Goal Celebrations Tool v1.2.rar?
How up to date is this analysis of Famous Dogg Goal Celebrations Tool v1.2.rar?
Community
Member reviews and reports for this exact file hash.
