File scan report
Verdict Suspicious
Is Famous Dogg Goal Celebrations Tool v1.
This rarely submitted game-mod archive is flagged by 8 of the 61 antivirus engines that checked it, including two independent major antivirus engines with generic crypter labels…
Read the whole reasonShow less
Why Suspicious? 8 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Treat this mod archive with caution: only use it if it comes from a source you trust, and keep your antivirus enabled while scanning the extracted files.
What to do now5 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or extract it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
It is only 2 days old. If you're unsure, scan it again in a few days; antivirus engines often catch up on new files.
If you already opened or extracted it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
8 of 61 flagged
- Flagged 8
- No detection 53
- No result 14
- Code signing Not applicable
- Test run Completed
- First seen 2d ago
Chapter 02
Why we think so
5 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The archive appears to be a Pro Evolution Soccer 2017 celebration mod tool, first seen on Oct 25, 2026 and submitted by only three sources. Eight of the 61 antivirus engines that checked it flag it, including Ikarus and Avira, but only with generic packer or crypter labels. The combined sandbox verdict was clean, so these signals point both ways.
Eight of the 61 antivirus engines that checked it flag the archive, and two of the votes come from major antivirus engines: Ikarus, and Avira together with F-Secure, which runs Avira's engine. All the labels are generic crypter or packer names, and none of them identifies a real malware family. The combined sandbox verdict was clean, with no high-risk techniques and no injection target. The recorded activity, such as writing the game's settings file and loading Steam-related libraries, fits a game modding tool. Those libraries are often flagged by antivirus engines. Because the file is rare, has no trusted signature or reference-database entry, and no complete host-reputation result is available, the detections cannot be dismissed.
What We Detected
8 of the 61 antivirus engines that checked it flagged this RAR archive. Avira and F-Secure, which share one engine, report a generic crypter label. Ikarus reports 'Trojan.Win32.Crypt'. DeepInstinct, NANO-Antivirus, Varist and two less reliable engines also flag it. No named malware family appears in any label.
Threat Behavior
The combined sandbox verdict was clean. They recorded the extraction of a Pro Evolution Soccer 2017 mod tool, a write to the game's settings file, and the loading of Steam-related libraries. No high-risk techniques, injection targets or persistence were observed. No complete reputation check of contacted hosts is available.
What To Do Now
Only run this tool if you obtained it from the mod author's known distribution page. Keep your antivirus enabled, and scan the extracted files before use. If you have any doubt about the source, delete the archive.
Where this verdict could be wrong2 caveats
- The combined sandbox verdict was clean, and the observed activity matches a game modding tool rather than malware.
- Every engine label is a generic packer or crypter bucket rather than a named family. Steam-emulation libraries in game mods are a frequent false-positive source.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The sandbox runs produced a clean combined verdict, with no high-risk techniques observed.
- No injection into other processes and no persistence were recorded.
- The archive is not listed in public malware sample databases.
- Two independent major antivirus engines flag the archive with crypter-style labels.
- Eight of the 61 antivirus engines that checked it detect it in total.
- It is rarely submitted and was first seen on Oct 25, 2026.
- There is no trusted signature or known-software reference entry to vouch for it.
- The package includes game-emulation libraries of the kind often bundled with unofficial game modifications.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 13sandbox rule tags
- 8spawned processes
- 0network contacts
- 11filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Read the user name of the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
Famous Dogg Goal Celebrations Tool v1.2.rar
d8b2336d624e2ca0df1710940d895462e3842c910d28b218d3163d4f28eaa239
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
FamousDogg_Celebrations_Tool.exe
"C:\Users\<USER>\AppData\Local\Temp\Famous Dogg Goal Celebrations Tool v1.2/FamousDogg_Celebrations_Tool.exe"
Test run - Evidence 3 of 5: ProcessSeen in the test run
rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Famous Dogg Goal Celebrations Tool v1.2/OPTIONAL- USE THIS VERSION OF PES2017/sdkencryptedappticket.dll",#1
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
settings.dat
C:\Users\<USER>\Documents\KONAMI\Pro Evolution Soccer 2017\settings.dat
Test run - Evidence 5 of 5: Written fileSeen in the test run
Settings.exe.log
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Settings.exe.log
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
13MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1106
- T1129· Loads modules
- T1497· Sandbox evasion
- T1562· Disables security
- T1562.001· Disables security
- T1564· Hides artifacts
- T1574· Execution hijack
Observed activity
Processes started
8Programs the file ran, with their command lines.
FamousDogg_Celebrations_Tool.exe"C:\Users\<USER>\AppData\Local\Temp\Famous Dogg Goal Celebrations Tool v1.2/FamousDogg_Celebrations_Tool.exe"rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Famous Dogg Goal Celebrations Tool v1.2/OPTIONAL- USE THIS VERSION OF PES2017/sdkencryptedappticket.dll",#1Settings.exe"C:\Users\<USER>\AppData\Local\Temp\Famous Dogg Goal Celebrations Tool v1.2/OPTIONAL- USE THIS VERSION OF PES2017/Settings.exe"rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Famous Dogg Goal Celebrations Tool v1.2/OPTIONAL- USE THIS VERSION OF PES2017/Settings_b.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Famous Dogg Goal Celebrations Tool v1.2/OPTIONAL- USE THIS VERSION OF PES2017/steamclient.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Famous Dogg Goal Celebrations Tool v1.2/OPTIONAL- USE THIS VERSION OF PES2017/steam_api.dll",#1
Show all 8 entries for processes started
unarchiver.exe"C:\Windows\System32\unarchiver.exe" "C:\Users\user\Desktop\Famous Dogg Goal Celebrations Tool v1.2.rar"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\xv1kcxcb.ks0" "C:\Users\user\Desktop\Famous Dogg Goal Celebrations Tool v1.2.rar"
Files
8Files the file created, changed or deleted.
- Written
C:\Users\<USER>\Documents\KONAMI\Pro Evolution Soccer 2017\settings.dat - Written
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Settings.exe.log - Written
C:\Users\user\AppData\Local\Temp\unarchiver.log - Written
C:\Users\user\AppData\Local\Temp\xv1kcxcb.ks0 - Written
C:\Users\user\AppData\Local\Temp\xv1kcxcb.ks0\Famous Dogg Goal Celebrations Tool v1.2 - Written
C:\Users\user\AppData\Local\Temp\xv1kcxcb.ks0\Famous Dogg Goal Celebrations Tool v1.2\FamousDogg_celebrationsByRP.cpk
Show all 8 entries for files
- Written
\Device\ConDrv\\Connect - Written
stdout
Registry and auto-start
14Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\AutoLogger\Circular Kernel Context Logger\Status - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\WinRAR\FileList\FileColumnWidths\mtime - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\WinRAR\FileList\FileColumnWidths\name - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\WinRAR\FileList\FileColumnWidths\size - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\WinRAR\FileList\FileColumnWidths\type
Show all 14 entries for registry and auto-start
- Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\WinRAR\Interface\Themes\ShellExtBMP - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\WinRAR\Interface\Themes\ShellExtIcon - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\SETTINGS.EXE587F1040000F4E20\Name - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\SETTINGS.EXE587F1040000F4E20\UsesMapper - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication\Name - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication\Id - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication\Version - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication\MostRecentStart
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
Pro Evolution Soccer 2017DirectInput.{89521361-AA8A-11CF-BFC7-444553540000}DirectInput.{5944E682-C92E-11CF-BFC7-444553540000}
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 933e1778b2760b3a9194…6ad3b5Not checkedno saved verdict
- 32741d4b5c0a3f4536ea…d81b40Not checkedno saved verdict
- 6939116c94596fecbb22…fd9357Not checkedno saved verdict
- 34cf5057110d3c30f7a5…a5bad1Not checkedno saved verdict
- f9dab190079357b550d9…e0661eNot checkedno saved verdict
- 2d6d733d5b1da1b442fa…83dbb8Not checkedno saved verdict
- 70e5b5ca2a56c31cc165…8b16a4Not checkedno saved verdict
- 687182c84787409ed341…ecbd7dNot checkedno saved verdict
- ac6e8331d48bd2424459…041689Not checkedno saved verdict
- a4a58877381d2a4063ba…96f684Not checkedno saved verdict
Chapter 04
Technical details
8 of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 8
- Avira (major engine)TR/Crypt.ZPACK.Gen
- F-Secure (major engine)Trojan.TR/Crypt.ZPACK.Gen
- Ikarus (major engine)Trojan.Win32.Crypt
- BkavW32.Malware.80781CB2
- CynetMalicious (score: 99)
- DeepInstinctMALICIOUS
- NANO-AntivirusVirus.Win32.Gen.ccmw
- VaristW32/FakeAlert.5!Maximus
File fingerprint
- Last analyzed
- Oct 26, 2026, 8:44 PM UTC
- SHA-256
d8b2336d624e2ca0df1710940d895462e3842c910d28b218d3163d4f28eaa239- SHA-1
87ee85cc68a191f8c33c3c29b68ca2fd4f1ff666- MD5
9f728b9121477889be03fada0472b561
About this file
Famous Dogg Goal Celebrations Tool v1.2.rar is an RAR file of 73.3 MB.
- Type and size
- RAR · 73.3 MB
- Signer
- Not applicable
- First seen
- Oct 25, 2026On VirusTotal.
- Submitted by
- 3 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
8 of 61 engines flagged this file
14 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 8 detections come from 7 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-118 engines2flagged3 vendors sharing 2 engines
- Tier-231 engines3flagged
- Low-trust12 engines2flagged
View all 75 engine results
- AviraMalicious: TR/Crypt.ZPACK.Gen
- BkavMalicious: W32.Malware.80781CB2
- CynetMalicious: Malicious (score: 99)
- DeepInstinctMalicious: MALICIOUS
- F-SecureMalicious: Trojan.TR/Crypt.ZPACK.Gen
- IkarusMalicious: Trojan.Win32.Crypt
- NANO-AntivirusMalicious: Virus.Win32.Gen.ccmw
- VaristMalicious: W32/FakeAlert.5!Maximus
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXNo result
- CylanceNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Barely seen in the wild and first surfaced recently. 8 antivirus detections make that low prevalence materially relevant, but rarity alone is not proof of malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Famous Dogg Goal Celebrations Tool v1.2.rar safe, or is it malware?
What is Famous Dogg Goal Celebrations Tool v1.2.rar?
How many antivirus engines detected Famous Dogg Goal Celebrations Tool v1.2.rar?
I already downloaded and opened or extracted Famous Dogg Goal Celebrations Tool v1.2.rar — what should I do?
What is the SHA-256 hash of Famous Dogg Goal Celebrations Tool v1.2.rar?
How up to date is this analysis of Famous Dogg Goal Celebrations Tool v1.2.rar?
Community
Member reviews and reports for this exact file hash.
