File scan report
Verdict Safe
Is DO NOT OPEN.
Two of the 58 antivirus engines that checked it applied archive-bomb labels, but broad longstanding prevalence, major antivirus engine silence, and unremarkable sandbox results…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 58 flagged
- Flagged 2
- No detection 56
- No result 17
- Code signing Not applicable
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 2 of the 58 antivirus engines that checked it flagged this ZIP, and none of the major antivirus engines did. It has been submitted by 128 distinct sources since Nov 28, 2024, while the sandbox runs recorded no high-risk techniques, malicious verdict, persistence, injection target, or sample network contact.
ZoneAlarm and VBA32 applied archive-bomb labels, accounting for 2 of 75 engine detections. None of the major antivirus engines flagged the sample, and no shared malware family was established. The file has longstanding, broad prevalence, with 128 distinct sources and 142 submissions since it was first seen on Nov 28, 2024. The sandbox runs produced no malicious verdict and recorded no high-risk technique, persistence, named injection target, or sample network contact. No malware-specific community rules or public malware-database entry corroborated the detections, although the archive contents were not examined by our static analysis.
What We Detected
Two of the 58 antivirus engines that checked it flagged the ZIP: ZoneAlarm used an archive-bomb label, while VBA32 used an archive mail-bomb label. None of the major antivirus engines flagged it, and the engines did not establish a recognized malware-family consensus.
Threat Behavior
The sandbox runs recorded no malicious verdict, high-risk technique, persistence mechanism, named injection target, file it created, or sample network contact. The activity that was recorded was consistent with opening or listing an archive and running the associated script handler. Our static analysis did not examine the archive contents, so the archive-bomb claims could not be directly verified from the bytes.
What To Do Now
The overall evidence favors false detections, supported by 128 distinct submitters and history dating to Nov 28, 2024. Keep security software enabled and extract unfamiliar archives only in a controlled environment; rescan any extracted files separately before opening them.
Where this verdict could be wrong3 caveats
- ZoneAlarm and VBA32 independently applied archive-bomb or mail-bomb labels, so a deliberately resource-intensive archive remains a plausible alternative explanation.
- The archive contents were not examined by our static analysis, so the two detections cannot be directly disproved from the bytes.
- No complete reputation check was available for contacted hosts, although the sandbox runs recorded no sample contacts to assess.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the major antivirus engines flagged the sample.
- The file has been submitted by 128 distinct sources and was first seen on Nov 28, 2024.
- The sandbox runs recorded no malicious verdict, high-risk technique, persistence, injection target, or sample network contact.
- No malware-specific community rule or public malware-database entry matched the hash.
- Two independent engines labeled the ZIP as an archive bomb or mail bomb.
- The archive contents were not examined by our static analysis, leaving the archive-bomb claim unverified.
- The displayed script-style name does not match the detected ZIP format, which warrants care when handling the file.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 6sandbox rule tags
- 6spawned processes
- 0network contacts
- 1filesystem & mutex artifacts
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
6MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1033· Reads user info
- T1071· Application protocol
- T1082· System recon
- T1518.001· Checks your AV
- T1564.001· Hides artifacts
- T1574· Execution hijack
Observed activity
Processes started
6Programs the file ran, with their command lines.
wscript.exe"C:\Windows\system32\wscript.exe" "C:\Users\<USER>\Desktop\DO NOT OPEN.vbs"exo-open/usr/bin/exo-open exo-open /tmp/sample.zipexo-open/usr/bin/exo-open -engrampa/usr/bin/engrampa engrampa /tmp/sample.zip7z/usr/lib/p7zip/7z l -slt -bd -y -- /tmp/sample.zippython3.8/usr/bin/python3.8 -
Files
1Files the file created, changed or deleted.
- Written
/root/.cache/dconf/user
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
dbus-launch/usr/bin/dbus-launch dbus-launch --autolaunch=a39eb3ed78b7401fb6809ed0c562a5b1 --binary-syntax --close-stderr
Chapter 04
Technical details
2 of the 58 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The Safe verdict weighed these detections and treats them as non-decisive.
- VBA32suspected of Archive.MailBomb
- ZoneAlarmTroj/ArchBomb
File fingerprint
- Last analyzed
- Oct 26, 2026, 5:58 AM UTC
- SHA-256
dbbfc2e4ff312cc2a699fb34a980e9efebd9bb8b768a221e6582953315211436- SHA-1
3d9ab0b3b673a689fbe37e2ed1e03ecf2c76b79d- MD5
91608a46012480a4a3ed8a50dc2e3bb2
About this file
DO NOT OPEN.vbs is a ZIP file of 257.0 kB.
- Type and size
- ZIP · 257.0 kB
- Signer
- Not applicable
- First seen
- Nov 28, 2024On VirusTotal.
- Submitted by
- 128 distinct sources
First scanned
Antivirus consensus
2 of 58 engines flagged this file
17 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-229 engines1flagged
- Low-trust12 engines1flagged
View all 75 engine results
- VBA32Malicious: suspected of Archive.MailBomb
- ZoneAlarmMalicious: Troj/ArchBomb
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacNo result
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavNo result
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXNo result
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataNo result
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaNo result
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is DO NOT OPEN.vbs safe?
What is DO NOT OPEN.vbs?
How many antivirus engines detected DO NOT OPEN.vbs?
What is the SHA-256 hash of DO NOT OPEN.vbs?
Is it safe to open or extract DO NOT OPEN.vbs?
How up to date is this analysis of DO NOT OPEN.vbs?
Community
Member reviews and reports for this exact file hash.