Suspicious
Unsigned executable with hacktool labels, LSASS access, and direct-IP C2 but limited tier-1 consensus and no sandbox malice.
dd303fbbe0818e92b0…d8defb0889The reasoning behind this verdict
The MT AI Engine weighs every signal from this scan — antivirus detections, sandbox behaviour, code signing, prevalence and historical matches — to reach a single, evidence-based verdict.
The combination of offensive MITRE techniques, credential-dumper heuristic, and direct-IP C2 raises concern despite the low engine count. The file remains unsigned with no established signer history, removing the benign-signed-installer safety net. Medium prevalence and nine-year age suggest it may be an old game installer repurposed or mislabelled, but the behavioural signals outweigh that possibility. The single tier-1 detection and confirmed hacktool labels prevent a clean verdict while the lack of sandbox malice and dropped malicious children keep it from malicious.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines.tier1Malicious=1 (Ikarus Trojan.Win32.TrojanClicker) and hacktoolConfirmed=true
behaviour.offensiveTechniques includes T1134, T1485, T1547.001, T1548 plus MalwareTips.Synth.CredentialDumper firing on lsass.exe
MalwareTips.Synth.DirectIpC2 fired on 5 direct IPs with zero domains
signing.verified=false and signerStats.found=false
prevalence.classification=medium with 3341 days age
- 16 tier-1 engines reported clean
- No malicious dropped children
- No malicious sandbox verdicts
- Medium prevalence over nine years
- Unsigned binary with no signer history
- LSASS memory access observed in sandbox
- Direct-IP C2 without domain resolution
- Hacktool labels from multiple engines
Treat as suspicious and avoid execution; the behavioural indicators outweigh the limited engine consensus but do not reach malicious threshold without further corroboration.
What this file does
What it attempted when executed in an isolated sandbox
High concern: Records what you type — keylogger behaviour.
High concern: Talks to a remote server to take commands or send out your data.
High concern: Sets itself to run automatically every time you start your PC.
Moderate concern: Obfuscates or packs its code to avoid detection.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Scans through your files and folders.
Moderate concern: Checks whether it's being watched in a sandbox before acting.
Translated from the file's technical behaviour during analysis. It never ran on your device.
What to do now
We couldn't fully clear this file. Treat it with caution.
Don't run it unless you're certain it came from a source you trust.
Check where you got it — an email attachment or a random download link is a red flag.
If you're unsure, delete it. You can always re-download a clean copy from the official source.
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.
trojanclicker corroborated by 2 sources
- VT (74 engines)trojanclicker
- MT AI Enginetrojanclicker
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 20.99.133.109
- 184.27.218.92
- 20.69.140.28
- 23.196.193.245
- 23.46.228.39
- C:\Users\<USER>\AppData\Local\Temp\aiw22851796.bmp
- C:\Users\<USER>\AppData\Local\Temp\aiw22851859.bmp
- C:\Users\<USER>\AppData\Local\Temp\aiw22851875.bmp
- C:\Users\<USER>\AppData\Local\Temp\aiw22851890.bmp
- C:\Users\<USER>\AppData\Local\Temp\aiw22851937.bmp
- C:\Program Files (x86)\Big City Adventure - San Francisco\22868906.tmp
- C:\Program Files (x86)\Big City Adventure - San Francisco\22868937.tmp
- C:\Program Files (x86)\Big City Adventure - San Francisco\22868984.tmp
- C:\Program Files (x86)\Big City Adventure - San Francisco\22869062.tmp
- C:\Program Files (x86)\Big City Adventure - San Francisco\22869093.tmp
- Big City Adventure - San Francisco_inst_m
- cversions.3.m
- \Sessions\1\BaseNamedObjects\Big City Adventure - San Francisco_inst_m
- \BaseNamedObjects\Local\SM0:528:304:WilStaging_02
- \BaseNamedObjects\Local\SM0:528:120:WilError_03
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- e2b5fd507077186f978a…968ceaNever scannednever seen before
- 7e7d16c39deb6d3079a7…c3d9bbNever scannednever seen before
- e37c908a1787545d6c9d…c9bbaaNever scannednever seen before
- be4acc10037e800d199d…8f9b99Never scannednever seen before
- 16a19763520bc5acfa82…a4042fNever scannednever seen before
- 5390897ae64b96ae7d22…675110Never scannednever seen before
- 759f2d89ddf896efca9c…fb4fd0Never scannednever seen before
- 3f8a4dfe9ab441222f1d…8ab8f3Never scannednever seen before
- ba79e50d6009aac8e455…2daaf5Never scannednever seen before
- 51d762f36e46137af6a0…606574Never scannednever seen before
YARA & heuristic rule matches
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
Sandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exeSample contacted 5 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence20.99.133.109 · 184.27.218.92 · 20.69.140.28
5 detections across 74 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- Big City Adventure - San Francisco.exe
- Size
- 22.15 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- dd303fbbe0818e92b06929b9a9f84dbf86513cea3542ee06192667d8defb0889
- MD5
- ec05d41d3d2a61aec5a42b14db8b4f5e
- SHA-1
- e002bddca2ef0d50cb3e81c496ab154cbd2eeef5
- PE imphash
- 0f0220a878efa4349029ff3e2777968b
- First seen (VT)
- 5/24/2017, 3:53:30 AM UTC
- Last analysis (VT)
- 7/13/2026, 7:25:04 AM UTC
- First scan (MalwareTips)
- 7/16/2026, 5:39:56 PM UTC
- Last scan (MalwareTips)
- 7/16/2026, 5:39:56 PM UTC
Safety FAQ
Common questions about Big City Adventure - San Francisco.exe, answered from the scan data above.
Before using the site
- Big City Adventure - San Francisco.exe is suspicious — treat it as unsafe until you're sure. 5 of 74 antivirus engines flag it (family: trojanclicker), which isn't a strong consensus but is enough to be cautious. Don't run it unless you fully trust where it came from, and prefer downloading the software fresh from its official site.
- Big City Adventure - San Francisco.exe is a Windows executable program, about 22.2 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.
- To remove Big City Adventure - San Francisco.exe: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original Big City Adventure - San Francisco.exe file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.
- Big City Adventure - San Francisco.exe is classified as a hacktool — dual-use offensive tooling that is dangerous regardless of intent. Engines attribute it to the trojanclicker family. Knowing the family matters because it tells you the likely impact — data theft, remote control, file encryption, or unwanted ads — and guides the cleanup.
- The SHA-256 hash of Big City Adventure - San Francisco.exe is dd303fbbe0818e92b06929b9a9f84dbf86513cea3542ee06192667d8defb0889, and its MD5 is ec05d41d3d2a61aec5a42b14db8b4f5e. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
- This report reflects the scan run on July 16, 2026. Because a file's hash never changes, the identity of Big City Adventure - San Francisco.exe is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
After an incident
- Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.
Technical questions
- 5 of 74 antivirus engines flagged Big City Adventure - San Francisco.exe, 5 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.