File scan report
Verdict Safe
Is spoofer.
No engine detected malware in this unsigned driver-like executable, although its publisher is unverified and no completed observation from the test run is available.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Use the file only if it came from a trusted official source and its hash matches the publisher's release information. Keep security protection enabled, especially because the executable is unsigned and driver-like.
Good practice2 tips
We found nothing harmful in this file.
Use it only with hardware or software from the original manufacturer.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 69 flagged
- Flagged 0
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Partial
- First seen 5mo ago
Chapter 02
Why we think so
5 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 69 antivirus engines that checked it returned without a malicious or suspicious finding, including 16 major antivirus engines reporting clean. The file is unsigned and has one service-related static technique, while no completed sandbox run or complete host-reputation check is available, so ordinary caution remains appropriate.
The strongest evidence is the absence of malicious or suspicious findings across 74 engines, with no major detection or family consensus. Static PE analysis also found neither likely packing nor high-entropy code, and the external intelligence checks produced no known-malware or YARA matches. The file is unsigned, so its publisher and integrity cannot be authenticated through code signing. is listed as an offensive technique, but no completed sandbox run exists, so it cannot be described as runtime-observed activity. Host reputation was not checked or saved. No complete contacted-host reputation result was available.
What We Detected
None of the 69 antivirus engines that checked it marked the sample malicious or suspicious. This includes 16 major antivirus engines reporting clean, with no malware-family consensus. Static PE analysis reports no likely packing and no high-entropy code, while CIRCL, MalwareBazaar, and YARAify supplied no corroborating threat hit.
Threat Behavior
The evidence lists T1543.003, a service-related technique that can be associated with driver or service installation. However, the absence of a sandbox run means no completed observation from the test run is available, so this technique should be treated as static capability evidence rather than confirmed execution. The file is unsigned, and no signer history exists to establish its publisher. No complete contacted-host reputation result is available.
What To Do Now
Keep security software enabled and obtain the file from its official source whenever possible. Before installing a kernel-level component, verify its expected hash or publisher documentation and consider testing it in an isolated environment.
Where this verdict could be wrong3 caveats
- The missing code signature leaves the publisher and integrity of this driver-like executable unverified.
- appears in the sandbox's offensive-technique list, but the absence of a sandbox run means there is no completed observation from the test run to corroborate it.
- No contacted-host reputation result was saved, so no completed host-reputation cross-check is available.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/69 engines reported malicious or suspicious findings.
- No major malware-family consensus exists.
- No code section has packed-level entropy and the file does not appear packed.
- YARAify, CIRCL, and MalwareBazaar returned no threat hits.
- The executable is unsigned.
- No historical signer reputation is available.
- Static evidence includes T1543.003.
- No completed sandbox observation is available.
- No completed contacted-host reputation cross-check is available.
6 sources checked · 4 complete · 1 partial · 1 not needed or not applicable. See every source
Chapter 03
Technical details
None of the 69 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 partial · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 10, 2026, 4:09 PM UTC
- SHA-256
dd85eba4c33fbc33c4f736326a79fb060730f51b4d90d6bac95d284e0d5bfb6f- SHA-1
62b63104a8d3e68e6f55c2a8f4aa37d88e4a8652- MD5
7273134b91433961fb24f269101b6261
About this file
spoofer.drv.sys is a Win32 EXE file of 195.1 kB.
- Type and size
- Win32 EXE · 195.1 kB
- Signer
- UnsignedNo code signature.
- First seen
- May 20, 2026On VirusTotal.
- Submitted by
- 13 distinct sources
- Packer
- None detected
- Entropy
- 6.02 of 8
First scanned
Includes every engine result (74), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is spoofer.drv.sys safe?
What is spoofer.drv.sys?
How many antivirus engines detected spoofer.drv.sys?
What is the SHA-256 hash of spoofer.drv.sys?
Is it safe to use spoofer.drv.sys?
How up to date is this analysis of spoofer.drv.sys?
Community
Member reviews and reports for this exact file hash.