File scan report
Verdict Safe
Is DRTCP.
Only Zillya flagged this widely submitted executable, while all major antivirus engines remained silent and evidence from the test run showed no corroborating high-risk activity.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 72 flagged
- Flagged 1
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 19y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 72 antivirus engines that checked it flagged the executable, using an adware label that no other engine corroborated; all 18 reporting major antivirus engines were silent. Its history spans 400 submission sources since it was first seen on Feb 20, 2007, and the sandbox summary found no high-risk techniques, injected processes, or malicious dropped files.
Zillya alone reported an adware label, while none of the 18 reporting major antivirus engines flagged the file. The executable has been submitted 504 times by 400 sources and was first seen on Feb 20, 2007, providing a substantial benign anchor. The combined sandbox summary recorded only techniques common in legitimate software, with no high-risk techniques or named injection targets. No malicious child was identified, and the executable does not show high-entropy code or recognized packing. The remaining uncertainty comes from the absent signature, unavailable static examination, and lack of a complete host-reputation check, but these do not corroborate the isolated detection.
What We Detected
Only 1 of the 72 antivirus engines that checked it flagged the executable. Zillya applied the label Adware.DLBoost.Win32.22, while all 18 reporting major antivirus engines remained silent and no second engine supported that label.
Threat Behavior
The combined sandbox summary recorded techniques common in legitimate Windows software but no high-risk techniques, named injection targets, persistence indicators, or malicious dropped files. The executable also lacked high-entropy code and recognized packing. Background network contacts were excluded from the sample's activity; no complete reputation result is available for all remaining observed contacts.
What To Do Now
The broad submission history and lack of corroborating detections make the isolated adware label likely to be a false positive. Obtain the executable from its intended trusted source and keep security software enabled, especially because the file has no verifiable publisher signature.
Where this verdict could be wrong3 caveats
- Zillya labels the executable Adware.DLBoost.Win32.22, although no other engine corroborates that unwanted program label.
- The executable is unsigned, so its publisher cannot be authenticated.
- Our static analysis was not available, and no complete reputation result is available for all observed contacts.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 72 antivirus engines that checked it flagged the file, and none of the 18 reporting major antivirus engines did.
- The file has 504 submissions from 400 sources and was first seen on Feb 20, 2007.
- The sandbox summary showed no high-risk techniques or named process-injection targets.
- No malicious dropped files were identified.
- The executable shows neither high-entropy code nor recognized packing.
- Zillya labels the executable as adware, but no other engine corroborates that assessment.
- The executable has no verifiable publisher signature.
- Our proprietary static examination was unavailable, and the observed contacts did not receive a complete reputation check.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 3spawned processes
- 1network contact
- 22filesystem & mutex artifacts
Includes 9 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
1 of the 72 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The Safe verdict weighed these detections and treats them as non-decisive.
- ZillyaAdware.DLBoost.Win32.22
File fingerprint
- Last analyzed
- Apr 23, 2026, 8:19 PM UTC
- SHA-256
de08e3d24dc3cafea087936be9b2016951b0b9f5c96399b74c0cc3b2e1c945b6- SHA-1
597d16a19baf7d15a045be41c907b956d1de706b- MD5
5db09a8e32164e4669f5eadc0cf50182
About this file
DRTCP.exe is a Win32 EXE file of 53.8 kB.
- Type and size
- Win32 EXE · 53.8 kB
- Signer
- UnsignedNo code signature.
- First seen
- Feb 20, 2007On VirusTotal.
- Submitted by
- 400 distinct sources
- Packer
- None detected
- Entropy
- 5.46 of 8
First scanned Updated
Verdict history
- Suspicious
- Maliciousafter a new scan
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Includes every engine result (76), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is DRTCP.exe safe?
What is DRTCP.exe?
How many antivirus engines detected DRTCP.exe?
What is the SHA-256 hash of DRTCP.exe?
Is it safe to run DRTCP.exe?
How up to date is this analysis of DRTCP.exe?
Community
Member reviews and reports for this exact file hash.
