File scan report
Verdict Safe
Is Anime
Only 1 of the 70 antivirus engines that checked it raised a generic detection, while stronger engines and completed sandbox runs supplied no corroborating malicious evidence.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 70 flagged
- Flagged 1
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 4d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Bkav alone flagged this executable with a generic label; the other 74 of the 70 antivirus engines that checked it did not flag it, including all reporting major antivirus engines. The completed sandbox runs produced a combined clean verdict and recorded neither a named injection target nor another high-risk technique, making the lone detection likely a false positive.
Only 1 of the 70 antivirus engines that checked it flagged the executable, and that result came from Bkav with a generic malware label. No major antivirus engines detected it, and the completed sandbox runs produced a combined clean verdict without recording any named injection target. The mapping is uncorroborated and therefore does not establish that process injection occurred. Public sample databases and malware-specific community rules supplied no supporting evidence, and no malicious child was identified. Confidence is moderated because the executable is unsigned and was first seen on Nov 2, 2026 with a limited submission history.
What We Detected
Bkav was the only engine to flag the executable, using the generic label W32.Malware.DF99DCD5. The other 74 of the 70 antivirus engines that checked it did not flag it, including every reporting major antivirus engine. No real malware family was identified.
Threat Behavior
The completed sandbox runs produced a combined clean verdict and recorded no named process-injection target or other high-risk technique. A T1055 mapping appeared without the artifact needed to show actual injection, so it does not corroborate the isolated detection. No complete contacted-host reputation result is available, although the sandbox recorded no sample network contacts.
What To Do Now
The evidence strongly suggests that Bkav's generic result is a false positive. Because the executable is unsigned and has a limited history, obtain it from the expected developer or distribution channel, retain security software, and rescan if its origin is uncertain.
Where this verdict could be wrong3 caveats
- The executable is unsigned, so there is no verified publisher identity supporting it.
- It was first seen on Nov 2, 2026 and has only 22 distinct submitters, giving it a limited history.
- Bkav reported W32.Malware.DF99DCD5, although no other engine corroborated that generic label.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The other 74 of the 70 antivirus engines that checked it did not flag the file, including all reporting major antivirus engines.
- The completed sandbox runs produced a combined clean verdict.
- No named process-injection target or other high-risk technique was recorded.
- No malware-specific community rule or public sample-database listing matched the hash.
- No malicious dropped file was identified.
- The executable has no verified publisher signature.
- It was first seen on Nov 2, 2026 and has a limited submission history.
- Bkav raised one generic malware detection.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 15sandbox rule tags
- 2spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
15MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1070· Covers its tracks
- T1070.006· Covers its tracks
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1553
- T1553.002
- T1574· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
AnimeAdventuresMacro.exe"C:\Users\<USER>\Desktop\AnimeAdventuresMacro.exe"AnimeAdventuresMacro.exe"C:\Users\user\Desktop\AnimeAdventuresMacro.exe"
Chapter 04
Technical details
1 of the 70 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- BkavW32.Malware.DF99DCD5
File fingerprint
- Last analyzed
- Nov 3, 2026, 5:13 AM UTC
- SHA-256
e2dc3e6bf4b803aeb7823bf967cf083a7cf79cdc703561520485f3555f548cfc- SHA-1
cdb6aed759abff4c9d53d82d8cdde70b634f93d6- MD5
42071ac6d3c8b6b32b3348588cd8e4bf
About this file
AnimeAdventuresMacro.exe says it is Capy's AA Macro, 2.5 MB.
- Claims to be
- Capy's AA MacroFrom the file's own version information, written by whoever built it.
- Original name
- AnimeAdventuresMacro.exeMatches the shared file name.
- Type and size
- Win32 EXE · 2.5 MB
- Signer
- UnsignedNo code signature.
- First seen
- Nov 2, 2026On VirusTotal.
- Submitted by
- 22 distinct sources
- Packer
- None detected
- Entropy
- 7.25 of 8
First scanned
Antivirus consensus
1 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- BkavMalicious: W32.Malware.DF99DCD5
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroNo result
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is AnimeAdventuresMacro.exe safe?
What is AnimeAdventuresMacro.exe?
How many antivirus engines detected AnimeAdventuresMacro.exe?
What is the SHA-256 hash of AnimeAdventuresMacro.exe?
Is it safe to run AnimeAdventuresMacro.exe?
How up to date is this analysis of AnimeAdventuresMacro.exe?
Community
Member reviews and reports for this exact file hash.