File scan report
Verdict Safe
Is isaac-
No antivirus engine flags this executable, the combined sandbox verdict was clean, and its high entropy is explained by Valve's Steam DRM wrapper rather than malware packing.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
The file itself shows no sign of malicious behaviour, so keep your security software enabled and let it scan the file normally. If it came from an unofficial game-rip or mirror site, obtain the game from the official store instead, since repackaged copies from such sources cannot be vouched for by this analysis.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 4mo ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 70 antivirus engines that checked it in our network flagged this executable, including all 18 major antivirus engines, and the sandbox runs recorded no network contacts, no process injection and no persistence. The encrypted code section that scanners may flag is Valve's Steam DRM wrapper, which game executables legitimately use. The file is unsigned, so there is no publisher identity behind it.
The engine results are silent across the board: none of the 70 antivirus engines that checked it flagged this file, and the 18 major antivirus engines all returned clean. The combined sandbox verdict was clean with no split between runs, no high-risk techniques, no injected processes, no persistence keys and no outbound connections at all, which is what a self-contained game executable looks like once its launcher has finished. The two things that could look alarming at a glance both have a plain explanation. The code section is heavily encrypted and the file has an extra .bind section, and the antivirus metadata identifies that section as Valve's Steam DRM wrapper — protection added to game binaries, not custom obfuscation. That same wrapper is exactly why a public sandbox service cited in the comments produced anti-debug, packed and evasive tags; those tags describe DRM behaviour, not malicious intent. The file is not digitally signed, so nothing cryptographically ties it to a publisher, and one researcher note says the copy came from a game-rip site. That concerns the download channel rather than this specific binary: the bytes themselves show no hostile behaviour, no network traffic and no reference-database or community-rule findings, and the file has been circulating widely across hundreds of sources for months without a single detection. The reputation check for hosts contacted during download was not completed, so no claim is made about the trustworthiness of the site or mirror the file came from. Anyone who received it from an unofficial source should still source the game from the official store.
What We Detected
None of the 70 antivirus engines that checked it in our network flagged this 9 MB Windows executable; the 18 major antivirus engines all returned clean results, and no engine returned a suspicious rating either. Reference-database and community-rule lookups (known-software references, the public sample database and community YARA rules) also came back empty, and no engine attached a malware family name to it.
The executable is not digitally signed, so there is no publisher certificate to verify. It has been in circulation since Jun 10, 2026 and has been submitted by 809 distinct sources, which is the profile of a widely distributed, stable piece of software rather than a fresh, narrowly targeted sample.
Threat Behavior
Four sandbox runs executed the file and produced a combined clean result, with no disagreement between runs. During execution the sample did not contact any domain, address or URL, created no autorun or service persistence, set no registry keys, injected into no other process, and spawned no additional programs. The only files it wrote were .NET runtime breadcrumb entries created by the runtime itself as it loaded libraries.
The techniques the sandbox recorded — code obfuscation variants, input-queue interaction and standard HTTP-style networking mappings — are all common in legitimate software, and none of them came with the artefacts that would make them meaningful here. The file's large encrypted code section and extra .bind section are identified in the antivirus metadata as Valve's Steam DRM wrapper, which is how Steam-distributed game executables ship; the entropy in the ordinary code section is unremarkable.
What To Do Now
Keep your antivirus and other protection enabled and let it scan the file on access; nothing here needs to be excluded from scanning. If you obtained this executable from an unofficial game-rip or mirror site rather than the official store, treat the download channel as the risk: repackaged copies can differ from the file examined here even when the name is identical. Getting the game through the official store removes that uncertainty entirely.
Where this verdict could be wrong4 caveats
- Two researcher annotations relay an automated multi-engine scanning service scoring the file as malicious on tags such as anti-debug, packed and evasive — those tags are also what a Steam DRM wrapper looks like, but the claim was not independently reproduced by the engines or the sandbox runs here.
- The file carries no digital signature, so there is no publisher identity to confirm it is the genuine game executable rather than a modified copy.
- A researcher note says the copy examined came from a game-rip download site; the file's own behaviour shows no network activity, but a repackaged copy from such a source should be checked by the recipient rather than trusted on this file's evidence alone.
- The reputation lookup for the sites and addresses contacted during download could not be completed, so nothing is claimed about the download location's trustworthiness.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No engine out of 75 flagged the file, and all 18 major antivirus engines reported it clean.
- The combined sandbox verdict was clean with no malicious verdict and no split between runs.
- During execution the sample made no network connections, created no persistence and injected into no process.
- The encrypted code section is identified as Valve's Steam DRM wrapper, a legitimate protection used by game executables.
- The file has been submitted by 809 distinct sources since Jun 10, 2026 without any detection or public-database listing.
- The executable is unsigned, so there is no publisher identity attached to the bytes.
- Its code section is encrypted by Valve's Steam DRM wrapper, which prevents straightforward inspection of what the program contains.
- Researcher notes say the copy analysed came from a game-rip download site, so the distribution channel rather than the file is the open question.
- The reputation check for the download location was not completed, so nothing is claimed about how trustworthy the source was.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 4sandbox rule tags
- 1spawned processes
- 0network contacts
- 5filesystem & mutex artifacts
Includes the sandbox verdicts, 4 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 6, 2026, 8:22 PM UTC
- SHA-256
e5faf6f513c6de9cc9ff1c335ef9c541e2b33fc623aa3b8ffbd2e6a6c0027bb0- SHA-1
5f846c1508cfde8dc2f9631ecbd0cde8e031ee75- MD5
86522b51331d90911ef240bacaa965a6
About this file
isaac-ng.exe is a Win32 EXE file of 9.4 MB.
- Type and size
- Win32 EXE · 9.4 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 10, 2026On VirusTotal.
- Submitted by
- 809 distinct sources
- Packer
- Possibly packedPacking hides code; legitimate installers use it too.
- Entropy
- 6.50 of 8A code section is highly compressed or encrypted.
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is isaac-ng.exe safe?
What is isaac-ng.exe?
How many antivirus engines detected isaac-ng.exe?
What is the SHA-256 hash of isaac-ng.exe?
Is it safe to run isaac-ng.exe?
How up to date is this analysis of isaac-ng.exe?
Community
Member reviews and reports for this exact file hash.