File scan report
Verdict Malicious
Is PCW.
Fourteen of the 69 antivirus engines that checked it, six of them major, call this unsigned 64-bit executable a trojan, and nobody inspecting the code knows what it is for.
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already ran it, follow the steps below.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't run it
Don't run this file. Delete it, then empty the Recycle Bin.
If you already ran it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
If you typed passwords on the device after running it, change them from another device you trust.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
14 of 69 flagged
- Flagged 14
- No detection 55
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 4mo ago
Chapter 02
Why we think so
5 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This unsigned Windows executable is detected by 14 of the 69 antivirus engines that checked it, including six major antivirus engines such as Microsoft, Symantec, Sophos, Fortinet, Trellix and TrendMicro, with trojan labels from generic rules to a named Tedy detection. It is not packed and has no publisher signature, and only two sources have ever submitted it.
The antivirus spread on this file is broad rather than incidental: 14 of the 69 antivirus engines that checked it flag it, and six of those are major antivirus engines, including Microsoft with a machine-learning trojan label, Symantec with a generic trojan, Sophos with a generic signature, and TrendMicro with a Tedy trojan detection. The labels do not agree on one named family, so the file is characterised as a generic trojan rather than a specific one. Nothing about the binary suggests a benign commercial product: there is no code-signing certificate, no publisher history on our side, and the file has been submitted by only two sources since it was first seen on Jun 12, 2026. The binary itself is not packed and shows no high-entropy code, so the detections are not simply an artefact of obfuscation. One run was recorded and it produced no malicious verdict, no outbound connections and no dropped files, but it also captured no harmless purpose for the program, so it neither clears the file nor adds to the engine evidence. The host-reputation cross-check was not completed, so no conclusion is drawn from network reputation either way.
What We Detected
This is a 5.4 MB 64-bit Windows executable with no code signature and no publisher history. Fourteen of the 69 antivirus engines that checked it flag it. The major group is substantial: Microsoft returns a machine-learning trojan label (Sabsik family), Symantec a generic trojan, Sophos a generic signature, Trellix an Artemis heuristic, Fortinet a possible-threat label, and TrendMicro a Tedy trojan detection. Malwarebytes adds an AI-generated malware detection, alongside several less established engines.
Threat Behavior
The binary is not packed and does not carry high-entropy code, so the detections are not explained by a wrapper or protector. Labels are generic and do not converge on one family, which is characteristic of trojan droppers and loaders whose payload is fetched or unpacked later rather than shipped in the file. Our own inspection of the bytes was not performed for this sample, so the file's actual capability was not confirmed. One recorded run of the program produced no outbound connections, no injected processes and no dropped files; it wrote only routine input-device and audio settings for the user profile. That run therefore neither demonstrates a benign purpose nor confirms the engine findings. The contacted-host reputation check was not completed, so nothing can be said about the destinations this program might use.
What This Means
An unsigned, rarely submitted executable that six major antivirus engines call a trojan is not something to launch to see what happens. There is no publisher, no reputation and no visible legitimate purpose to offset the detections, and the generic labelling fits a loader-style threat that does its real work after execution.
What To Do Now
Do not run the file. If it arrived as an attachment, from a download link, or from someone you do not know, treat the sender or the link as hostile and remove the file. If you believe it is a program you actually asked for, get a fresh copy directly from the vendor's official site and check it before use. Keep your security software enabled and let it handle the file if it is still on disk.
Where this verdict could be wrong3 caveats
- Several major antivirus engines — including BitDefender, ESET, Avira, Avast, AVG and DrWeb — returned nothing at all, so the malware call is not unanimous.
- The recorded run produced no malicious sandbox verdict, no network connections and no dropped files, so whatever the payload does was not captured in the environment that was used.
- Labels such as Artemis, Generic-S, PossibleThreat and a machine-learning 'Sabsik' family name are broad and occasionally land on unusually built or packed software — though this file shows no packer and low section entropy, which weakens that explanation.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The executable is not packed and its code section entropy is low, so the detections cannot be dismissed as a simple packing artefact
- No malware sharing databases or community rule sets list this hash
- The recorded run produced no outbound connections, no dropped files and no injected processes
- No brand impersonation was found — the file does not pretend to come from another vendor
- 14 of the 69 antivirus engines that checked it flag the file, six of them major antivirus engines including Microsoft, Symantec, Sophos, Fortinet, Trellix and TrendMicro
- The file carries no digital signature, so there is no publisher identity to check
- Only two sources have ever submitted it, and it has no reputation history at all
- Detection labels span generic trojan, rule and AI-based verdicts, which is typical of loader-style threats that fetch their real payload later
- Our own inspection of the file contents has not been carried out, so its actual capability is unconfirmed
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 1 isolated test; no test environment rated what it did as risky.
Test run summary
Capture complete- 1isolated sandbox run
- 0spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Includes every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
14 of the 69 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 14
- Fortinet (major engine)W32/PossibleThreat
- Microsoft (major engine)Trojan:Win32/Sabsik.EN.A!ml
- Sophos (major engine)Mal/Generic-S
- Symantec (major engine)Trojan.Gen.MBT
- TrellixENS (major engine)Artemis!F9D23F1BEA18
- TrendMicro (major engine)Trojan.Win64.TEDY.TL0101FD26ZY
- TrendMicro-HouseCall (major engine)Trojan.Win64.TEDY.TL0101FD26ZY
- Antiy-AVLGrayWare/Win32.Wacapew
File fingerprint
- Last analyzed
- Nov 5, 2026, 10:50 AM UTC
- SHA-256
e7d088fa0fc714c5b39c97cf63e093145d42f7973023d141a87cf6b19f37f3d6- SHA-1
62bfa39302c87b8829ca6c916edc64d901a18245- MD5
f9d23f1bea183c170f2a73d1b21115cf
About this file
PCW.exe is a Win32 EXE file of 5.5 MB.
- Type and size
- Win32 EXE · 5.5 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 12, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.77 of 8
First scanned
Includes every engine result (74), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is PCW.exe malware?
What is PCW.exe?
How many antivirus engines detected PCW.exe?
I already downloaded and ran PCW.exe — what should I do?
How do I remove PCW.exe?
What kind of malware is PCW.exe?
What is the SHA-256 hash of PCW.exe?
How up to date is this analysis of PCW.exe?
Community
Member reviews and reports for this exact file hash.