File scan report
Verdict Safe
Is download safe? Yes, no threats found.
None of the 60 antivirus engines that checked it flagged this HTML file, and its completed browser run produced no malicious verdict, persistence, injection, or hostile contact.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust where it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 60 flagged
- Flagged 0
- No detection 60
- No result 15
- Code signing Not applicable
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
A completed browser run mapped one protocol-related technique but showed no malicious sandbox outcome, persistence, injection, file it created, or known hostile host; caution remains appropriate because the embedded-script file has little prevalence.
This is a small HTML document containing embedded JavaScript, rather than a native executable. None of the 60 antivirus engines that checked it flagged it, and no malware family was identified. During one completed browser run, it opened through Edge and Chrome without a malicious sandbox verdict, persistence, process injection, or file it created. All 29 distinct observed contacts were covered by the host-reputation check, with no malicious or suspicious matches. is a limited counter-signal, but it lacks corroboration from engines, external intelligence, runtime outcomes, or hostile files it created. The file's low prevalence warrants ordinary source verification despite the otherwise benign evidence.
What We Detected
The sample is a 26,624-byte HTML document containing embedded JavaScript. None of the 60 antivirus engines that checked it flagged it, and no malware family or external malware-specific rule matched the hash.
Threat Behavior
One completed sandbox run opened the document in Edge and Chrome. It produced no malicious sandbox verdict, persistence indicators, process injection, or files it created. The run mapped T1571, a protocol-related technique, but this was not accompanied by a remote control verdict or other offensive activity. The host-reputation check covered all 29 distinct listed contacts and found no malicious or suspicious matches.
What To Do Now
The evidence is consistent with an ordinary web document, but embedded JavaScript can change what a page displays or loads. Open it only if its source and expected content are known, keep browser and security software enabled, and avoid entering credentials or approving downloads if the page behaves unexpectedly.
Where this verdict could be wrong2 caveats
- The HTML contains embedded JavaScript and is rare, with only one recorded submission, so broad real-world reputation is limited.
- The sandbox mapped T1571, indicating use of a non-standard application-layer protocol, although no malicious outcome or corroborating detection was recorded.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 60 antivirus engines that checked it flagged the file.
- The completed browser run produced no malicious sandbox verdict.
- No persistence, process injection, or file it created was observed.
- All 29 distinct observed contacts were checked, with no malicious or suspicious host matches.
- No malware-specific external intelligence or researcher rules matched the hash.
- The document contains embedded JavaScript, which can execute when opened in a browser.
- Only one submission is recorded, so the file has limited prevalence and reputation history.
- The sandbox mapped T1571, although no malicious result or corroborating behavior followed.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 4sandbox rule tags
- 4spawned processes
- 25network contacts
- 20filesystem & mutex artifacts
Includes 4 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 60 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 11, 2026, 8:49 AM UTC
- SHA-256
ec184056e6e48232479f4bb33d0b0cf7e8d3bf8091ce327342d67fb11d624f13- SHA-1
310aea32a65c0221d31fef893a06b4fb61a45d0f- MD5
63adca00f88452ae9f5119bcf375d5bd
About this file
download is an HTML file of 26.6 kB.
- Type and size
- HTML · 26.6 kB
- Signer
- Not applicable
- First seen
- Sep 5, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is download safe?
What is download?
How many antivirus engines detected download?
What is the SHA-256 hash of download?
Is it safe to open download?
How up to date is this analysis of download?
Community
Member reviews and reports for this exact file hash.