File scan report
Verdict Safe
Is download safe? Yes, no threats found.
None of the 60 antivirus engines that checked it flagged this HTML file, and its completed browser run produced no malicious verdict, persistence, injection, or hostile contact.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust where it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 60 flagged
- Flagged 0
- No detection 60
- No result 15
- Code signing Not applicable
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
A completed browser run mapped one protocol-related technique but showed no malicious sandbox outcome, persistence, injection, file it created, or known hostile host; caution remains appropriate because the embedded-script file has little prevalence.
This is a small HTML document containing embedded JavaScript, rather than a native executable. None of the 60 antivirus engines that checked it flagged it, and no malware family was identified. During one completed browser run, it opened through Edge and Chrome without a malicious sandbox verdict, persistence, process injection, or file it created. All 29 distinct observed contacts were covered by the host-reputation check, with no malicious or suspicious matches. is a limited counter-signal, but it lacks corroboration from engines, external intelligence, runtime outcomes, or hostile files it created. The file's low prevalence warrants ordinary source verification despite the otherwise benign evidence.
What We Detected
The sample is a 26,624-byte HTML document containing embedded JavaScript. None of the 60 antivirus engines that checked it flagged it, and no malware family or external malware-specific rule matched the hash.
Threat Behavior
One completed sandbox run opened the document in Edge and Chrome. It produced no malicious sandbox verdict, persistence indicators, process injection, or files it created. The run mapped T1571, a protocol-related technique, but this was not accompanied by a remote control verdict or other offensive activity. The host-reputation check covered all 29 distinct listed contacts and found no malicious or suspicious matches.
What To Do Now
The evidence is consistent with an ordinary web document, but embedded JavaScript can change what a page displays or loads. Open it only if its source and expected content are known, keep browser and security software enabled, and avoid entering credentials or approving downloads if the page behaves unexpectedly.
Where this verdict could be wrong2 caveats
- The HTML contains embedded JavaScript and is rare, with only one recorded submission, so broad real-world reputation is limited.
- The sandbox mapped T1571, indicating use of a non-standard application-layer protocol, although no malicious outcome or corroborating detection was recorded.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 60 antivirus engines that checked it flagged the file.
- The completed browser run produced no malicious sandbox verdict.
- No persistence, process injection, or file it created was observed.
- All 29 distinct observed contacts were checked, with no malicious or suspicious host matches.
- No malware-specific external intelligence or researcher rules matched the hash.
- The document contains embedded JavaScript, which can execute when opened in a browser.
- Only one submission is recorded, so the file has limited prevalence and reputation history.
- The sandbox mapped T1571, although no malicious result or corroborating behavior followed.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 4sandbox rule tags
- 4spawned processes
- 25network contacts
- 20filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
4MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
- T1082· System recon
- T1571· Unusual port
- T1573
Observed activity
Processes started
4Programs the file ran, with their command lines.
msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "C:\Users\<USER>\Desktop\document.html"chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --metrics-shmem-handle=1916,i,17029967067249688974,15600870672705809174,524288 --field-trial-handle=1908,i,12178682902543884591,10511401802723707738,262144 --variations-seed-version=20260831-170048.808000-production --mojo-platform-channel-handle=1960 /prefetch:11chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\index.html"
Network contacts
2525 hosts, listed as 5 domains, 18 addresses, 2 links. Links show the host and path only.
- Domain
js.player.cntv.cn - Domain
tv.cctv.com - Domain
js.player.cntv.cn.wsglb0.com - Domain
tv.cctv.com.wsglb0.com - Domain
redirector.gvt1.com - IP address
150.171.109.183
Show all 25 entries for network contacts
- IP address
150.171.74.13 - IP address
138.113.128.90 - IP address
138.113.128.20 - IP address
157.185.179.12 - IP address
43.175.171.175 - IP address
43.146.68.80 - IP address
43.146.64.170 - IP address
23.55.236.133 - IP address
23.55.236.139 - IP address
184.25.59.84 - IP address
74.179.77.204 - IP address
4.150.223.114 - IP address
150.171.110.145 - IP address
23.55.236.138 - IP address
20.165.94.63 - IP address
52.123.250.144 - IP address
142.251.157.119 - URL
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAALE+VmfUqbVYAAAAAAAAs= - URL
http://clients2.google.com/time/1/current
Files
20Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\800546e9-2ed8-40d6-943f-c782f231c06b - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\3fdf0089-d61b-44f4-82a4-a5e27757bcbd - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics
Show all 20 entries for files
- Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6A9C4F7D-518.pma - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\28cda946-b9b6-441a-ad4c-8eebc122c45a.tmp - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0 - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\128.png - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\af - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\af\messages.json - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\am - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\am\messages.json - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\ar\messages.json - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\az - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\az\messages.json - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\be - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\be\messages.json
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Deleted
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
Sandbox background — not the file
5The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3808 -s 3836 - VM host
edge-mobile-static.azureedge.net - VM host
business.bing.com - VM host
199.232.210.172 - VM host
204.79.197.203
Chapter 04
Technical details
None of the 60 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 11, 2026, 8:49 AM UTC
- SHA-256
ec184056e6e48232479f4bb33d0b0cf7e8d3bf8091ce327342d67fb11d624f13- SHA-1
310aea32a65c0221d31fef893a06b4fb61a45d0f- MD5
63adca00f88452ae9f5119bcf375d5bd
About this file
download is an HTML file of 26.6 kB.
- Type and size
- HTML · 26.6 kB
- Signer
- Not applicable
- First seen
- Sep 5, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 60 engines flagged this file
15 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-232 engines0flagged
- Low-trust11 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is download safe?
What is download?
How many antivirus engines detected download?
What is the SHA-256 hash of download?
Is it safe to open download?
How up to date is this analysis of download?
Community
Member reviews and reports for this exact file hash.