File scan report
Verdict Suspicious
Is Valheim
Four of the 69 antivirus engines that checked it flagged this unsigned editor, while major antivirus engines stayed silent and evidence from the test run showed only an…
Read the whole reasonShow less
Why Suspicious? 4 antivirus engines flag it, but no major engine agrees; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Avoid normal execution until the exact hash is verified through a trusted source. Keep security software enabled and use isolation if further testing is required.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
4 of 69 flagged
- Flagged 4
- No detection 65
- No result 6
- Code signing Unsigned
- Test run Completed
- First seen 29d ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The evidence is mixed: four of the 69 antivirus engines that checked it raised generic or behavioral alerts, but no major antivirus engines identified malware or agreed on a family. One sandbox mapped possible process injection without naming a target, while its overall run was clean and observed network contacts were background traffic.
Four of the 69 antivirus engines that checked it flagged the executable, but the detections came from two smaller and two less reliable products, with no major family consensus. The unsigned file has no verified publisher or established signer history, which limits the reassurance available for a relatively recent executable. The test run mapped T1055, but it identified no injected process and the sole sandbox verdict was clean. The apparent network contacts were attributed to the analysis environment, and the complete host check found no cached malicious or suspicious host. External intelligence produced no malware-specific rule, malware repository, or malicious file it created corroboration. These competing signals support caution without establishing a named malware family.
What We Detected
Four of the 69 antivirus engines that checked it flagged the executable. Skyhigh used a behavioral backdoor label, Zillya used a generic Trojan label, and two less reliable engines supplied nonspecific malware detections. No major antivirus engines flagged it, and there was no agreement on a malware family.
Threat Behavior
The completed sandbox run mapped possible process injection to MITRE T1055, but it did not identify an injected target process and returned an overall clean result. The listed domain and IP were explicitly attributed to sandbox background traffic rather than the sample. The host-reputation check covered that distinct background host and found no cached malicious or suspicious result.
What To Do Now
Do not run the file on an important system until its origin and checksum can be verified against a trusted release channel. Keep security software enabled; if testing is necessary, use an isolated virtual machine with no valuable accounts, saves, or personal data.
Where this verdict could be wrong3 caveats
- The only completed sandbox run returned a clean verdict and identified no injected process.
- The observed domain and IP were marked as sandbox background traffic, not sample-generated communication.
- The file is unsigned and only moderately prevalent, so the limited detections cannot be dismissed as a publisher-associated false positive.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No major antivirus engines flagged the file.
- The sole completed sandbox run returned a clean result.
- Observed network contacts were identified as analysis-environment background traffic.
- No malware-specific researcher rules or malware repository match corroborated the detections.
- No inspected file it created had a saved malicious result.
- The executable is unsigned and has no established publisher history.
- Four antivirus engines raised malware or backdoor-style alerts.
- The test run mapped possible process injection, although no target process was identified.
- The file was first observed on Sep 26, 2026 and has limited distribution.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 14sandbox rule tags
- 2spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Note: Read the user name of the test computer.
Note: Listed the programs running on the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
ValheimCharacterEditor.exe
ef42dc9a97b82530a7eec118f5354fd28402d43ec73d103757677903167de462
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
ValheimCharacterEditor.exe
"C:\Users\<USER>\Desktop\ValheimCharacterEditor.exe"
Test run - Evidence 3 of 5: ProcessSeen in the test run
ValheimCharacterEditor.exe
"C:\Users\user\Desktop\ValheimCharacterEditor.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
VCRUNTIME140.dll
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\VCRUNTIME140.dll
Test run - Evidence 5 of 5: Written fileSeen in the test run
_bz2.pyd
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_bz2.pyd
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 14 mapped techniques, every process, file, registry and network entry and 1 dropped file.
Show the technical evidenceChapter 04
Technical details
4 of the 69 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 4
- APEXMalicious
- BkavW32.Malware.8D6FBE49
- SkyhighBehavesLike.Win64.Backdoor.vc
- ZillyaTrojan.Blank.Script.2228
File fingerprint
- Last analyzed
- Oct 13, 2026, 2:15 PM UTC
- SHA-256
ef42dc9a97b82530a7eec118f5354fd28402d43ec73d103757677903167de462- SHA-1
833656bcd3725c1c897c2e704fc12ffbcfae6c54- MD5
adec401d5c87f5d6c747b72253c80b3a
About this file
ValheimCharacterEditor.exe is a Win32 EXE file of 11.5 MB.
- Type and size
- Win32 EXE · 11.5 MB
- Signer
- UnsignedNo code signature.
- First seen
- Sep 26, 2026On VirusTotal.
- Submitted by
- 9 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 6.40 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ValheimCharacterEditor.exe safe, or is it malware?
What is ValheimCharacterEditor.exe?
How many antivirus engines detected ValheimCharacterEditor.exe?
I already downloaded and ran ValheimCharacterEditor.exe — what should I do?
What is the SHA-256 hash of ValheimCharacterEditor.exe?
How up to date is this analysis of ValheimCharacterEditor.exe?
Community
Member reviews and reports for this exact file hash.