File scan report
Verdict Suspicious
Is Valheim
Four of the 69 antivirus engines that checked it flagged this unsigned editor, while major antivirus engines stayed silent and evidence from the test run showed only an…
Read the whole reasonShow less
Why Suspicious? 4 antivirus engines flag it, but no major engine agrees; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Avoid normal execution until the exact hash is verified through a trusted source. Keep security software enabled and use isolation if further testing is required.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
4 of 69 flagged
- Flagged 4
- No detection 65
- No result 6
- Code signing Unsigned
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The evidence is mixed: four of the 69 antivirus engines that checked it raised generic or behavioral alerts, but no major antivirus engines identified malware or agreed on a family. One sandbox mapped possible process injection without naming a target, while its overall run was clean and observed network contacts were background traffic.
Four of the 69 antivirus engines that checked it flagged the executable, but the detections came from two smaller and two less reliable products, with no major family consensus. The unsigned file has no verified publisher or established signer history, which limits the reassurance available for a relatively recent executable. The test run mapped T1055, but it identified no injected process and the sole sandbox verdict was clean. The apparent network contacts were attributed to the analysis environment, and the complete host check found no cached malicious or suspicious host. External intelligence produced no malware-specific rule, malware repository, or malicious file it created corroboration. These competing signals support caution without establishing a named malware family.
What We Detected
Four of the 69 antivirus engines that checked it flagged the executable. Skyhigh used a behavioral backdoor label, Zillya used a generic Trojan label, and two less reliable engines supplied nonspecific malware detections. No major antivirus engines flagged it, and there was no agreement on a malware family.
Threat Behavior
The completed sandbox run mapped possible process injection to MITRE T1055, but it did not identify an injected target process and returned an overall clean result. The listed domain and IP were explicitly attributed to sandbox background traffic rather than the sample. The host-reputation check covered that distinct background host and found no cached malicious or suspicious result.
What To Do Now
Do not run the file on an important system until its origin and checksum can be verified against a trusted release channel. Keep security software enabled; if testing is necessary, use an isolated virtual machine with no valuable accounts, saves, or personal data.
Where this verdict could be wrong3 caveats
- The only completed sandbox run returned a clean verdict and identified no injected process.
- The observed domain and IP were marked as sandbox background traffic, not sample-generated communication.
- The file is unsigned and only moderately prevalent, so the limited detections cannot be dismissed as a publisher-associated false positive.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No major antivirus engines flagged the file.
- The sole completed sandbox run returned a clean result.
- Observed network contacts were identified as analysis-environment background traffic.
- No malware-specific researcher rules or malware repository match corroborated the detections.
- No inspected file it created had a saved malicious result.
- The executable is unsigned and has no established publisher history.
- Four antivirus engines raised malware or backdoor-style alerts.
- The test run mapped possible process injection, although no target process was identified.
- The file was first observed on Sep 26, 2026 and has limited distribution.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 14sandbox rule tags
- 2spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Note: Read the user name of the test computer.
Note: Listed the programs running on the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
ValheimCharacterEditor.exe
ef42dc9a97b82530a7eec118f5354fd28402d43ec73d103757677903167de462
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
ValheimCharacterEditor.exe
"C:\Users\<USER>\Desktop\ValheimCharacterEditor.exe"
Test run - Evidence 3 of 5: ProcessSeen in the test run
ValheimCharacterEditor.exe
"C:\Users\user\Desktop\ValheimCharacterEditor.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
VCRUNTIME140.dll
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\VCRUNTIME140.dll
Test run - Evidence 5 of 5: Written fileSeen in the test run
_bz2.pyd
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_bz2.pyd
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
14MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1497· Sandbox evasion
- T1518· Checks your AV
- T1574· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
ValheimCharacterEditor.exe"C:\Users\<USER>\Desktop\ValheimCharacterEditor.exe"ValheimCharacterEditor.exe"C:\Users\user\Desktop\ValheimCharacterEditor.exe"
Files
15Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\VCRUNTIME140.dll - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_bz2.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_decimal.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_hashlib.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_lzma.pyd - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_socket.pyd
Show all 15 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_tcl_data\auto.tcl - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_tcl_data\clock.tcl - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_tcl_data\encoding\ascii.enc - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_tcl_data\encoding\big5.enc - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_tcl_data\encoding\cns11643.enc - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_tcl_data\encoding\cp1250.enc - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_tcl_data\encoding\cp1251.enc - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_tcl_data\encoding\cp1252.enc - Written
C:\Users\<USER>\AppData\Local\Temp\_MEI000013342\_tcl_data\encoding\cp1253.enc
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM host
a1672.dscr.akamai.net - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 76f6bc85fc9cb89bc3f9…5415eaNot checkedno saved verdict
Chapter 04
Technical details
4 of the 69 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 4
- APEXMalicious
- BkavW32.Malware.8D6FBE49
- SkyhighBehavesLike.Win64.Backdoor.vc
- ZillyaTrojan.Blank.Script.2228
File fingerprint
- Last analyzed
- Oct 13, 2026, 2:15 PM UTC
- SHA-256
ef42dc9a97b82530a7eec118f5354fd28402d43ec73d103757677903167de462- SHA-1
833656bcd3725c1c897c2e704fc12ffbcfae6c54- MD5
adec401d5c87f5d6c747b72253c80b3a
About this file
ValheimCharacterEditor.exe is a Win32 EXE file of 11.5 MB.
- Type and size
- Win32 EXE · 11.5 MB
- Signer
- UnsignedNo code signature.
- First seen
- Sep 26, 2026On VirusTotal.
- Submitted by
- 9 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 6.40 of 8
First scanned
Antivirus consensus
4 of 69 engines flagged this file
6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-236 engines2flagged
- Low-trust16 engines2flagged
View all 75 engine results
- APEXMalicious: Malicious
- BkavMalicious: W32.Malware.8D6FBE49
- SkyhighMalicious: BehavesLike.Win64.Backdoor.vc
- ZillyaMalicious: Trojan.Blank.Script.2228
- AcronisClean
- AhnLab-V3No result
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroNo result
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ValheimCharacterEditor.exe safe, or is it malware?
What is ValheimCharacterEditor.exe?
How many antivirus engines detected ValheimCharacterEditor.exe?
I already downloaded and ran ValheimCharacterEditor.exe — what should I do?
What is the SHA-256 hash of ValheimCharacterEditor.exe?
How up to date is this analysis of ValheimCharacterEditor.exe?
Community
Member reviews and reports for this exact file hash.