File verdict·Decided by the MT AI Engine
Our call

Safe

Widely submitted plain-text AutoHotkey script with zero engine detections and clean researcher annotations.

Trust score92High trust
V1.2_nosave.ahk
859 B
f0d65e1672e61cd50f95d047d022
Antivirus engines
0 of 74 flagged
Code signing
Unsigned
Age
First seen 2y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

90%Confidence
Very high
Reasoning

Zero malicious detections across tier-1 and tier-2 engines combined with common_old prevalence and explicit clean community annotations indicate the file is benign. The absence of signing, sandbox data, or external-intel hits does not raise concern given the file type and submission history. No heuristics fired and no adversarial filename signals were present.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines: 0 malicious out of 74 total (tier1Malicious=0)

  2. prevalence.classification=common_old (3654 uniqueSources)

  3. externalIntel.yaraify.ruleCount=0

  4. communityComments[0].text contains explicit 'Verdict: Clean'

  5. filenameAnalysis.hasNumericVersion=true

Points in its favour
  • Zero engine detections across all tiers
  • Common_old prevalence with thousands of submissions
  • Explicit clean annotations from researchers
What to do

Treat as safe; no further action required unless the script exhibits unexpected behaviour at runtime.

No researcher-database hits
External threat-intel sources were not collected for this scan.
Antivirus engine breakdown

0 detections across 74 engines

0 malicious0 suspicious74 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-240 engines
0flag
Mainstream engines with mixed FP rates
Low-trust17 engines
0flag
Heuristic / generic-AI engines (high FP rate)
All 74 engines report this file as clean.
Hash f0d65e1672e6… cross-referenced against 74 AV engines via our AV network.
Prevalence

How often this file shows up in the wild

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old
Unique uploaders
3,654
Hundreds of people have uploaded this — common.
Total submissions
8,200
Includes repeat uploads by the same source.
First seen by VT
2y ago
Dec 23, 2024
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
here
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
12/23/2024, 1:23:14 PM
First seen (MalwareBazaar)
Last analysis (VT)
7/9/2026, 5:13:30 PM
Scanned here
7/10/2026, 9:24:45 PM
File name
V1.2_nosave.ahk
Size
859 B
MIME type
(unknown)
Detected type
Text
SHA-256
f0d65e1672e61cd50f9ea142ebfec61596ec2c4eed46ed3f3e011895d047d022
MD5
5cffe999f36e96f2f72b3999ab6269ec
SHA-1
a5468fb5e1754986920c32d0654faa25b8a429c2
First seen (VT)
12/23/2024, 1:23:14 PM
Last analysis (VT)
7/9/2026, 5:13:30 PM
First scan (MalwareTips)
7/10/2026, 9:24:45 PM
Last scan (MalwareTips)
7/10/2026, 9:24:45 PM
Behavior tags
text
Frequently asked

Safety FAQ

Common questions about V1.2_nosave.ahk, answered from the scan data above.

  • V1.2_nosave.ahk appears safe. 74 of 74 antivirus engines report it clean. As a habit, only open files you downloaded from the official source, since attackers sometimes distribute trojanised copies of legitimate software under the same name.
  • V1.2_nosave.ahk is a file, about 859 bytes. Our analysis found no threat indicators for it. A file's name can be reused by different files, so we identify it by its cryptographic hash (below).
  • None — all 74 antivirus engines we queried report V1.2_nosave.ahk as clean. That's reassuring, though brand-new malware can briefly evade detection before vendors add signatures, so we also weigh the file's behaviour and reputation.
  • The SHA-256 hash of V1.2_nosave.ahk is f0d65e1672e61cd50f9ea142ebfec61596ec2c4eed46ed3f3e011895d047d022, and its MD5 is 5cffe999f36e96f2f72b3999ab6269ec. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
  • Based on this scan, yes — V1.2_nosave.ahk shows no threat indicators. The important caveat is source: make sure you downloaded it from the official website or a trusted store, because attackers sometimes distribute malware-laced copies under a legitimate file's name. If your own antivirus flags it while we report it clean, that is most often a false positive, but verify the source before overriding your antivirus.
  • This report reflects the scan run on July 10, 2026. Because a file's hash never changes, the identity of V1.2_nosave.ahk is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.