File scan report
Verdict Safe
Is artmoney821eng64.
Only Skyhigh flagged this executable generically; major antivirus engines, completed sandbox runs, and external intelligence supplied no corroborating malicious evidence.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 71 flagged
- Flagged 1
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 18d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Skyhigh alone flagged the file with a generic dropper-style label, while none of the major antivirus engines did. Four completed sandbox runs produced no malicious verdict, named injection target, persistence, or sample-attributed network contact, so the isolated detection is most consistent with a false positive.
Only 1 of the 71 antivirus engines that checked it flagged the executable, and the detection was Skyhigh's generic behavior label rather than a named malware family. None of the major antivirus engines flagged it, and independent detections did not corroborate the result. Four completed sandbox runs returned no malicious verdict and recorded neither a named injection target nor persistence or sample-attributed network contact. The mapping lacked the target artifact needed to establish process injection and therefore carries no adverse weight. The executable is unsigned and protected with .NET Reactor, which lowers confidence, but no malware-specific intelligence or malicious child supports the lone alert.
What We Detected
Skyhigh was the only engine to flag the executable, using a generic dropper-behavior label. None of the major antivirus engines flagged it, and no engine identified a real malware family. The executable is unsigned and protected with .NET Reactor, which can make automated inspection harder but is not proof of harmful code.
Threat Behavior
Four completed sandbox runs produced no malicious verdict. They recorded no named injection target, persistence indicator, or sample-attributed network contact. No malware-specific community rule, public sample-database listing, or malicious dropped file corroborated Skyhigh's result. A complete host-reputation cross-check was not available.
What To Do Now
If the executable came from the expected publisher channel, it can be used with normal caution while security software remains enabled. If its origin is uncertain, obtain a fresh copy from the official source and compare its SHA-256 before running it.
Where this verdict could be wrong3 caveats
- Skyhigh's generic dropper-style detection is a meaningful warning even though no other engine corroborates it.
- The executable is unsigned and protected with .NET Reactor, which limits static visibility and prevents publisher verification.
- No complete contacted-host reputation result is available, although the sandbox runs recorded no sample-attributed contacts.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the major antivirus engines flagged the file.
- Four completed sandbox runs produced no malicious verdict or corroborated high-risk behavior.
- No sample-attributed network contact or persistence was observed during the test run.
- No malware-specific rule or public malware-sample database matched the hash.
- The inspected dropped file was not identified as malicious or suspicious.
- One antivirus engine reported generic dropper-like behavior.
- The executable has no authenticated publisher signature.
- The code is protected with .NET Reactor, reducing transparency to automated inspection.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 10sandbox rule tags
- 5spawned processes
- 0network contacts
- 17filesystem & mutex artifacts
Includes the sandbox verdicts, 10 mapped techniques, every process, file, registry and network entry and 1 dropped file.
Show the technical evidenceChapter 04
Technical details
1 of the 71 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- SkyhighBehavesLike.Win32.Dropper.tc
File fingerprint
- Last analyzed
- Oct 19, 2026, 4:40 PM UTC
- SHA-256
f293402c2a995996518a9681255b26a8f7f723f02f4d4ff631606b84dcdfd48c- SHA-1
5f3c0e21ae54922a8e2fa497114d6fd18046d922- MD5
62f9a42934af26402f2f377348c30e29
About this file
artmoney821eng64.exe says it is ArtMoney SE v8.21.3 (ArtMoney SE), 5.5 MB.
- Claims to be
- ArtMoney SE v8.21.3 (ArtMoney SE)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 5.5 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 7, 2026On VirusTotal.
- Submitted by
- 58 distinct sources
- Packer
- .NET Reactor 2.X-3.X (DetectItEasy protector)Packing hides code; legitimate installers use it too.
- Entropy
- 6.33 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is artmoney821eng64.exe safe?
What is artmoney821eng64.exe?
How many antivirus engines detected artmoney821eng64.exe?
What is the SHA-256 hash of artmoney821eng64.exe?
Is it safe to run artmoney821eng64.exe?
How up to date is this analysis of artmoney821eng64.exe?
Community
Member reviews and reports for this exact file hash.