File scan report
Verdict Safe
Is You
No antivirus engine detected this unsigned portable executable, and one sandbox run produced no offensive behavior, malicious verdict, persistence, or network contacts.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 67 flagged
- Flagged 0
- No detection 67
- No result 8
- Code signing Unsigned
- Test run Completed
- First seen 9mo ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 67 antivirus engines that checked it were free of detections, including 17 reporting major antivirus engines. One completed sandbox run produced no malicious verdict, high-risk technique, persistence indicator, or contacted domain, although the missing signature and unavailable host-reputation cross-check warrant ordinary caution about download provenance.
The strongest evidence is the complete absence of detections across 75 antivirus engines, with all 17 reporting major antivirus engines also silent. One sandbox run recorded routine system activity but no high-risk techniques, malicious sandbox verdict, persistence indicator, or network contact. Research feeds provided no matching YARA rules or known-malicious record. The executable is unsigned, so its claimed origin cannot be authenticated, and no complete contacted-host reputation result is available. Two import-table fingerprint-only historical matches disagree and lack a matching signer, making them weak evidence because common build frameworks can share import-table fingerprint.
What We Detected
None of the 67 antivirus engines that checked it flagged the executable, and all 17 reporting major antivirus engines returned no detection. Research intelligence also produced no YARAify, MalwareBazaar, or CIRCL match.
Threat Behavior
One completed sandbox run recorded 18 system techniques common in legitimate software but no high-risk techniques, malicious sandbox verdict, persistence indicator, contacted domain, IP address, or URL. The executable wrote temporary files, which is common for portable or self-extracting applications. A complete contacted-host reputation check was not available, although the observed run contained no network contacts to inspect.
What To Do Now
The main limitation is that the executable is unsigned, so its publisher cannot be verified. Obtain it from the developer's official release channel, retain security software, and avoid running copies from advertisements, mirrors, or bundled download sites.
Where this verdict could be wrong4 caveats
- Code signing applies to this file type but the file is unsigned, so no verified publisher identity supports the executable.
- The file carries the tags 'overlay' and 'corrupt', although no code section has packed-level entropy and the file does not appear packed.
- No contacted-host reputation result was saved, so no completed host-reputation cross-check is available.
- similarHashes[0].verdict='suspicious' for the same import-table fingerprint, but signerMatchesSubject=false and the filename and publisher context differ.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/67 antivirus engines reported a detection.
- All 17 reporting major antivirus engines returned no detection.
- One sandbox run produced no malicious verdict or high-risk technique.
- No persistence indicators or observed network contacts were recorded.
- YARAify, MalwareBazaar, and CIRCL returned no hits.
- The Win32 executable is unsigned, preventing publisher verification.
- The file metadata includes the tags 'overlay' and 'corrupt'.
- No complete contacted-host reputation result is available.
- Historical import-table fingerprint matches are mixed and do not share a signer.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 18sandbox rule tags
- 1spawned processes
- 0network contacts
- 6filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
18MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1045
- T1056.001· Keylogging
- T1059· Runs commands
- T1063
- T1070.004· Covers its tracks
- T1082· System recon
- T1083· Scans your files
- T1112
- T1115
- T1125
- T1129· Loads modules
- T1140· Deobfuscation
- T1222
- T1529
- T1547.009· Auto-start
Observed activity
Processes started
1Programs the file ran, with their command lines.
YouTubeToMP3Portable.exe"C:\Users\<USER>\Desktop\YouTubeToMP3Portable.exe"
Files
5Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nsgC063.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsc96F3.tmp - Written
C:\Users\user\AppData\Local\Temp\nsbC63C.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsm96E2.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsgC5BE.tmp
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
Local\MSCTF.Asm.MutexDefault1
Chapter 04
Technical details
None of the 67 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 10, 2026, 2:57 AM UTC
- SHA-256
f2b367bc697df9a0d1c106fd129d915a45870478a6bd2996154a69c706f30e74- SHA-1
23a8156c9bfc9763cf39a80a7721db7f2b496cb3- MD5
493555c748d4480b967e3b162aa14202
About this file
YouTubeToMP3Portable.exe is a Win32 EXE file of 145.4 kB.
- Type and size
- Win32 EXE · 145.4 kB
- Signer
- UnsignedNo code signature.
- First seen
- Jan 28, 2026On VirusTotal.
- Submitted by
- 16 distinct sources
- Packer
- None detected
- Entropy
- 7.96 of 8
First scanned
Antivirus consensus
0 of 67 engines flagged this file
8 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-234 engines0flagged
- Low-trust16 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaNo result
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32No result
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is YouTubeToMP3Portable.exe safe?
What is YouTubeToMP3Portable.exe?
How many antivirus engines detected YouTubeToMP3Portable.exe?
What is the SHA-256 hash of YouTubeToMP3Portable.exe?
Is it safe to run YouTubeToMP3Portable.exe?
How up to date is this analysis of YouTubeToMP3Portable.exe?
Community
Member reviews and reports for this exact file hash.