File scan report
Verdict Suspicious
Is Art
Two of the 64 antivirus engines that checked it raised generic infostealer alerts, but major antivirus engines, sandbox execution, external intelligence, and file it created…
Read the whole reasonShow less
Why Suspicious? 2 antivirus engines flag it, but no major engine agrees; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 64 flagged
- Flagged 2
- No detection 62
- No result 11
- Code signing Unsigned
- Test run Completed
- First seen 14d ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Malwarebytes and McAfeeD flagged this unsigned, recently observed Electron-style executable, but neither alert has major or family consensus. The completed sandbox run found no malicious verdict, and external intelligence and inspected file it created results did not corroborate infostealing, leaving a plausible false-positive scenario but insufficient assurance for unrestricted use.
Only 2 of the 64 antivirus engines that checked it flagged the sample, with no major detections or agreed malware family. Malwarebytes supplied a generic Electron infostealer label, while McAfeeD used a hash-style label; similar generic detections have been reported as false positives for Electron/NSIS installers. One sandbox run completed without a malicious verdict, and its recorded contacts were identified as analysis-environment background rather than sample traffic. is a noteworthy token-manipulation mapping, but no injected process, malicious child, malware-specific YARA rule, or known-malicious intelligence match corroborates it. The executable is nevertheless unsigned, only three days old in the dataset, and lacks established publisher history, so the two alerts cannot be dismissed outright. Import-table fingerprint-only history is mixed and does not establish identity because every match lacks a matching signer.
What We Detected
Two of the 64 antivirus engines that checked it raised alerts. Malwarebytes used a generic Electron infostealer label, while McAfeeD produced a hash-based generic detection; no major antivirus engines flagged the file and no engine consensus identified a specific family. Comparable Electron/NSIS installer detections have appeared in Malwarebytes false-positive reports, which increases the possibility that installer packaging triggered the alert.
Threat Behavior
One completed sandbox run returned clean. T1134 was mapped as the only offensive technique, but no process injection target, persistence indicator, malicious child verdict, or sample-attributed network contact was observed. The listed domain and IP were explicitly identified as analysis-environment background traffic, not file activity. Ten dropped files lack saved verdicts, so they remain unclassified rather than cleared.
What To Do Now
Do not run the executable on a primary system until its origin can be independently verified. Obtain it from the developer's official release channel, compare the SHA-256 value, and request a signed build or publisher confirmation; keep security software enabled. If testing is necessary, use an isolated disposable environment without sensitive accounts or data.
Where this verdict could be wrong3 caveats
- The completed sandbox run returned clean and did not show process injection or sample-attributed network activity.
- No MalwareBazaar match, malware-specific YARA rule, malicious file it created, packing indicator, or high-entropy code corroborated the infostealer label.
- Fifteen major antivirus engines returned no detection, and no major antivirus engines identified a malware family.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No major antivirus engines flagged the file; 15 major antivirus engines returned no detection.
- The completed sandbox run did not produce a malicious verdict or identify injected processes.
- Recorded network contacts were analysis-environment background traffic rather than activity attributed to the sample.
- No MalwareBazaar match or malware-specific YARA rule was found.
- No inspected child had a saved malicious verdict, and the antivirus analysis found neither packing nor high-entropy code.
- The executable is unsigned and has no established publisher history.
- Malwarebytes raised a generic Electron infostealer detection, and McAfeeD independently flagged the hash.
- The file was first observed on Oct 12, 2026 and has limited submission history.
- Sandbox analysis mapped token manipulation, although it did not identify a target process or corroborating attack chain.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 19sandbox rule tags
- 1spawned processes
- 0network contacts
- 19filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as setting up auto-start; no auto-start entry was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 4: FileSeen in the test run
ArtCraft-v0.41.0.exe
f47d9bf81d7446110421ec6b79e6934be3a715d219dcb41cb05a550c72de5f96
Uploaded file
- 1
Processes
What ran
- Evidence 2 of 4: ProcessSeen in the test run
ArtCraft-v0.41.0.exe
"C:\Users\user\Desktop\ArtCraft-v0.41.0.exe"
Test run
- 2
Files
Created or changed
- Evidence 3 of 4: Written fileSeen in the test run
System.dll
C:\Users\<USER>\AppData\Local\Temp\nsiCDD1.tmp\System.dll
Test run - Evidence 4 of 4: Written fileSeen in the test run
app-64.7z
C:\Users\<USER>\AppData\Local\Temp\nsiCDD1.tmp\app-64.7z
Test run - +1 more recorded observation
4 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 19 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
2 of the 64 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
- MalwarebytesSpyware.InfoStealer.Electron.Generic
- McAfeeDti!F47D9BF81D74
File fingerprint
- Last analyzed
- Oct 15, 2026, 9:25 AM UTC
- SHA-256
f47d9bf81d7446110421ec6b79e6934be3a715d219dcb41cb05a550c72de5f96- SHA-1
d3a722cef340e24e91e30ef84f09e39146f31524- MD5
9ef3c8c8b05b7cafaad22e3859a5a8bc
About this file
ArtCraft-v0.41.0.exe is a Win32 EXE file of 72.6 MB.
- Type and size
- Win32 EXE · 72.6 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 12, 2026On VirusTotal.
- Submitted by
- 4 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.91 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ArtCraft-v0.41.0.exe safe, or is it malware?
What is ArtCraft-v0.41.0.exe?
How many antivirus engines detected ArtCraft-v0.41.0.exe?
What should I do if I already ran ArtCraft-v0.41.0.exe?
What is the SHA-256 hash of ArtCraft-v0.41.0.exe?
How up to date is this analysis of ArtCraft-v0.41.0.exe?
Community
Member reviews and reports for this exact file hash.
