File scan report
Verdict Malicious
Is Openworld.
Ten malware-specific YARA matches and runtime persistence, injection, encryption, and destructive-impact mappings outweigh the complete absence of antivirus detections.
Read the whole reasonShow less
Moderate evidence · Few antivirus engines flag it; other checks support the rating.
If you already ran it, follow the steps below.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't run it
Don't run this file. Delete it, then empty the Recycle Bin.
If you already ran it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
If you typed passwords on the device after running it, change them from another device you trust.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 23d ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The executable matched ten malware-specific research rules, including dropper, ransomware, clipboard-stealer, and security-tampering patterns. Evidence from the test run also recorded AppData installation with Run-key persistence and five offensive technique mappings, although 0 of the 71 antivirus engines that checked it flagged it and the sole sandbox verdict was clean.
No antivirus engine flagged the file, and all 17 reporting major antivirus engines were silent. That strong counter-signal is outweighed by ten malware-specific YARA matches spanning dropper, ransomware, clipboard-stealing, anti-analysis, and security-tampering patterns. Evidence from the test run shows the unsigned executable copying itself into AppData and creating a Windows Run key, while mappings include T1055, T1485, T1486, T1547.001, and T1560. The mapping does not identify an injected target, so it is supportive rather than conclusive by itself. All seven observed non-background hosts had complete reputation coverage without a known hostile match, and the single sandbox labeled the run clean, which keeps confidence below the highest range.
What We Detected
None of the 71 antivirus engines that checked it flagged this executable, including the 17 major antivirus engines that returned results. However, external research rules produced 19 matches, ten of which were malware-specific. Those matches included Disable_Defender, FreddyBearDropper, RANSOMWARE, an anti-VM rule, and a Windows clipboard-clipper rule; this breadth of malware-specific matching is the strongest signal in the evidence.
Threat Behavior
The sandbox recorded the unsigned executable writing a copy of itself and updater components beneath the user's AppData directory, then creating Windows Run entries for persistence. The injection mapping names no target process, so it cannot prove a particular injection method. The single sandbox verdict was clean, all seven distinct non-background contacted hosts had no malicious or suspicious cache matches, and none of the dropped files has a saved malicious verdict.
What To Do Now
Do not run or reinstall this executable on a production system. If it has already executed, keep security software enabled, isolate the device, remove the Openworld Run entry only through trusted security or system-administration tools, and perform a full scan while investigating the AppData files it created.
Where this verdict could be wrong4 caveats
- None of the 71 antivirus engines that checked it flagged the executable, including all 17 major antivirus engines that returned results.
- The completed sandbox run labeled the execution clean despite recording several concerning technique mappings.
- All seven distinct non-background contacted hosts were checked, with no malicious or suspicious cache matches.
- The ten dropped files have no saved verdicts, so they neither corroborate nor clear the parent executable.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the executable, including all 17 reporting major antivirus engines.
- The completed sandbox run returned a clean label.
- All seven observed non-background hosts were covered by the reputation check, with no malicious or suspicious matches.
- The executable was not packed and its code section did not show unusually high entropy.
- Ten malware-specific research rules matched, including dropper, ransomware, clipboard-stealer, anti-VM, and security-tampering patterns.
- The unsigned executable copied itself into the user's AppData directory and established automatic startup through Windows Run keys.
- The file was first observed only nine days before analysis and has no established publisher identity.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 22sandbox rule tags
- 2spawned processes
- 6network contacts
- 26filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Set itself to start automatically after a restart.
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Checked whether it was running on a test computer.
Note: Read the user name of the test computer.
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
Not confirmed: Showed activity a sandbox rule links to file encryption; no ransomware behaviour was confirmed.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
Openworld.exe
f9d76ea1f6070b8f736f4c85428c531d9b74557fc7b8422ee23db0788700c6ce
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
Openworld.exe
"C:\Users\<USER>\Desktop\Openworld.exe"
Test run - Evidence 3 of 7: ProcessSeen in the test run
Openworld.exe
"C:\Users\user\Desktop\Openworld.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
updater.log
C:\Users\<USER>\AppData\Roaming\.openworld\updater\updater.log
Test run - Evidence 5 of 7: Written fileSeen in the test run
.Openworld.exe.tmp-8494577
C:\Users\<USER>\AppData\Roaming\.openworld\.Openworld.exe.tmp-8494577
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
core.openworld.pascard.com
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
x2.c.lencr.org
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 22 mapped techniques, every process, file, registry and network entry and 9 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 12, 2026, 11:08 PM UTC
- SHA-256
f9d76ea1f6070b8f736f4c85428c531d9b74557fc7b8422ee23db0788700c6ce- SHA-1
fd7acd922226e70e67c295136142a2559d3b06c9- MD5
2677da5bd8a58b798e700f5503d824ee
About this file
Openworld.exe is a Win32 EXE file of 7.2 MB.
- Type and size
- Win32 EXE · 7.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 3, 2026On VirusTotal.
- Submitted by
- 95 distinct sources
- Packer
- None detected
- Entropy
- 6.48 of 8
First scanned
Includes every engine result (75), 22 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is Openworld.exe malware?
What is Openworld.exe?
How many antivirus engines detected Openworld.exe?
I already downloaded and ran Openworld.exe — what should I do?
How do I remove Openworld.exe?
What kind of malware is Openworld.exe?
What is the SHA-256 hash of Openworld.exe?
How up to date is this analysis of Openworld.exe?
Community
Member reviews and reports for this exact file hash.