You are right to be suspicious. The file gets flagged by 3 out of 70 scanners[0], and there are some "execution parents" (files that create the file being studi

You are right to be suspicious. The file gets flagged by 3 out of 70 scanners[0], and there are some "execution parents" (files that create the file being studied upon execution in a sandbox environment, see the relations tab) that are flagged by more scanners. I first thought this was a honeypot, but it looks like plain old malware. [0]: https://www.virustotal.com/gui/file/84dab96a11da002f640ba371f218c49fc3c13d192b9ffbae63cea45bf572ef2d/detection https://www.virustotal.com/gui/file/84dab96a11da002f640ba371...