{
  "family": "filerepmalware",
  "sample_count": 45,
  "category": "trojan",
  "description": "FileRepMalware (identified across endpoint security platforms and telemetry as Win32:FileRepMalware [Trj], FileRepMalware [PUP], and Win64:FileRepMalware) is a widely encountered cloud reputation and heuristic detection signature established by Avast and AVG security engines. Triggered when an executable demonstrates a low prevalence score, lacks recognized digital code-signing certificates, and exhibits behavioral indicators common to trojans, downloaders, or potentially unwanted programs (PUPs), FileRepMalware acts as an automated triage shield against zero-day crimeware. Threats categorized under FileRepMalware span freshly compiled malware droppers, trojanized utility installers, unauthorized cryptocurrency miners, and ad injection stubs that attempt to slip past static signature databases by frequently altering binary hashes.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Win32:FileRepMalware [Trj]",
    "FileRepMalware [PUP]",
    "Win64:FileRepMalware",
    "FileRepMalware",
    "Win32:FileRepMalware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is FileRepMalware in Avast and AVG?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "FileRepMalware (short for File Reputation Malware) is an automated detection tag generated by the cloud reputation engines of Avast, AVG, and related antimalware scanners. Rather than identifying a specific, known virus signature, it flags executable files that are relatively new, rarely encountered in their global telemetry, or lack a trusted digital signature from an established software publisher."
      }
    },
    {
      "@type": "Question",
      "name": "Is FileRepMalware dangerous or safe?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "FileRepMalware is a precautionary warning that a file is suspicious, but it does not definitively prove the file is dangerous. In many cases, it is a false positive triggered when a user downloads a brand-new software release, an indie game patch, or a custom script that hasn't yet built a reputation score. However, because cybercriminals frequently recompile malware binaries to evade signature detection, treat any unrecognized file flagged as FileRepMalware as potentially hazardous until verified."
      }
    },
    {
      "@type": "Question",
      "name": "Is FileRepMalware a false positive?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, FileRepMalware has a relatively high false positive rate compared to traditional signature detections. It commonly triggers on legitimate newly compiled software, internal company utilities, open-source projects, and automated updates that have only been downloaded by a few users worldwide."
      }
    },
    {
      "@type": "Question",
      "name": "How do I know if a FileRepMalware detection is real malware or a false alarm?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Upload the quarantined or flagged file to VirusTotal.com to scan it across 70+ independent antivirus engines. If only Avast and AVG flag it as FileRepMalware while Microsoft Defender, Bitdefender, Kaspersky, and Sophos classify it as clean, it is almost certainly a reputation-based false positive. If multiple vendors flag it with specific trojan or stealer signatures, it is malicious."
      }
    },
    {
      "@type": "Question",
      "name": "How can I safely restore a file blocked as FileRepMalware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "If you have verified the file is clean via VirusTotal, open your antivirus Quarantine (Virus Chest), right-click the blocked executable, select 'Restore and add exception', and submit the file to the vendor's false positive analysis portal so it can be whitelisted for other users."
      }
    },
    {
      "@type": "Question",
      "name": "How does an antivirus engine calculate file reputation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "File reputation engines assess multiple telemetry criteria, including file age (how long the hash has existed on the internet), distribution volume (how many endpoints have downloaded it), download origin (trusted CDN vs. unverified file-sharing host), and the presence of a valid Extended Validation (EV) code-signing certificate."
      }
    },
    {
      "@type": "Question",
      "name": "How can software developers prevent their applications from being flagged as FileRepMalware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Developers should sign all binaries and installers with an EV Code Signing Certificate, establish download volume over time, avoid packing executables with aggressive obfuscators like UPX or Themida, and proactively submit new software builds to major antivirus false positive analysis programs prior to public distribution."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1204.002",
    "T1027",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Bundlers",
    "Untrusted Freeware Portals",
    "Phishing Email Drops"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Rapid Hash Polymorphism",
    "Low-Prevalence Zero-Day Staging",
    "Unsigned Code Execution",
    "Heuristic Evasion Attempts",
    "Background Payload Ingestion"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Unsigned)",
      "x64 Executable"
    ],
    "network_signatures": [
      "Outbound HTTP/HTTPS connections to recently registered domains (NRDs) or dynamic DNS services",
      "Telemetry queries matching heuristic cloud reputation lookups"
    ],
    "evasion_techniques": [
      "Compiling unique binaries per victim to prevent static signature matching",
      "Employing custom packers to mask PE headers and import tables"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "b1c2d3e4f5061728394a5b6c7d8e9f0123456789",
      "c2d3e4f5061728394a5b6c7d8e9f0123456789ab"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FileRepStub"
    ],
    "file_paths": [
      "%Temp%\\unverified_setup.exe",
      "%AppData%\\Local\\Temp\\update_agent.exe"
    ]
  },
  "defensive_measures": [
    "Enable cloud-delivered protection and automatic sample submission in endpoint security tools",
    "Block execution of unsigned executable files downloaded from the Internet using Windows Defender Application Control (WDAC)",
    "Submit suspicious low-reputation binaries to multi-scanner repositories like VirusTotal for consensus evaluation"
  ],
  "sources": [
    {
      "name": "Avast Threat Intelligence - FileRepMalware Detection Overview",
      "url": "https://www.avast.com"
    },
    {
      "name": "AVG Antivirus Knowledgebase - Understanding FileRep Detections",
      "url": "https://www.avg.com"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Win32:FileRepMalware [Trj]",
      "FileRepMalware [PUP]",
      "Win64:FileRepMalware"
    ]
  },
  "motivation": "Automated Heuristic Interception of Low-Reputation Threats",
  "sample_hashes": []
}