Report Malware and Suspicious Links here so Mods can take Action !

[$crypto$]

Fake Freezium thread --- possible hacked account then spreading danger Github link.

Account: AleScamHole This user recently woke up from a long period of inactivity. please ban
Fake ANN: [ANN] Freezium | POW

Code:

[size=12pt]https://github.com/perlmine1/Frizium-dev/releases/download/1.1.0/Freezium-win64-v.1.1.0.zip[/size]

Virustotal: https://www.virustotal.com/gui/file/87c93233925ec133cfd749a058e8f255e9ed7955d9e90ee63afd7e5d79fec3d8/detection

[AakZaki]

Data from VirusTotal and Hybrid Analysis state that this .exe file is malicious:


Account: ArqTras<= Please Banned
Fake ANN Thread: [ANN][PDC] Privacy Data Coin — confidential transfers by default

Code:

[size=14pt][b]Wallets and source[/b][/size]
Desktop wallet, daemon, and simplewallet are published as the latest GitHub release. GUI archives are the desktop wallet. CLI archives are the daemon and simplewallet.

https://github.com/PrivacyDataCoin-Project/PDC/releases/latest
https://github.com/PrivacyDataCoin-Project/PDC/releases/download/v2.3.0/Pdc-Gui-v2.3.0-windows.exe

VirusTotal: 3/62 security vendors flagged this file as malicious, and there is a Potential Raspberry Robin

VirusTotal Scan Result: https://www.virustotal.com/gui/file/1235174c2a233e7d1d9bba079af8ff66fda471eb4e2fd85549452776c10c7ad5/detection

Raspberry Robin : https://redcanary.com/threat-detection-report/threats/raspberry-robin/

Hybrid Analysis: 1/23 security vendors flagged this file as malicious, and there are several malicious indicators

Code:

Anti-Detection/Stealthiness (1)
Creates a process in suspended mode (likely for process injection)

Details "Pdc-Gui-v2.3.0-windows.tmp" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Pdc\Pdc.exe"" - (UID: 00000000-00002416)
Source API Call
Relevance 10/10
-------------------------------------------------------------------

Installation/Persistence (1)
Writes data to a remote process

Details "Pdc-Gui-v2.3.0-windows.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-4IWQ1RG74B.tmp\Pdc-Gui-v2.3.0-windows.tmp" (Handle: 600)
"Pdc-Gui-v2.3.0-windows.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-4IWQ1RG74B.tmp\Pdc-Gui-v2.3.0-windows.tmp" (Handle: 600)
"Pdc-Gui-v2.3.0-windows.tmp" wrote 000011C0 bytes to a remote process "C:\Program Files\Pdc\vc_redist.x64.exe" (Handle: 1724)
"Pdc-Gui-v2.3.0-windows.tmp" wrote 00000008 bytes to a remote process "C:\Program Files\Pdc\vc_redist.x64.exe" (Handle: 1724)
"Pdc-Gui-v2.3.0-windows.tmp" wrote 000011C0 bytes to a remote process "C:\Program Files\Pdc\Pdc.exe" (Handle: 1620)
"Pdc-Gui-v2.3.0-windows.tmp" wrote 00000008 bytes to a remote process "C:\Program Files\Pdc\Pdc.exe" (Handle: 1620)
"Pdc-Gui-v2.3.0-windows.tmp" wrote 000011C0 bytes to a remote process "C:\Program Files\Pdc\Pdc.exe" (Handle: 1992)
"Pdc-Gui-v2.3.0-windows.tmp" wrote 00000008 bytes to a remote process "C:\Program Files\Pdc\Pdc.exe" (Handle: 1992)
"vc_redist.x64.exe" wrote 000011C0 bytes to a remote process "C:\Windows\Temp\{705BD475-C14C-4D38-B852-F84CFF9BF8EB}\.cr\vc_redist.x64.exe" (Handle: 684)
"vc_redist.x64.exe" wrote 00000008 bytes to a remote process "C:\Windows\Temp\{705BD475-C14C-4D38-B852-F84CFF9BF8EB}\.cr\vc_redist.x64.exe" (Handle: 684)
Source API Call
Relevance 6/10
-------------------------------------------------------------------

Unusual Characteristics (1)
Spawns many processes

Details Spawned process "Pdc-Gui-v2.3.0-windows.exe" (UID: 00000000-00007280)
Spawned process "Pdc-Gui-v2.3.0-windows.tmp" with commandline "/SL5="$50308
100915460
893952
C:\\Pdc-Gui-v2.3.0-windows.exe"" (UID: 00000000-00002416)
Spawned process "vc_redist.x64.exe" with commandline "/install /quiet /norestart" (UID: 00000000-00008044)
Spawned process "vc_redist.x64.exe" with commandline "-burn.clean.room="%PROGRAMFILES%\\Pdc\\vc_redist.x64.exe" -burn.filehandle.attached=680 -burn.filehandle.self=672 /install /quiet /norestart" (UID: 00000000-00004080)
Spawned process "Pdc.exe" (UID: 00000000-00005488)
Spawned process "Pdc.exe" (UID: 00000000-00001768)
Source Monitored Target
Relevance 8/10

Hybrid Analysis Scan Result: https://hybrid-analysis.com/sample/1235174c2a233e7d1d9bba079af8ff66fda471eb4e2fd85549452776c10c7ad5

[AakZaki]

Data from VirusTotal and Hybrid Analysis state that this .exe file is Suspicious:


Account: feelcoin-dev<= Please Banned
Fake ANN Thread: [ANN] [FEEL] Feelcoin | RandomX PoW | CPU Mining | Independent Blockchain

Code:

[b]Feelcoin v0.2.0[/b]

[url=https://github.com/feelcoin-org/feelcoin/releases/tag/v0.2.0]Download Feelcoin v0.2.0[/url]

https://github.com/feelcoin-org/feelcoin/releases/download/v0.2.0/feelcoin-v0.2.0-windows-x64.zip

VirusTotal: 21/71 security vendors flagged this file as malicious


VirusTotal Scan Result: https://www.virustotal.com/gui/file/44c73fb4a5411065cc6686b903a804ae25fe85e7c5a1931577251f773b345521/detection

Hybrid Analysis: 3/27 security vendors flagged this file as malicious


Suspicious Indicators:

Code:

Anti-Detection/Stealthiness (1)
File exhibits characteristics of junk code obfuscation

DetailsSection ".text" unusually large (16999136 bytes)
possible junk padding
Source Static Parser
Relevance 3/10
---------------------------------------------------
Anti-Reverse Engineering (1)
Section contains high entropy

Details "feelcoind.exe" has section name .rodata with entropy "7.755655339919864"
Source Static Parser
Relevance 1/10
---------------------------------------------------
Network Related (1)
Process binds to unusual ports

Details Process "C:\feelcoind.exe" binds to port 35780
Process "C:\feelcoind.exe" binds to port 35781
Process "C:\feelcoind.exe" binds to port 35782
Source Network Traffic
Relevance 10/10
---------------------------------------------------
Pattern Matching (3)
YARA signature match – Detect ransom note

Details YARA signature for detecting ransom note matched on process "00000000-00000916"
YARA signature for detecting ransom note matched on file "sample.bin"
Source YARA Signature
Relevance 10/10

YARA signature match - ChaCha20 encryption algorithm

Details YARA signature for ChaCha20 256-bit key algorithm matched on file "sample.bin"
YARA signature for ChaCha20 128-bit key algorithm matched on file "sample.bin"
Source YARA Signature
Relevance 9/10

YARA signature match – cryptographic algorithms

Details YARA signature matched on Chacha20 instruction used in file "sample.bin"
Source YARA Signature
Relevance 1/10
---------------------------------------------------
Spyware/Information Retrieval (1)
Tries to read/open stored key files

Details
"feelcoind.exe" opens a file C:\ProgramData\feelcoin\rpc_ssl.key (UID: 00000000-00000916)
"feelcoind.exe" opens a file %ALLUSERSPROFILE%\feelcoin\rpc_ssl.key (UID: 00000000-00000916)
Source API Call
Relevance 3/10
--------------------------------------------------
Found TLS callbacks

Details
"feelcoind.exe" has a TLS callback with entrypoint at 0x1404c9d40
"feelcoind.exe" has a TLS callback with entrypoint at 0x140b36d40
"feelcoind.exe" has a TLS callback with entrypoint at 0x140b63d80
Source Static Parser
Relevance 10/10

PE file contains unusual section name

Details
"feelcoind.exe" has a section named "text_env"
Source Static Parser
Relevance 10/10

Imports suspicious APIs

Details
RegCloseKey
SetSecurityDescriptorDacl
CreateServiceA
OpenProcessToken
RegOpenKeyExA
StartServiceCtrlDispatcherA
StartServiceA
IsDebuggerPresent
DeviceIoControl
FindFirstFileW
CreateDirectoryW
Sleep
VirtualProtect
CreateFileMappingA
LoadLibraryW
DeleteFileW
GetModuleHandleExA
GetModuleFileNameA
GetFileSizeEx
CreateFileW
GetProcAddress
GetFileSize
GetSystemInfo
GetVersionExA
CreateFileA
SleepConditionVariableCS
GetModuleHandleExW
GetModuleHandleW
SleepEx
OpenProcess
GetThreadContext
CreateDirectoryExW
CreateProcessA
CopyFileExW
TerminateProcess
GetTickCount
WriteFile
GetFileAttributesW
CreateThread
GetModuleFileNameW
VirtualAlloc
MapViewOfFileEx
FindNextFileW
GetFileAttributesA
GetSystemDirectoryA
OutputDebugStringA
LoadLibraryA
GetModuleHandleA
ShellExecuteExA
bind
send
WSASend
sendto
WSAStartup
accept
recvfrom
socket
WSASocketA
listen
closesocket
connect
WSASocketW
recv
Source Static Parser
Relevance 1/10

Hybrid Analysis Scan Result: https://hybrid-analysis.com/sample/44c73fb4a5411065cc6686b903a804ae25fe85e7c5a1931577251f773b345521

[AakZaki]

Data from Hybrid Analysis state that this .exe file is Malicious:


Account: MioziM<= Please Banned
Fake ANN Thread: [ANN] DogKong v8 - cryptocurrency (CPU miner)

Code:

## 📥 Download

Latest version: [Releases](https://github.com/marquesslim-hue/DOGKONG/releases)

Hybrid Analysis: 2/24 security vendors flagged this file as malicious


Malicious Indicators:

Code:

Network Related (2)
Contacts multiple hosts

Details Contacted 14 (or more) hosts in at least 0 different cls.countries
Source Network Traffic
Relevance 9/10

Attempts to identify external IP address

Details "api.ipify.org"
Source Network Traffic
Relevance 6/10
----------------------------------------
System Security (1)
Modifies firewall settings

Details Process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="DogKong P2P" dir=in action=allow protocol=TCP localport=18555" (UID: 00000000-00003628)
Source Monitored Target
Relevance 8/10
----------------------------------------
Unusual Characteristics (1)
Spawns many processes

Details Spawned process "DogKong_v8.exe" (UID: 00000000-00002252)
Spawned process "DogKong_v8.exe" (UID: 00000000-00002164)
Spawned process "cmd.exe" with commandline "/c "ver"" (UID: 00000000-00007836)
Spawned process "cmd.exe" with commandline "/c netsh advfirewall firewall add rule name="DogKong P2P" dir=in action=allow protocol=TCP localport=18555 >nul 2>&1" (UID: 00000000-00005996)
Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="DogKong P2P" dir=in action=allow protocol=TCP localport=18555" (UID: 00000000-00003628)
Source Monitored Target
Relevance 8/10
----------------------------------------
Ransomware/Banking (1)
The analysis extracted a file with a known ransomware suffix

Details Found dropped filename "cp936.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "cp949.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "cns11643.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "euc-kr.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "ksc5601.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "big5.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "cp950.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "gb12345.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "gb2312.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "gb2312-raw.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "euc-jp.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "jis0208.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "jis0212.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "cp932.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "macJapan.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "shiftjis.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "macCentEuro.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "macDingbats.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "macCroatian.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "macCyrillic.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "iso8859-16.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "macRomania.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "macIceland.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "iso8859-13.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Found dropped filename "iso8859-10.enc" which has been seen in the context of ransomware (Indicator: .ENC)
Source Binary File
Relevance 10/10

Hybrid Analysis Scan Result: https://hybrid-analysis.com/sample/7f78a8d844a37f085766551a4d3ad9c31fe3c5edc5b66e73e16297f7ceb6de74

[lightbit]

Suspicious ANN - Umber Network (UMR)

ANN: https://bitcointalk.org/index.php?topic=5597492.0
User: Red-X
GitHub: https://github.com/Umber-core/Umber-core

Reason for suspicion:

Another suspicious cryptocurrency ANN distributing a Windows wallet ZIP through GitHub.

- The GitHub repository currently contains only a README, with no publicly visible blockchain or wallet source code.
- The ANN advertises a complete privacy-focused L1 blockchain, DEX, NFT marketplace, and 169+ TPS without providing verifiable supporting resources.
- Inconsistent identifiers throughout the announcement: UMR, TNB, and TSC-1.
- The ANN is self-moderated.
- A downloadable Windows executable is being distributed without sufficient information to independently verify its safety.

Possible fake ANN / unsafe wallet distribution. Malware is NOT confirmed.

Could someone experienced with malware analysis please investigate the linked wallet release?

I recommend avoiding the download until it has been independently verified.

Wallet download mentioned in ANN:

Code:

https://github.com/Umber-core/Umber-core/releases/download/0.1/Umber-0.1-win-x64.zip

[lightbit]

Suspicious ANN / Unverified Wallet - Quench Core (QNC)

ANN: https://bitcointalk.org/index.php?topic=5597527.0
User: jimswers

Suspicious GitHub:

Code:

https://github.com/Quench-core/Quench-core

Wallet download:

Code:

https://github.com/Quench-core/Quench-core/releases/download/0.1/Quench-0.1-win-x64.zip

Reasons for suspicion:

• The public GitHub repository contains only a README, with no visible blockchain or wallet source code, yet distributes a Windows wallet executable archive.
• The ANN title contains [RUB], while the project identifies its actual ticker as QNC.
• The announcement provides two different merged-mining hostnames: merge.quench.org and merge.quenchcore.org.
• The project claims an operational mainnet, explorer and Bitcoin merged-mining infrastructure without providing sufficient independently verifiable evidence in the ANN.
• The announcement is self-moderated.

Potentially unsafe wallet download - independent investigation requested.

This is not confirmation of malware. However, the combination of an unverifiable binary download, missing public source code and inconsistent announcement details raises concerns.

Could the moderators or experienced malware analysts investigate this ANN and its GitHub release?

I recommend that users avoid executing the wallet on their main systems until its safety and authenticity can be verified.

[lightbit]

Suspicious ANN - Ferrule (FRL) | Contradictory Wallet Release Information

ANN: https://bitcointalk.org/index.php?topic=5597554.0
User: rhader (https://bitcointalk.org/index.php?action=profile;u=358950)
GitHub:

Code:

https://github.com/ferrule-core/ferrule

Wallet download advertised in ANN:

Code:

https_://github.com/ferrule-core/ferrule/releases/download/v0.1.0/ferrule-wallet-0.1.0-win-x64.zip

Reasons for concern:

• Contradictory download status: The ANN advertises a Windows wallet ZIP, but the official project website explicitly states that the Windows wallet is "Not released".
• Missing implementation: The GitHub README confirms that the reference node source has not been published and that the project is still at the specification stage.
• Release inconsistency: A v0.1.0 GitHub release page exists, yet the repository's CHANGELOG states that v0.1.0 is unreleased and that no wallet binary or SHA-256 checksum exists.
• Unverified software: No verifiable checksum is published alongside the advertised download in the ANN.
• Self-moderated ANN: The announcement is self-moderated.

Official project downloads page:
https://ferrule-core.github.io/ferrule/downloads/

Official changelog:
https://github.com/ferrule-core/ferrule/blob/main/CHANGELOG.md

Requesting investigation of the advertised wallet download and clarification of these contradictions.

I have not verified the ZIP's contents, and malware is not confirmed. These discrepancies could reflect outdated documentation, but the executable should not be trusted without independent verification.

Could someone experienced in analysing suspicious wallet releases investigate this?

[$crypto$]

This is a fake, self-moderated thread, in which accounts are likely hacked, then spread malicious files via a direct github link.

Account: Mjeramirez This user recently woke up from a long period of inactivity. please ban
Fake ANN: [ANN][SKEP] Skep - RandomX CPU PoW, rules woven before block zero

Code:

[center]https://github.com/skep-core/skep/releases/download/v0.1.0/skep-wallet-0.1.0-win-x64.zip[/center]

Virustotal: https://www.virustotal.com/gui/file/c6ca0a46b3d5cb176f8b66f67e3758e57d4f096189ce3560a9c2e8e76d98d28c/detection

[lightbit]

Suspicious ANN / Unverifiable Windows Wallet - Girder (GRDR)

ANN: https://bitcointalk.org/index.php?topic=5597666.0
User: Seresjen

GitHub repository:

Code:

https://github.com/girder-core/girder

Wallet download advertised in ANN:

Code:

https://github.com/girder-core/girder/releases/download/v0.1.0/Girder-0.1-win-x64.zip

Reasons for suspicion:

• Unverifiable executable: A 203.3 MiB Windows wallet archive is being distributed despite the project's explicit admission that its reference node source code has not been published.
• No reproducible build: WALLET.md states that the released binary cannot be rebuilt from publicly inspectable source code.
• No operational public testnet: The announcement confirms that the testnet is not running and the blockchain explorer is not indexing.
• No independent security review: The release has not undergone a third-party security review.
• Checksum is not proof of safety: A published SHA-256 hash establishes file integrity when independently trusted, but does not prove that the software is safe.
• Self-moderated ANN: The announcement allows the topic creator to remove replies.

Supporting evidence:

Wallet documentation:
https://github.com/girder-core/girder/blob/main/WALLET.md

Release notes:
https://github.com/girder-core/girder/releases/tag/v0.1.0

Changelog:
https://github.com/girder-core/girder/blob/main/CHANGELOG.md

Requesting independent investigation of this Windows wallet archive.

I have not analysed the binary itself, and malware is NOT confirmed. However, distributing an unaudited executable without publicly available implementation source code presents a legitimate security concern.

Could an experienced member investigate the release and confirm whether it is safe?

Until then, I recommend avoiding execution on personal systems containing wallets, private keys or other sensitive information.

[lightbit]

Suspicious ANN / Unverifiable Windows Wallet - Pontil (PNTL)

ANN: https://bitcointalk.org/index.php?topic=5597727.0
User: Bershie

GitHub repository:

Code:

https://github.com/pontil-core/pontil

Wallet download advertised in ANN:

Code:

https_://github.com/pontil-core/pontil/releases/download/v0.1.0/pontil-0.1-win-x64.zip

Reasons for concern:

• Unsigned Windows executable: The developer distributes a 213,219,780-byte (203.3 MiB) wallet archive containing an unsigned executable.
• Missing implementation source: The project's own README confirms that the reference node's source code has not been published. The public repository primarily contains documentation rather than independently buildable wallet and node software.
• Contradictory publication sequence: TRANSPARENCY.md specifies that reference-node source and testnet milestones precede publication of a wallet archive. However, the wallet has already been released while the source remains unpublished and the public testnet is not running.
• No functioning public blockchain: The ANN acknowledges that no public testnet is running, the chain index contains no data, and there are no pools.
• Hash does not establish safety: The developer supplies the same SHA-256 hash in multiple project-controlled locations. While useful for detecting mismatched downloads, it does not provide independent verification of the executable's behaviour.
• Self-moderated announcement: The ANN allows the topic creator to remove replies.

Published SHA-256:

Code:

d51033e9d3fa98e80192142687ca2f66667b958e3b58dd67cf936a745a6533ca

Supporting evidence:

Repository:
https://github.com/pontil-core/pontil

Transparency document:
https://github.com/pontil-core/pontil/blob/main/TRANSPARENCY.md

Wallet documentation:
https://github.com/pontil-core/pontil/blob/main/WALLET.md

Release information:
https://github.com/pontil-core/pontil/releases/tag/v0.1.0

Requesting independent security investigation of the wallet release.

I have not executed or analysed the binary, and I am not claiming that malware has been confirmed.

However, distributing an unsigned wallet executable without publicly inspectable implementation source code, especially when the project's own publication sequence appears inconsistent with its current release status, warrants additional scrutiny.

Could experienced malware analysts investigate the archive and verify its authenticity and behaviour?

Until then, users should avoid executing it on systems containing wallets, private keys or other sensitive information.

[lightbit]

Suspicious ANN / Unverifiable Windows Wallet - Welt (WLT)

ANN: https://bitcointalk.org/index.php?topic=5597757.0
User: madhavanmalolan

GitHub repository:

Code:

https://github.com/welt-core/welt

Wallet download advertised in ANN:

Code:

https_://github.com/welt-core/welt/releases/download/v0.1.0/welt-0.1-win-x64.zip

Reasons for suspicion:

• Unsigned Windows executable: The ANN distributes a 98,629,586-byte (94.1 MiB) ZIP containing an unsigned Windows executable, despite the project being in an early development stage.
• Missing implementation source code: The GitHub README explicitly confirms that the reference-node source code has not been published. The public repository primarily contains documentation, website files and specifications rather than a buildable blockchain implementation.
• Contradictory publication sequence: TRANSPARENCY.md specifies that reference-node source and a functioning testnet should precede publication of a wallet archive. However, the wallet was released on October 24, 2026, while those earlier milestones remain incomplete.
• No operational public blockchain: The ANN acknowledges that no testnet is running, the blockchain explorer contains no data, and there are no mining pools.
• Very limited repository history: The public GitHub repository currently shows only two commits, providing limited implementation history for independent technical review.
• Checksum does not prove safety: The developer publishes a SHA-256 checksum in several project-controlled locations. This helps verify file integrity but does not independently establish that the binary is safe.
• Self-moderated ANN: The announcement is self-moderated, allowing the topic creator to remove critical replies.

Published SHA-256:

Code:

fbf72c4edecf757fb87e51d70c6b7a6f402ef9f0622cf76e0ba55bc7f713f766

Supporting evidence:

Repository:
https://github.com/welt-core/welt

Transparency document:
https://github.com/welt-core/welt/blob/main/TRANSPARENCY.md

Wallet documentation:
https://github.com/welt-core/welt/blob/main/WALLET.md

Release:
https://github.com/welt-core/welt/releases/tag/v0.1.0

Requesting independent investigation of the advertised wallet executable.

I have not executed or analysed the binary, and malware is NOT confirmed.

However, releasing an unsigned executable without publicly inspectable implementation source code, particularly when the project's own documented release sequence has not been followed, raises legitimate security concerns.

Could experienced malware analysts investigate the archive and determine whether it is safe?

Until the release can be independently verified, I recommend avoiding execution on systems containing cryptocurrency wallets, private keys or other sensitive information.