File scan report
Verdict Safe
Is setup.
Only Webroot flagged this established installer as repack riskware, while major antivirus engines remained silent and its completed sandbox run produced no malicious verdict.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 9
- Code signing Unsigned
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Webroot was the sole detector among 75 engines, using a generic repack-riskware label; no major antivirus engines flagged the file. Its broad, long-standing prevalence and clean sandbox verdict outweigh that detection, although the unsigned origin, shellcode-rule match, and reported process injection warrant obtaining it from a trusted source.
Only 1 of the 66 antivirus engines that checked it flagged the executable, and that detection came from less reliable Webroot as generic repack riskware; no major antivirus engines identified malware. The file has circulated among 502 submitters over more than two years, reducing concern that it is a newly introduced payload. One completed sandbox run returned clean, with no persistence recorded and no malicious cached host among all 19 observed contacts, though and reported injection targets remain noteworthy. Five community YARA rules matched, but only the shellcode rule was specific, while the other four describe generic compiler, TLS, or obfuscation traits. The executable is unsigned, and its similar-file history is mixed, but those comparisons are import-table fingerprint-only framework matches without signer corroboration. Overall, the isolated generic detection is more consistent with a repacked-installer false positive than an established malware family.
What We Detected
Webroot was the only engine among 75 to flag the file, labeling it W32.Riskware.Repack. No major antivirus engines reported malware, and there was no family consensus. The executable is unsigned, so its publisher cannot be authenticated.
Threat Behavior
One completed sandbox run returned clean and recorded no persistence. It nevertheless mapped T1134 and listed injection targets including WMIADAP.EXE and several updater processes, which deserves caution. All 19 observed contacts received complete reputation coverage with no malicious or suspicious cached result; several listed contacts were analysis-system background traffic and were not attributed to the sample. Ten dropped files have no saved verdict, so they provide no assurance either way.
Additional Context
The file has 502 submitters and 532 submissions dating from April 2024, indicating established circulation. Code sections did not show high entropy or likely packing. Five community YARA rules matched, but four were generic and only the shellcode-pattern rule was specific. Similar-file results were based solely on a shared import-table fingerprint without a matching signer, making them weak because installers built with the same framework may share that fingerprint.
What To Do Now
Use the installer only if it came directly from the expected publisher or another trusted distribution channel. Keep security software enabled, verify the download hash where the publisher provides one, and avoid proceeding if the source or intended product is unclear.
Where this verdict could be wrong4 caveats
- The executable is unsigned, so there is no publisher identity or signer history to corroborate its origin.
- A shellcode-specific YARA rule matched, and data from the test run mapped while listing injection into WMIADAP.EXE and updater processes.
- Four files built with the same import table were previously treated cautiously and one was associated with Pomal, though these were matches on the import table alone without a matching signer.
- All ten dropped files lack saved verdicts, so their safety remains unverified even though none is recorded as malicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 66 antivirus engines that checked it flagged the file, using a generic repack-riskware label.
- No major antivirus engines reported malware.
- A completed sandbox run returned clean and recorded no persistence.
- The file has broad, established circulation across 502 submitters and 532 submissions.
- No high-entropy code or likely packing was identified, and complete reputation coverage found no harmful observed host.
- The executable is unsigned, preventing publisher verification.
- A shellcode-pattern YARA rule matched the file.
- Data from the test run mapped token manipulation and reported injection into system or updater processes.
- Ten dropped components have no saved security verdict.
- Similar installer fingerprints have previously received cautious or harmful assessments, although those fingerprint matches are weak.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 16sandbox rule tags
- 14spawned processes
- 2network contacts
- 37filesystem & mutex artifacts
Includes the sandbox verdicts, 16 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- WebrootW32.Riskware.Repack
File fingerprint
- Last analyzed
- Oct 12, 2026, 11:16 PM UTC
- SHA-256
0c9e207aa76a2d16296daaf938fdb1312cdbc2c7421d2c99027f58439b39e345- SHA-1
494d82b46b026c99463d27bb816e1ea7689cf524- MD5
34abf59642d25fb2636cd7155beddf44
About this file
setup.exe is a Win32 EXE file of 3.1 MB.
- Type and size
- Win32 EXE · 3.1 MB
- Signer
- UnsignedNo code signature.
- First seen
- Apr 14, 2024On VirusTotal.
- Submitted by
- 502 distinct sources
- Packer
- None detected
- Entropy
- 7.03 of 8
First scanned
Includes every engine result (75), 5 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is setup.exe safe?
What is setup.exe?
How many antivirus engines detected setup.exe?
What is the SHA-256 hash of setup.exe?
Is it safe to install setup.exe?
How up to date is this analysis of setup.exe?
Community
Member reviews and reports for this exact file hash.