MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Safe

Test-file label present; 28 detections are ignored per explicit rule.

Trust score88High trust
MT AI confidence · 92%
Setup.exe
4.3 MB
24100b43cdef8a018b…fc26a36c1f
Antivirus engines
28 of 75 flagged
Code signing
Unsigned
Age
First-seen today
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

92%Confidence
Very high
Reasoning

The presence of engines.anyTestFileLabel=true is an absolute rule that forces a safe verdict. While 11 tier-1 engines flagged the file, the labels are generic adware/PUP strings and no strong family consensus exists. The binary is unsigned and brand-new with no sandbox or network evidence of malice. Similar-hash RAG returned nothing, reinforcing that this is an isolated test submission.

Key signals · 4

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines.anyTestFileLabel=true (Kaspersky labelFlags.testFile)

  2. 28/71 malicious detections but tier1FamilyConsensus.strong=false

  3. signing.signed=false and prevalence.classification=rare_new

  4. popularThreatLabel=pcappstore but anyTestFileLabel overrides

Points in its favour
  • anyTestFileLabel=true
  • no sandbox malicious verdict
  • no malicious contacted hosts
What to do

Treat as a test file and disregard the detections.

Threat family attribution

pcappstore corroborated by 1 source

  • VT (75 engines)
    pcappstore
No researcher-database hits
External threat-intel sources were not collected for this scan.
Antivirus engine breakdown

28 detections across 75 engines

28 malicious0 suspicious47 clean
Tier-117 engines
11flag
Top commercial AVs (low FP rate)
Tier-238 engines
12flag
Mainstream engines with mixed FP rates
Low-trust20 engines
5flag
Heuristic / generic-AI engines (high FP rate)
AhnLab-V3
malicious
PUP/Win.PCAppStore.R777103
ALYac
malicious
Trojan.Generic.40015369
Arcabit
malicious
Trojan.Generic.D26295EE [many]
Avast
malicious
Win64:MalwareX-gen [Misc]
AVG
malicious
Win64:MalwareX-gen [Misc]
Avira
malicious
ADWARE/W64.MalwareX
BitDefender
malicious
Trojan.Generic.40015342
CTX
malicious
exe.trojan.generic
Cynet
malicious
Malicious (score: 99)
DrWeb
malicious
Program.Unwanted.5544
Elastic
malicious
malicious (high confidence)
Emsisoft
malicious
Trojan.Generic.40015342 (B)
ESET-NOD32
malicious
Win32/Adware.VeryFast.Q application
F-Secure
malicious
Adware.ADWARE/W64.MalwareX
Fortinet
malicious
Riskware/VeryFast
GData
malicious
Win32.Trojan-Ransom.PCAppStoreLocker.A
Google
malicious
Detected
Gridinsoft
malicious
PUP.Win64.PCAppStore.oa!s1
K7AntiVirus
malicious
Unwanted-Program ( 005ce0731 )
K7GW
malicious
Unwanted-Program ( 005ce0731 )
Kaspersky
malicious
not-a-virus:HEUR:AdWare.Win32.PCAppStore.gen
Malwarebytes
malicious
PUP.Optional.VeryFast
MicroWorld-eScan
malicious
Trojan.Generic.40015342
Rising
malicious
PUA.FastApp@XH.1FBD (CERT:yqBmFCPIMzqYeYrfIC+fSQ)
Varist
malicious
W64/ABApplication.KSPD-4216
VBA32
malicious
Adware.PCAppStore
VIPRE
malicious
Trojan.Generic.40015342
Webroot
malicious
Win.Deceptor.Pcappstore
Hash 24100b43cdef… cross-referenced against 75 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 7.68Unpacked
Section entropy7 sections
.text
6.46
.rdata
5.36
.data
4.51
.pdata
5.96
.fptable
0.00
.rsrc
7.99
.reloc
5.38
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.

Rare & new
Unique uploaders
1
Very few people have ever uploaded this — rare.
Total submissions
1
Includes repeat uploads by the same source.
First seen by VT
0d ago
Jun 6, 2026
Prevalence quadrant
here
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
6/6/2026, 1:44:22 PM
First seen (MalwareBazaar)
—
Last analysis (VT)
6/6/2026, 1:44:22 PM
Scanned here
6/6/2026, 1:45:03 PM
File name
Setup.exe
Size
4.35 MB
MIME type
application/x-msdownload
Detected type
Win32 EXE
SHA-256
24100b43cdef8a018bad380d223a2825b8eb33b3e7bcacaae316eefc26a36c1f
MD5
89131076b31dfff1ac51c6def46f5328
SHA-1
e195b6f140d0fcdf3224e8bf5fe57d4dce3ebb82
PE imphash
6baf91e587892c296d304b3daf25a3cd
First seen (VT)
6/6/2026, 1:44:22 PM
Last analysis (VT)
6/6/2026, 1:44:22 PM
First scan (MalwareTips)
6/6/2026, 1:45:03 PM
Last scan (MalwareTips)
6/6/2026, 1:45:03 PM
Behavior tags
peexeoverlay64bits
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.