File scan report

Verdict Safe

Analyzed Aug 26, 20262 months ago

Is DAMN_NFO_Viewer_Setup.exe safe? Yes, no threats found.

Two less reliable engines flag an unsigned, packed installer that has been widely submitted since 2006.

Strong evidence · Widely seen for a long time, and nothing harmful found.

Install it as usual if it came from the official source

Good practice2 tips

We found nothing harmful in this file.

Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

2 of 71 flagged

Flagged 2
No detection 69
No result 4

FileDAMN_NFO_Viewer_Setup.exe269.3 kBSHA-256 36ec0190d03b…fdbcc6

Code signing Unsigned
Test run Completed
First seen 20y ago

It has a long history: seen by 1,094 sources over more than six months.

Chapter 02

Why we think so

2 points against it and 3 in its favour, checked against the scan evidence.

Analyst conclusion

Only less reliable detections exist; major antivirus engines are silent. The file is a long-standing installer whose sandbox activity is inconclusive without host-reputation data.

Where this verdict could be wrong1 caveat

communityComments contain researcher note calling detections a false-positive linked to ASPack packing

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

9sandbox rule tags
4spawned processes
3network contacts
40filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

9

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1027.002· Obfuscated code
T1036
T1055· Process injection
T1056· Keylogging
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1497· Sandbox evasion
T1518.001· Checks your AV

Observed activity

Processes started

4

Programs the file ran, with their command lines.

DAMN_NFO_Viewer_Setup.exe"C:\Users\<USER>\AppData\Local\Temp\DAMN_NFO_Viewer_Setup.exe"
DAMN_NFO_Viewer_Setup.exe%SAMPLEPATH%\DAMN_NFO_Viewer_Setup.exe
36ec0190d03b1983fe1a24523de5dc3180d1c132fdc6a03469e529a6a0fdbcc6.exe%SAMPLEPATH%\36ec0190d03b1983fe1a24523de5dc3180d1c132fdc6a03469e529a6a0fdbcc6.exe
36ec0190d03b1983fe1a24523de5dc3180d1c132fdc6a03469e529a6a0fdbcc6.exeC:\36ec0190d03b1983fe1a24523de5dc3180d1c132fdc6a03469e529a6a0fdbcc6.exe

Network contacts

3

3 hosts, listed as 3 addresses. Links show the host and path only.

IP address23.50.34.78
IP address23.223.246.81
IP address23.215.102.42

Files

30

Files the file created, changed or deleted.

WrittenC:\Program Files (x86)
WrittenC:\Program Files (x86)\DAMN NFO Viewer
WrittenC:\Program Files (x86)\DAMN NFO Viewer\DAMN NFO Viewer.exe
WrittenC:\Program Files (x86)\DAMN NFO Viewer\LangDLLs
WrittenC:\Program Files (x86)\DAMN NFO Viewer\LangDLLs\DAMN_NFO_Viewer_CHI.dll
WrittenC:\Program Files (x86)\DAMN NFO Viewer\LangDLLs\DAMN_NFO_Viewer_DEU.dll

Show all 30 entries

WrittenC:\Program Files (x86)\DAMN NFO Viewer\LangDLLs\DAMN_NFO_Viewer_DUT.dll
WrittenC:\Program Files (x86)\DAMN NFO Viewer\LangDLLs\DAMN_NFO_Viewer_ENG.dll
WrittenC:\Program Files (x86)\DAMN NFO Viewer\LangDLLs\DAMN_NFO_Viewer_ESL.dll
WrittenC:\Program Files (x86)\DAMN NFO Viewer\LangDLLs\DAMN_NFO_Viewer_FRA.dll
WrittenC:\Program Files (x86)\DAMN NFO Viewer\LangDLLs\DAMN_NFO_Viewer_ITA.dll
WrittenC:\Program Files (x86)\DAMN NFO Viewer\LangDLLs\DAMN_NFO_Viewer_NOR.dll
WrittenC:\Program Files (x86)\DAMN NFO Viewer\LangDLLs\DAMN_NFO_Viewer_POR.dll
WrittenC:\Program Files (x86)\DAMN NFO Viewer\LangDLLs\DAMN_NFO_Viewer_RUS.dll
WrittenC:\Program Files (x86)\DAMN NFO Viewer\LangDLLs\DAMN_NFO_Viewer_SVE.dll
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER21DB.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER2287.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER22B6.tmp.txt
DeletedC:\Windows\System32\spp\store\2.0\cache\cache.dat
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER34E7.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER34F7.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER34F8.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER817F.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER82C8.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER8289.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER82B9.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER82D9.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER82E9.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WERC6E.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WERD2A.tmp.csv

Mutexes

10

Named locks a program uses so only one copy runs; malware families often reuse them.

CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500

Show all 10 entries

MSCTF.Shared.MUTEX.EBH
MSCTF.Shared.MUTEX.AKJ
\Sessions\1\BaseNamedObjects\Global\SyncRootManager
\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex

Sandbox background — not the file

20

The analysis machine's own processes and connections, recorded in every run.

VM processwuapihost.exeC:\Windows\System32\wuapihost.exe
VM processUI0Detect.exeC:\Windows\System32\UI0Detect.exe
VM processupdater.exeC:\Program Files\Google3708_1913126043\bin\updater.exe
VM host192.168.0.126
VM host23.216.147.76
VM host20.99.132.105

Show all 20 entries

VM hosta83f:8110:ce03:0:0:0:ce03:0
VM hosta83f:8110:2800:1800:4000:1800:1800:100
VM host192.168.0.10
VM host52.185.73.156
VM host131.253.33.203
VM host23.216.147.64
VM host20.99.133.109
VM host20.99.184.37
VM hosta83f:8110:8d00:100:89:9598:0:8b
VM hosta83f:8110:2359:c047:9a68:d0ba:fb57:7901
VM host20.69.140.28
VM host192.229.211.108
VM host20.99.186.246
VM host20.99.185.48

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

2a3b463071d55c73178d…4fd6edNot checked
no saved verdict
a2efb4cfe20ff865a1df…b26f08Not checked
no saved verdict
fc04999cc894cc634d22…3ccb6eNot checked
no saved verdict
f7d35c12f730c4adad0b…122565Not checked
no saved verdict
c5debdd3b61107b1742b…cf5cfcNot checked
no saved verdict
0222be6598f1909ff593…5cb1e8Not checked
no saved verdict
4577677450f70e084462…114de3Not checked
no saved verdict
0325cd314b49fa71bff2…1790a8Not checked
no saved verdict
a2126c706ec8fb06aa71…4aecb5Not checked
no saved verdict
459da43fc26dbca5754a…beeec2Not checked
no saved verdict

Chapter 04

Technical details

2 of the 71 antivirus engines that checked it flag it; no publisher signature.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete2 of 71 engines flagged it · 4 gave no result · treated as non-decisive DetailsJun 1, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsAug 26, 2026

Contacted hostsMalwareTips URL scannerPartial3 hosts contacted in the test run had no completed reputation check DetailsAug 26, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete2 MalwareTips behaviour rules DetailsAug 26, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedAug 26, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchAug 26, 2026

Engines that flagged it 2

The saved verdict treats these detections as likely false positives.

MaxSecureTrojan.Malware.74574680.susgen
Trapminesuspicious.low.ml.score

File fingerprint

Last analyzed: Aug 26, 2026, 2:53 AM UTC

SHA-256: 36ec0190d03b1983fe1a24523de5dc3180d1c132fdc6a03469e529a6a0fdbcc6
SHA-1: 2b8d3cb4c984e993e207cae7cd6569b95ba35bf8
MD5: 07d310c0b9d9416741810a8889e5f20b

About this file

DAMN_NFO_Viewer_Setup.exe is a Win32 EXE file of 269.3 kB.

Type and size: Win32 EXE · 269.3 kB
Signer: UnsignedNo code signature.
First seen: Jun 11, 2006On VirusTotal.
Submitted by: 1,094 distinct sources
Packer: ASPack/ASProtect (section names)Packing hides code; legitimate installers use it too.
Entropy: 7.76 of 8A code section is highly compressed or encrypted.

First scanned Aug 26, 2026

Antivirus consensus

2 of 71 engines flagged this file

2 malicious0 suspicious69 not flagged4 no result

4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-236 engines
0flagged
Low-trust17 engines
2flagged

These detections were treated as likely false positives in the saved verdict.

View all 75 engine results

MaxSecureMalicious: Trojan.Malware.74574680.susgen
TrapmineMalicious: suspicious.low.ml.score
AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.

2 heuristics

MITRE ATT&CK profile

Execution× 1Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)
DropperNetworkProfile
T1105 T1027
high
Unsigned, packed PE with sandbox-observed network activity. The packing step hides the payload until execution; the network call fetches / reports for the next stage. Classic dropper / stager behaviour.
Evidence
23.50.34.78

PE forensics

Section entropy & packers

Executable sections have high entropy (7.2+) — the code is compressed or encrypted and only decrypted at runtime. Classic packing behaviour.

ent 7.76Likely packed

Section entropy6 sections

.text

7.96packed

.rdata

7.62

.data

7.78

.rsrc

7.99

.DAMN

5.99

.adata

0.00

0.0Packed threshold 7.28.0

Detected packers

ASPack/ASProtect (section names)

Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

1,094

Hundreds of people have uploaded this — common.

Total submissions

1,355

Includes repeat uploads by the same source.

First seen

20y ago

Jun 11, 2006

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is DAMN_NFO_Viewer_Setup.exe safe?

We found nothing harmful in DAMN_NFO_Viewer_Setup.exe. 2 of the 71 antivirus engines that checked it flag it; after weighing the other evidence we treat those alerts as false alarms. Install it only if it came from the developer's own website or an official app store.

What is DAMN_NFO_Viewer_Setup.exe?

DAMN_NFO_Viewer_Setup.exe is a software installer, about 269.3 kB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Jun 11, 2006.

How many antivirus engines detected DAMN_NFO_Viewer_Setup.exe?

2 of the 71 antivirus engines that checked it flag DAMN_NFO_Viewer_Setup.exe, including MaxSecure and Trapmine. We weigh which engines flagged it and what else the scan found, not just the count.

What is the SHA-256 hash of DAMN_NFO_Viewer_Setup.exe?

The SHA-256 fingerprint of DAMN_NFO_Viewer_Setup.exe is 36ec0190d03b1983fe1a24523de5dc3180d1c132fdc6a03469e529a6a0fdbcc6, and its MD5 is 07d310c0b9d9416741810a8889e5f20b. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to install DAMN_NFO_Viewer_Setup.exe?

We found nothing harmful in DAMN_NFO_Viewer_Setup.exe. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of DAMN_NFO_Viewer_Setup.exe?

This report reflects the scan on Aug 26, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Is DAMN_NFO_Viewer_Setup.exe safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

Engines that flagged it 2

File fingerprint

About this file

2 of 71 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is DAMN_NFO_Viewer_Setup.exe safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Mutexes

Sandbox background — not the file

Engines that flagged it 2

File fingerprint

About this file

Related file reports