File scan report
Verdict Safe
Is Adobe Installer safe? Yes, no threats found.
A valid Adobe signature and broad major silence outweigh one generic Yandex detection, though packed code and unusual runtime mappings warrant source verification.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 71 flagged
- Flagged 1
- No detection 70
- No result 4
- Code signing Adobe Inc.
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The executable carries a verified Adobe Inc. signature, and only 1 of the 71 antivirus engines that checked it flagged it with a generic Trojan label; no major antivirus engines agreed. The completed sandbox run did not issue a malware finding, but UPX packing and several offensive technique mappings mean it should still come from an official Adobe download channel.
The strongest identity evidence is the verified Adobe Inc. signature, which matches a curated trusted publisher and shows no conflicting brand information. Only Yandex flagged the sample among 75 engines, using a generic label that lacks family consensus, while all 17 major antivirus engines were silent. One completed sandbox run returned a clean result, and the fully covered host-reputation check found no malicious or suspicious destinations. However, the executable is UPX-packed and received T1055, T1485, T1486, and mappings, which are meaningful caution signals even though no injected target was identified. Two comparable Adobe-signed files were previously assessed as benign installers, while a same-import-table fingerprint, signer-matching sample was assessed cautiously, leaving some residual uncertainty. Overall, the solitary generic detection is most consistent with a false positive, provided the file was obtained through Adobe's official distribution channel.
What We Detected
Only 1 of the 71 antivirus engines that checked it flagged the executable. Yandex supplied the sole generic Trojan label, while none of the 17 major antivirus engines reported malware or agreed on a threat family. The executable has a verified Adobe Inc. signature that matches a curated trusted publisher, and no claimed-brand conflict was identified.
Threat Behavior
One completed sandbox run did not return a malware finding. Observed traffic included Adobe-related infrastructure and cloud-hosted devices; after excluding two identified analysis-environment contacts, all nine distinct observed hosts received reputation coverage with no malicious or suspicious matches. The sample nevertheless contains UPX-packed, high-entropy code and was mapped to T1055, T1485, T1486, and T1562.001. No injected process target was recorded, so the T1055 mapping indicates possible injection-related activity rather than proven injection into a named process.
What To Do Now
Use the executable only if it came directly from Adobe's official application or download channel, and verify that Windows still reports the Adobe Inc. signature as valid before running it. If it arrived through email, advertising, a file-sharing site, or another untrusted source, discard it and download a fresh installer from Adobe while keeping security software enabled.
Where this verdict could be wrong3 caveats
- UPX packing, high-entropy code, and the four offensive technique mappings are atypical enough to warrant caution even with a valid Adobe signature.
- A prior signer-matching file with the same import-table fingerprint received a suspicious assessment for unusual behavior.
- The ten dropped files have no saved assessments, so their individual safety remains unverified.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The digital signature is valid and belongs to Adobe Inc., a recognized trusted publisher.
- None of the 17 major antivirus engines reported malware.
- The completed sandbox run did not issue a malware finding.
- Complete reputation coverage of the nine distinct non-background contacted hosts found no malicious or suspicious matches.
- Two prior Adobe-signed comparison files were assessed as benign installers.
- The executable uses UPX packing and contains high-entropy code.
- The test run mapped possible process injection, data destruction, ransomware-style impact, and security-control impairment techniques.
- One engine supplied a generic Trojan detection.
- A comparable Adobe-signed file sharing this import-table fingerprint previously received a cautious assessment.
- Ten dropped files were observed but do not have individual saved assessments.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 28sandbox rule tags
- 7spawned processes
- 9network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
28MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1045
- T1047
- T1055· Process injection
- T1056· Keylogging
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1089
- T1112
- T1129· Loads modules
- T1140· Deobfuscation
- T1179
- T1198
- T1485
- T1486· File encryption
- T1497· Sandbox evasion
- T1518· Checks your AV
- T1518.001· Checks your AV
- T1562· Disables security
- T1562.001· Disables security
- T1573
- T1574· Execution hijack
Observed activity
Processes started
7Programs the file ran, with their command lines.
Premiere_Set-Up_7474.exe"C:\Users\<USER>\Desktop\Premiere_Set-Up_7474.exe"msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Premiere_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --user-data-dir="C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5648.5448.901240312263090617msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Premiere_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --user-data-dir="C:\Users\<USER>\AppData\Local\Temp\{B63F23BB-73F3-49B4-AD34-156F012BE1F2}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5648.5448.2519396432323786261msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\<USER>\AppData\Local\Temp\{B63F23BB-73F3-49B4-AD34-156F012BE1F2}\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\<USER>\AppData\Local\Temp\{B63F23BB-73F3-49B4-AD34-156F012BE1F2}\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.129 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --annotatio…msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.129 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --annotation=plat=W…msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView" --webview-exe-name=Premiere_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=3040 --field-trial-handle=1988,i,4787618831215667527,2111522063724941742,262144 --enable-f…
Show all 7 entries for processes started
msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\<USER>\AppData\Local\Temp\{B63F23BB-73F3-49B4-AD34-156F012BE1F2}\EBWebView" --webview-exe-name=Premiere_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2736 --field-trial-handle=1912,i,2584788726946660965,8667443683030177304,262144 --enab…
Network contacts
99 hosts, listed as 5 domains, 4 addresses, 1 link. Links show the host and path only.
- Domain
cc-api-data.adobe.io - Domain
cc-api-data-ue1.adobe.io - Domain
dunamis-ethos508-prod-va6-856defacfb833db1.elb.us-east-1.amazonaws.com - Domain
ethos.dunamis.ethos508-prod-va6.ethos.adobe.net - Domain
d1n897799gitxr.cloudfront.net - IP address
150.171.28.11
Show all 10 entries for network contacts
- IP address
52.6.228.48 - IP address
52.73.45.44 - IP address
34.233.49.149 - URL
https://cc-api-data.adobe.io
Files
30Files the file created, changed or deleted.
- Written
\Device\ConDrv\Connect - Written
C:\Users\<USER>\AppData\Local\Temp\CreativeCloud\ACC\WAM.log - Written
C:\Users\<USER>\AppData\Local\Temp\Adobe\com.adobe.dunamis\dunamis-2026-07-20_22-37-50.log - Written
C:\Users\<USER>\AppData\Roaming\com.adobe.dunamis\f65a88c9-12b3-4201-a633-87cf11b91fa8\v1\0 - Written
C:\Users\<USER>\AppData\Roaming\com.adobe.dunamis\f65a88c9-12b3-4201-a633-87cf11b91fa8\v1\0\meta_events\manifest - Written
C:\Users\<USER>\AppData\Roaming\com.adobe.dunamis\f65a88c9-12b3-4201-a633-87cf11b91fa8\v1\0\meta_events\cbe98cdb-5261-41af-83eb-71a0c019597f
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Adobe\OOBE\temp_lbs_wid - Written
C:\Users\<USER>\AppData\Roaming\com.adobe.dunamis\f65a88c9-12b3-4201-a633-87cf11b91fa8\v1\0\anon_events\manifest - Written
C:\Users\<USER>\AppData\Roaming\com.adobe.dunamis\f65a88c9-12b3-4201-a633-87cf11b91fa8\v1\0\anon_events\49b856e0-1faf-45cf-8c40-a15573ec432c - Written
C:\Users\<USER>\AppData\Local\Temp\{B63F23BB-73F3-49B4-AD34-156F012BE1F2}\index.html - Written
C:\Users\<USER>\AppData\Local\Temp\{B63F23BB-73F3-49B4-AD34-156F012BE1F2}\CCDInstaller.js - Written
C:\Users\<USER>\AppData\Local\Temp\{B63F23BB-73F3-49B4-AD34-156F012BE1F2}\index.css - Written
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Crashpad\throttle_store.dat - Written
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Crashpad\settings.dat - Written
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\BrowserMetrics\BrowserMetrics-6A5EA347-640.pma - Deleted
C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\BrowserMetrics-spare.pma - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\c8cd9c8d-c3da-4fd1-8829-927342fdd4c6.tmp - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Default\Extension Rules\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Default\shared_proto_db\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Default\Extension Scripts\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Local State~RFf481.TMP - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Local State~RFf6c3.TMP - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Default\Extension State\000001.dbtmp - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\BrowserMetrics\BrowserMetrics-6A5EA347-640.pma - Deleted
C:\Users\<USER>\AppData\Local\Adobe\webview2\Premiere_Set-Up_7474.exe\EBWebView\Default\1f8ffefc-2c7c-4bbe-849a-cc09584f1b8d.tmp
Registry and auto-start
16Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\dr - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\StabilityMetrics\user_experience_metrics.stability.exited_cleanly - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\usagestats - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\media.cdm.origin_data - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings\dgiklkfkllikcanfonkcabmbdfmgleag - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings\mhjfbmdgcfjbbpaeojofohoefgiehjai
Show all 16 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\urlstats - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\media.storage_id_salt - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.account_id - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.last_username - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\default_search_provider_data.template_url_data - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\safebrowsing.incidents_sent - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\pinned_tabs - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\search_provider_overrides - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.last_account_id - Deleted
HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
WAM.logLocal\ChromeProcessSingletonStartup!__OMADM_NAMED_MUTEX__Global\OneSettingQueryMutex+compat+encapsulationGlobal\{3EBE6875-9C4E-4782-8A43-275AFFFCA6FB}Global\359dca4322b8b4a0f7f92bf448150fb
Show all 10 entries for mutexes
Global\17984755fe166b7170b9b5099053521cLocal\MSCTF.Asm.MutexDefault1Local\ZonesCacheCounterMutexLocal\ZonesLockedCacheCounterMutex
Sandbox background — not the file
10The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
Show all 10 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p - VM host
8.8.8.8 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 95ba54ba7f7002941744…a7fb1fNot checkedno saved verdict
- bddd5901cb74bbff5e26…647961Not checkedno saved verdict
- d13635a950d267820847…dddeccNot checkedno saved verdict
- 6ac4674dddcefa804953…fff28fNot checkedno saved verdict
- 6542c8a21cbaf4b21722…35ae6eNot checkedno saved verdict
- 9dc47a1ddbe2798dada8…9e27d6Not checkedno saved verdict
- 697c3c2724c192f12ad9…eeaa73Not checkedno saved verdict
- 6840e2424abc424866e9…cfd45dNot checkedno saved verdict
- 12c2d883076d08246d67…a08cc4Not checkedno saved verdict
Chapter 04
Technical details
1 of the 71 antivirus engines that checked it flags it; signed by Adobe Inc..
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The Safe verdict weighed these detections and treats them as non-decisive.
- YandexTrojan.GenAsa!rBStHMRk3Wo
File fingerprint
- Last analyzed
- Oct 11, 2026, 8:28 PM UTC
- SHA-256
426fc32fbbc4cff8501e08b48186073b8b3657fe363d563d23b06576cfb90265- SHA-1
bedb564072e3333a5d27b69195a2b1c2f356236e- MD5
0d3b206ecdf9d69e051e11c708ab81cf
About this file
Adobe Installer is a Win32 EXE file of 3.6 MB.
- Type and size
- Win32 EXE · 3.6 MB
- Signer
- Adobe Inc.Valid code signature.
- First seen
- Jul 20, 2026On VirusTotal.
- Submitted by
- 212 distinct sources
- Packer
- UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]Packing hides code; legitimate installers use it too.
- Entropy
- 7.40 of 8A code section is highly compressed or encrypted.
First scanned
Antivirus consensus
1 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines1flagged
- Low-trust17 engines0flagged
View all 75 engine results
- YandexMalicious: Trojan.GenAsa!rBStHMRk3Wo
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)Packed PE with sandbox-observed network activity AND engine flags. Signed packed software exists legitimately, but a signed + packed + flagged binary is a signed dropper pattern.
Evidencecc-api-data.adobe.io
Section entropy & packers
Executable sections have high entropy (7.2+) — the code is compressed or encrypted and only decrypted at runtime. Classic packing behaviour.
Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is Adobe Installer safe?
What is Adobe Installer?
How many antivirus engines detected Adobe Installer?
Is Adobe Installer digitally signed?
What is the SHA-256 hash of Adobe Installer?
Is it safe to install Adobe Installer?
How up to date is this analysis of Adobe Installer?
Community
Member reviews and reports for this exact file hash.