File verdict·Decided by the MT AI Engine
Our call

Malicious

This file is confirmed confirmed malware — abuse.ch researchers uploaded this exact sample to MalwareBazaar as known malware. Delete it and scan your system.

confirmed malware
Trust score3Critical
MT AI confidence · 99%
setup.exe
8.6 MB
46e5e6ce73587216dc43aac277e6
Antivirus engines
10 of 74 flagged
Code signing
Unsigned
Age
First seen 2y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

99%Confidence
Very high
Reasoning

This file is confirmed confirmed malware — abuse.ch researchers uploaded this exact sample to MalwareBazaar as known malware. Delete it and scan your system. MalwareBazaar is a researcher-curated malware repository; hits there are ground-truth positives.

Key signals · 3

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. MalwareBazaar: confirmed malware

  2. (no named signature)

  3. First catalogued: 2025-08-06 19:19:30

Points against
  • MalwareBazaar confirmed family: confirmed malware
  • Researcher-uploaded malware sample
What to do

Delete this file and run a full-system antivirus scan.

Threat family attribution

gamehack corroborated by 3 sources

  • 5 YARA rules
    Borland, HUNTING_SUSP_TLS_SECTION, pe_detect_tls_callbacks
  • VT (74 engines)
    gamehack
  • MT AI Engine
    confirmed malware
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
20

Adversary techniques mapped to the MITRE ATT&CK framework.

T1012T1027T1027.002T1027.009T1033T1045T1055T1057T1059T1063T1071T1082T1083T1129T1134T1140T1497T1529T1614T1614.001
Spawned processes
15
$(unnamed)
"C:\Users\<USER>\Desktop\software.exe"
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\is-D1SB1.tmp\software.tmp" /SL5="$160068,8444262,140800,C:\Users\<USER>\Desktop\software.exe"
$(unnamed)
%SAMPLEPATH%\setup.exe
$(unnamed)
%USERPROFILE%\AppData\Local\Temp\is-UCESO.tmp\setup.tmp
$(unnamed)
%SAMPLEPATH%\46e5e6ce73587216dc2bf5b45f0de0655451a3f401c767cfa36d4343aac277e6.exe
$(unnamed)
%USERPROFILE%\AppData\Local\Temp\is-OVDFP.tmp\46e5e6ce73587216dc2bf5b45f0de0655451a3f401c767cfa36d4343aac277e6.tmp
$(unnamed)
%USERPROFILE%\AppData\Local\Temp\is-UV9TQ.tmp\46e5e6ce73587216dc2bf5b45f0de0655451a3f401c767cfa36d4343aac277e6.tmp
$(unnamed)
%USERPROFILE%\AppData\Local\Temp\is-5BI0A.tmp\46e5e6ce73587216dc2bf5b45f0de0655451a3f401c767cfa36d4343aac277e6.tmp
+7 more processes captured.
Network activity
22
IP addresses20
  • 23.198.171.50
  • 20.99.186.246
  • 20.99.133.109
  • 23.216.81.152
  • 184.25.191.235
  • 192.168.0.73
  • 192.168.0.92
  • 23.6.103.183
  • a83f:8110:0:0:9902:0:0:0
  • 192.168.0.16
+10 more
URLs2
  • http://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/4A8157B2FF422C259DDAA2D0E568C0C0AFAB940E1F6E0E482EF83E90DDBAD2D6/VC_redist.x86.exe
  • http://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/EE84FED2552E018E854D4CD2496DF4DD516F30733A27901167B8A9882119E57C/VC_redist.x64.exe
Filesystem & mutexes
29
Files written15
  • C:\Users\<USER>\AppData\Local\Temp\is-D1SB1.tmp\software.tmp
  • C:\Users\<USER>\AppData\Local\Temp\is-N0IEB.tmp\_isetup\_setup64.tmp
  • C:\Users\<USER>\AppData\Local\Temp\is-N0IEB.tmp\_isetup\_shfoldr.dll
  • C:\Users\<USER>\AppData\Local\Temp\is-N0IEB.tmp\idp.dll
  • C:\Users\<USER>\AppData\Local\Temp\is-N0IEB.tmp\innocallback.dll
+10 more
Files deleted4
  • %USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache\IE\KLT1I0ZU\update50[1].xml
  • C:\Windows\System32\wbem\Performance\WmiApRpl.h
  • C:\Windows\System32\wbem\Performance\WmiApRpl.ini
  • C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_cbbb49d6-b7ff-44ca-aba5-8a5e250d4d42
Mutexes created10
  • Local\DirectSound DllMain mutex (0x00000C98)
  • Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
  • Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
  • \Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
  • \Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
+5 more
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • 09af8004b85478e1eca047b449Never scanned
    never seen before
  • d92f7c60256509f74e3662ea29Never scanned
    never seen before
  • 58045dfbe8eb137de53d94d65dNever scanned
    never seen before
  • 450b9b0ba25bf068afbcfd0105Never scanned
    never seen before
  • f84677643d9977aa1e8a61f824Never scanned
    never seen before
  • ed8a485b9984997306eac78ee9Never scanned
    never seen before
  • 9884e9d1b4f8a873ccbd360d87Never scanned
    never seen before
  • fbbf18f351711497ef2c43fa39Never scanned
    never seen before
  • a1c80a60363e23d475e884a07cNever scanned
    never seen before
  • da1aff62524fc3c70a7890e235Never scanned
    never seen before
External threat intelligence

2 corroborating signals from researcher-curated sources

MalwareBazaar HIT·abuse.ch confirmed sampleView on MalwareBazaar
· exe· first seen 8/6/2025, 7:19:30 PM
exe
YARAify HIT·5 community rules matchedView on YARAify
  • Borlandby malware-lu
  • HUNTING_SUSP_TLS_SECTIONby chaosphere
    Detect PE files with .tls section that can be used for anti-debugging
  • pe_detect_tls_callbacks
  • shellcodeby nex
    Matched shellcode byte patterns
  • Sus_Obf_Enc_Spoof_Hide_PEby XiAnzheng
    Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Cross-referenced against MalwareBazaar (abuse.ch), YARAify, and the CIRCL hashlookup reference DB.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

5 YARAify2 synthesis
MITRE ATT&CK profile
Defense evasion× 1C2× 1
YARAify (community)
Researcher-authored rules via abuse.ch
  • Borland
  • HUNTING_SUSP_TLS_SECTION
  • pe_detect_tls_callbacks
  • shellcode
  • Sus_Obf_Enc_Spoof_Hide_PE
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • ProcessInjectionhigh

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    "C:\Users\<USER>\Desktop\software.exe"
  • DirectIpC2medium

    Sample contacted 14 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    23.198.171.50 · 20.99.186.246 · 20.99.133.109
Antivirus engine breakdown

10 detections across 74 engines

10 malicious0 suspicious64 clean
Tier-117 engines
3flag
Top commercial AVs (low FP rate)
Tier-238 engines
5flag
Mainstream engines with mixed FP rates
Low-trust19 engines
2flag
Heuristic / generic-AI engines (high FP rate)
GData
malicious
Generic.Trojan.PSEB.V3088Y
Google
malicious
Detected
Gridinsoft
malicious
PUP.Win32.GameHack.bot
Malwarebytes
malicious
RiskWare.Crack
Microsoft
malicious
PUA:Win32/GameHack
Paloalto
malicious
generic.ml
Sophos
malicious
Generic Reputation PUA (PUA)
TrellixENS
malicious
Artemis!8365D8A59F09
Varist
malicious
W32/ABApplication.LCHO-2663
Webroot
malicious
W32.Malware.gen
Hash 46e5e6ce7358… cross-referenced against 74 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked
Section entropy8 sections
.text
6.48
.itext
6.02
.data
2.67
.bss
0.00
.idata
4.97
.tls
0.00
.rdata
0.19
.rsrc
4.16
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old
Unique uploaders
3,668
Hundreds of people have uploaded this — common.
Total submissions
10,180
Includes repeat uploads by the same source.
First seen by VT
2y ago
Jun 21, 2024
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
here
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
6/21/2024, 3:58:53 PM
First seen (MalwareBazaar)
8/6/2025, 7:19:30 PM
Last analysis (VT)
7/3/2026, 11:41:36 PM
Scanned here
7/4/2026, 10:35:42 PM
File name
setup.exe
Size
8.62 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
46e5e6ce73587216dc2bf5b45f0de0655451a3f401c767cfa36d4343aac277e6
MD5
8365d8a59f090f0bc90d085ac3da014c
SHA-1
02072c995e4ac5fb04398b7e0dbeb8c9035c1f37
PE imphash
483f0c4259a9148c34961abbda6146c1
First seen (VT)
6/21/2024, 3:58:53 PM
Last analysis (VT)
7/3/2026, 11:41:36 PM
First scan (MalwareTips)
7/4/2026, 10:35:42 PM
Last scan (MalwareTips)
7/4/2026, 10:35:42 PM
Community reputation
-11flagged
Behavior tags
checks-user-inputoverlayhosts-modifierdetect-debug-environmentpeexelong-sleeps
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.