MalwareTipsTools

File scan report

Scan another file

Verdict Suspicious

Analyzed , 2 days ago

Is OxnaPDF-2.1.1-win-x64-Setup.exe safe? Treat it as suspicious.

Unsigned, barely distributed PDF-tool installer: one major antivirus engine calls it a generic trojan while three sandbox runs looked like an ordinary installer.

Why Suspicious? 3 antivirus engines flag it; nothing else confirms it.

Limited evidence · One sign points to a problem; nothing else confirms it.

Don't install it until you know where it came from

Do not install this copy — obtain the installer from the vendor's official website instead and let your security software scan it before running. Keep your antivirus and system protection enabled, and remove the program if you cannot confirm where this file came from.

What to do now5 steps

Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.

What to do

  1. Don't install it unless you're sure where it came from.

  2. Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.

  3. If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.

  4. It is only 2 days old. If you're unsure, scan it again in a few days; antivirus engines often catch up on new files.

If you already installed it

  1. Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.

Not sure what to do?

Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.

Paste this report's link in your topic so helpers can see what was found.

Why we think so

Share this file report

OxnaPDF-2.1.1-win-x64-Setup.exe: Suspicious — MalwareTips file scan

The link always shows the latest result for this exact file (its SHA-256 fingerprint).

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

3 of 68 flagged

  • Flagged 3
  • No detection 65
  • No result 7
FileOxnaPDF-2.1.1-win-x64-Setup.exe34.5 MBSHA-256 4cdebaaabe49…367307
  • Code signing Unsigned
  • Test run Completed
  • First seen 2d ago
3 of the 68 antivirus engines that checked it flag it, including ESET and Deep Instinct.

Chapter 02

Why we think so

5 points against it and 5 in its favour, checked against the scan evidence.

MT AI Engine · Verdict analysis

The reasoning behind this verdict

Analyst conclusion

Three of the 68 antivirus engines that checked it flagged this installer, including one major generic trojan label, and the file is unsigned with only a single submission behind it. Against that, the combined sandbox verdict was clean, no injected process was recorded, and the only network contact was the vendor's own update address. There is not enough to call it malicious, but nothing here establishes that it is trustworthy either.

Full reasoning

The scan picture is thin and contradictory. ESET-NOD32 calls the file a generic trojan, DeepInstinct returns a bare malicious verdict and a low-reliability engine reports a suspicious machine-learning score, while the other 65 engines that returned a result found nothing. The detections are generic rules on a large, freshly built installer rather than a named malware family, and no major antivirus engines agree on one family. The sandbox side argues the other way: three runs were combined as clean, the installer dropped its own application into the user profile, wrote normal uninstall entries and started an embedded browser component, and no injected process, credential access or encryption activity was observed. Network activity was limited to the vendor's own update address, and our host-reputation cross-reference found nothing known-bad among the hosts it inspected. The problem is identity and history: the file carries no valid signature, no publisher record, and it was first seen on Nov 9, 2026 with a single submitter, so there is no trusted anchor that would justify treating the detections as false positives. That combination of an unverified new binary and one major generic trojan label keeps it in cautious territory.

Detailed assessment

What We Detected

Three of the 68 antivirus engines that checked it flagged this file: ESET-NOD32 with a generic trojan label, DeepInstinct with a bare malicious verdict, and a lower-reliability engine with a suspicious machine-learning score. No family-level agreement exists among the major antivirus engines, and the remaining engines, including 17 major ones, returned nothing. The file is a 34 MB Windows installer for a PDF application, unsigned, with no publisher record and a single submission behind it, first seen on Nov 9, 2026.

What the Sandbox Showed

Three independent sandbox runs were combined as clean. The installer unpacked itself into the user profile, launched the bundled PDF application with an embedded Edge WebView2 browser component, created standard uninstall registry entries, and performed a single HTTPS request to the vendor's release manifest so it could check for updates. No process was injected into, nothing persisted beyond the advertised uninstall entries, and no credential store, encryption or defence-tampering activity was observed.

Signing and Reputation

There is no code signature and no signing history for any publisher of this name, so the file has no verifiable identity. Its distribution footprint is essentially nil at this point. Static inspection of the uploaded bytes found no hostile constructs, no packer and no unexpected embedded payload, and the only published malware reference databases returned no entries for it. Our host-reputation lookup for the two hosts involved found nothing known-bad, though that check covers only the hosts this file touched.

What To Do Now

Do not install this copy. If you want the application, get the installer directly from the vendor's official site over HTTPS and compare what you download with this file, and let your security software scan it before running. If you already installed it, run a full scan and review the uninstall entries and startup items for anything you do not recognise; if you cannot confirm the source, remove it. Keep your antivirus and system protection enabled throughout.

Where this verdict could be wrong3 caveats
  • A single generic major trojan label on a freshly built, unsigned installer is a common false-positive shape, and the clean sandbox observations plus the unflagged vendor update domain support that reading.
  • The earlier verdicts on files built with the same installer framework are all neutral or clean, which hints that other software packaged this way is usually harmless — but they come from unrelated publishers, so they say nothing specific about this one.
  • Our host-reputation check covered only two hosts, so an absence of known-bad contacts is weaker reassurance than a full network history would be.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Points in its favour
  • Three sandbox runs were combined as clean, with no injected process, no persistence beyond the advertised uninstall entries and no credential or encryption activity.
  • Network activity was limited to the vendor's own release manifest, and our host-reputation cross-reference found nothing known-bad among the hosts it inspected.
  • Static inspection of the uploaded bytes found no hostile constructs, no code packer and no hidden payload.
  • No published malware sample databases or community malware detection rules contain this file's hash.
  • The detections present are generic rule labels rather than a named malware family, and no major antivirus engines agree on one.
Points against
  • The installer is unsigned and has no publisher history, so there is no way to confirm who built it.
  • One major antivirus engine identifies it as a generic trojan, supported by a further machine-learning flag.
  • It has almost no distribution history — a single submission, first seen on Nov 9, 2026.
  • The file is large, carries a high-entropy resource section and an overlay, which is normal for bundled installers but also hides the bundled application code from quick inspection.
  • It contacts a remote update address on first run, which is standard for an updater but does give the vendor remote influence over what the application loads next.

7 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 3 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete
  • 3isolated sandbox runs
  • 39sandbox rule tags
  • 6spawned processes
  • 2network contacts
  • 33filesystem & mutex artifacts

What the test run showed

What the file did on a test computer

Confirmed in the test run

  • Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).

  • Moderate concern: Ran commands or a script on the test computer.

  • Moderate concern: Checked whether it was running on a test computer.

  • Moderate concern: Hid files or windows on the test computer.

  • Note: Read the user name of the test computer.

  • Note: Listed the programs running on the test computer.

  • Note: Talked to servers over the internet during the test run.

Sandbox labels we could not confirm (common in safe files too)

  • Not confirmed: A sandbox rule tagged this run as password-store access, but nothing touched the Windows password store.

  • Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.

  • Not confirmed: Showed activity a sandbox rule links to file encryption; no ransomware behaviour was confirmed.

  • Not confirmed: A sandbox rule tagged this run as setting up auto-start; no auto-start entry was recorded.

This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.

Recorded behavior

What happened in the test

Grouped by step. The order is not a timeline.

Seen in the test runWorked out from other results

  1. Input file

    The submitted object

    1
    1. Evidence 1 of 7: FileSeen in the test run

      OxnaPDF-2.1.1-win-x64-Setup.exe

      4cdebaaabe49c40b91c59a10de6d79cfed55ec6551dff8461933102721367307

      Uploaded file

  2. Processes

    What ran

    2
    1. Evidence 2 of 7: ProcessSeen in the test run

      msedgewebview2.exe

      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView" --webview-exe-name=OxnaPDF.exe --webview-exe-version=2.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4128 --field-trial-handle=1940,i,18352067088157212284,4994148482896097249,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3

      Test run
    2. Evidence 3 of 7: ProcessSeen in the test run

      OxnaPDF-2.1.1-win-x64-Setup.exe

      "C:\Users\<USER>\Desktop\OxnaPDF-2.1.1-win-x64-Setup.exe"

      Test run
    3. +1 more recorded observation

  3. Files

    Created or changed

    2
    1. Evidence 4 of 7: Written fileSeen in the test run

      db

      C:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Shared Dictionary\db

      Test run
    2. Evidence 5 of 7: Written fileSeen in the test run

      Trust Tokens-journal

      C:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\Trust Tokens-journal

      Test run
    3. +1 more recorded observation

  4. Network

    Hosts contacted

    2
    1. Evidence 6 of 7: Contacted hostSeen in the test run

      oxna.ai

      Contacted during the test run.

      Test run
    2. Evidence 7 of 7: Contacted hostSeen in the test run

      172.67.222.125

      Contacted during the test run.

      Test run
    3. +1 more recorded observation

7 facts from the test run. See the full activity list.

Runtime behaviour

What this file did when executed

This file was detonated in 3 sandboxes and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

1
  • VT: CLEANclean

Techniques observed in the sandbox

39

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

  • T1003· Credential theft
  • T1005
  • T1010
  • T1012
  • T1027· Obfuscated code
  • T1027.002· Obfuscated code
  • T1033· Reads user info
  • T1036
  • T1055· Process injection
  • T1057· Lists programs
  • T1059· Runs commands
  • T1069
  • T1071· Application protocol
  • T1082· System recon
  • T1083· Scans your files
  • T1112
  • T1115
  • T1125
  • T1129· Loads modules
  • T1134
  • T1222
  • T1485
  • T1486· File encryption
  • T1497· Sandbox evasion
  • T1497.001· Sandbox evasion
  • T1529
  • T1547.009· Auto-start
  • T1548
  • T1552· Credential search
  • T1552.001· Credential search
  • T1553
  • T1553.002
  • +7 more

Observed activity

Processes started
6

Programs the file ran, with their command lines.

  • msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView" --webview-exe-name=OxnaPDF.exe --webview-exe-version=2.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4128 --field-trial-handle=1940,i,18352067088157212284,4994148482896097249,262144 --enable-features=MojoIpcz…
  • OxnaPDF-2.1.1-win-x64-Setup.exe"C:\Users\<USER>\Desktop\OxnaPDF-2.1.1-win-x64-Setup.exe"
  • OxnaPDF.exe"C:\Users\<USER>\AppData\Local\Programs\OxnaPDF\OxnaPDF.exe"
  • msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OxnaPDF.exe --webview-exe-version=2.1.1 --user-data-dir="C:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2696.5268.1466403647405622674
  • msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.129 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=12…
  • OxnaPDF-2.1.1-win-x64-Setup.exe"C:\Users\user\Desktop\OxnaPDF-2.1.1-win-x64-Setup.exe"
Network contacts
2

2 hosts, listed as 1 domain, 1 address, 1 link. Links show the host and path only.

  • Domainoxna.ai
  • IP address172.67.222.125
  • URLhttps://oxna.ai/pdf/api/desktop/releases.json
Files
30

Files the file created, changed or deleted.

  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Shared Dictionary\db
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\Trust Tokens-journal
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Shared Dictionary\db-journal
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\Cookies
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\Cookies-journal
Show all 30 entries for files
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\c689c55e-8ddf-41f0-96cb-b4d246e094e1.tmp
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Shared Dictionary\cache\index-dir\temp-index
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\SCT Auditing Pending Reports
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\891d762e-8e02-4513-bf91-3df80c9a3900.tmp
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\SCT Auditing Pending Reports~RF32bc4.TMP
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\835519ed-2e47-4160-ad9a-54f5b1320f05.tmp
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\SCT Auditing Pending Reports~RF332f8.TMP
  • WrittenC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Cache\Cache_Data\index
  • DeletedC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\c689c55e-8ddf-41f0-96cb-b4d246e094e1.tmp
  • DeletedC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Shared Dictionary\cache\index-dir\temp-index
  • DeletedC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\SCT Auditing Pending Reports~RF32bc4.TMP
  • DeletedC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\SCT Auditing Pending Reports~RF332f8.TMP
  • DeletedC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\bac1b01e-90b9-4c2c-a3fd-89dc40f435c5.tmp
  • DeletedC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\16fcbd1e-ff40-4822-ac73-7b4594c35372.tmp
  • DeletedC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\Default\Network\a0701bbe-5d88-410f-8298-8727d5f21e4e.tmp
  • DeletedC:\Users\<USER>\AppData\Local\Temp\nsi52C0.tmp\modern-wizard.bmp
  • DeletedC:\Users\<USER>\AppData\Local\Temp\nsi52C0.tmp\nsDialogs.dll
  • DeletedC:\Users\<USER>\AppData\Local\Temp\nsi52C0.tmp\System.dll
  • DeletedC:\Users\<USER>\AppData\Local\Temp\nsi52C0.tmp\
  • DeletedC:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin
  • DeletedC:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update
  • DeletedC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\BrowserMetrics-spare.pma
  • DeletedC:\Users\<USER>\AppData\Local\ai.oxna.v2\EBWebView\b55d915e-ad50-45df-998e-aa0b11e2cae8.tmp
Registry and auto-start
16

Settings the file changed, including ways to start again after a restart.

  • SetHKEY_CURRENT_USER\SOFTWARE\OxnaPDF\InstallDir
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OxnaPDF\DisplayName
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OxnaPDF\DisplayVersion
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OxnaPDF\Publisher
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OxnaPDF\DisplayIcon
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OxnaPDF\InstallLocation
Show all 16 entries for registry and auto-start
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OxnaPDF\URLInfoAbout
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OxnaPDF\UninstallString
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OxnaPDF\QuietUninstallString
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OxnaPDF\NoModify
  • SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OxnaPDF\NoRepair
  • SetHKEY_CURRENT_USER\Software\Classes\OxnaPDF.pdf\(Default)
  • SetHKEY_CURRENT_USER\Software\Classes\OxnaPDF.pdf\DefaultIcon\(Default)
  • SetHKEY_CURRENT_USER\Software\Classes\OxnaPDF.pdf\shell\open\command\(Default)
  • SetHKEY_CURRENT_USER\Software\Classes\Applications\OxnaPDF.exe\shell\open\command\(Default)
  • DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings
Mutexes
3

Named locks a program uses so only one copy runs; malware families often reuse them.

  • cversions.3.m
  • Local\ChromeProcessSingletonStartup!
  • __OMADM_NAMED_MUTEX__
Sandbox background — not the file
2

The analysis machine's own processes and connections, recorded in every run.

  • VM processExplorer.EXEC:\Windows\Explorer.EXE
  • VM host162.159.36.2
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked
  • 9c76f4d53ceee2a471c9…d114cbNot checked
    no saved verdict
  • 86545b66cdb0603bc26b…da96d5Not checked
    no saved verdict
  • 67e63d1691dfee4c3969…97260cNot checked
    no saved verdict
  • 9503a2a94c5e28ec02c7…aa62f8Not checked
    no saved verdict
  • afe032f942e2ed0bf749…894432Not checked
    no saved verdict
  • 863a34001f6df39ff0e0…e7bf67Not checked
    no saved verdict
  • c0fe3a238a867dc119de…7c4498Not checked
    no saved verdict
  • f906ecf3bf145dd30532…950eabNot checked
    no saved verdict
  • ba48cb5e3fae38a3bb59…aa60acNot checked
    no saved verdict
  • 5382dfd18f53b0a7d88a…bb2a46Not checked
    no saved verdict

Chapter 04

Technical details

3 of the 68 antivirus engines that checked it flag it; no publisher signature.

Our file inspection

No risky structure found

We opened the uploaded Windows program in an isolated sandbox and read its structure without running it.

CompleteWindows program
Network indicators in the file
nsis.sf.net

1 link found. Only domains are shown; paths and query strings are never published.

Notable imports
clipboard ×1execution ×1privilege ×1

Checked on Nov 9, 2026 while the file was uploaded. MalwareTips deleted its copy afterwards; VirusTotal keeps the uploaded file.

Sources checked

Every check behind this verdict

7 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.

SourceStatusResultChecked
Antivirus enginesVirusTotal · 75 enginesCompleteRisk signal: 3 of 68 engines flagged it · 7 gave no result Details for antivirus engines
Sandbox runVirusTotal sandboxes · CAPA, CAPE Sandbox, ZenboxComplete3 runs: 1 clean, 2 without a verdict Details for sandbox run
Contacted hostsMalwareTips URL scannerComplete2 contacted hosts checked Details for contacted hosts
Static analysisMalwareTips, without running the fileCompleteNothing risky in the file's structure Details for static analysis
Signature rulesYARAify community rules + MalwareTips rulesComplete2 MalwareTips behaviour rules Details for signature rules
Malware sample databaseabuse.ch MalwareBazaarCompleteNot listed
Known-software referenceCIRCL hashlookupCompleteNo match

Engines that flagged it 3

  • ESET-NOD32 (major engine)Win64/Kryptik.GNB trojan
  • DeepInstinctMALICIOUS
  • Trapminesuspicious.low.ml.score

File fingerprint

Last analyzed
Nov 9, 2026, 4:42 AM UTC
SHA-256
4cdebaaabe49c40b91c59a10de6d79cfed55ec6551dff8461933102721367307
SHA-1
d6b5e377157a967f3c4d903f507035203a85dd8d
MD5
b1b142ea7a92a40a29c858ecdcdb3b05

About this file

OxnaPDF-2.1.1-win-x64-Setup.exe says it is OxnaPDF installer (OxnaPDF), 34.5 MB.

Claims to be
OxnaPDF installer (OxnaPDF)From the file's own version information, written by whoever built it.
Type and size
Win32 EXE · 34.5 MB
Signer
UnsignedNo code signature.
First seen
Nov 9, 2026On VirusTotal.
Submitted by
1 sourceRarely seen: few people have submitted this exact file.
Packer
None detected
Entropy
7.02 of 8

First scanned

Antivirus consensus

3 of 68 engines flagged this file

3 malicious0 suspicious65 not flagged7 no result

7 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

  • Tier-118 engines
    1flagged
  • Tier-234 engines
    1flagged
  • Low-trust16 engines
    1flagged
View all 75 engine results
  • DeepInstinctMalicious: MALICIOUS
  • ESET-NOD32Malicious: Win64/Kryptik.GNB trojan
  • TrapmineMalicious: suspicious.low.ml.score
  • AcronisClean
  • AhnLab-V3Clean
  • AlibabaClean
  • alibabacloudClean
  • ALYacClean
  • Antiy-AVLClean
  • APEXClean
  • ArcabitClean
  • AvastClean
  • Avast-MobileNo result
  • AVGClean
  • AviraClean
  • BitDefenderClean
  • BitDefenderFalxNo result
  • BkavClean
  • CAT-QuickHealClean
  • ClamAVClean
  • CMCClean
  • CrowdStrikeClean
  • CTXClean
  • CylanceClean
  • CynetNo result
  • DrWebClean
  • ElasticClean
  • EmsisoftClean
  • F-SecureClean
  • FortinetClean
  • GDataClean
  • GoogleClean
  • GridinsoftClean
  • huorongClean
  • IkarusClean
  • JiangminClean
  • K7AntiVirusClean
  • K7GWClean
  • KasperskyClean
  • KingsoftClean
  • LionicClean
  • MalwarebytesClean
  • MaxSecureClean
  • McAfeeDClean
  • MicrosoftClean
  • MicroWorld-eScanClean
  • NANO-AntivirusClean
  • PaloaltoClean
  • PandaClean
  • RisingClean
  • SangforClean
  • SentinelOneClean
  • SkyhighNo result
  • SophosClean
  • SUPERAntiSpywareClean
  • SymantecClean
  • SymantecMobileInsightNo result
  • TACHYONClean
  • tehtrisNo result
  • TencentClean
  • TrellixENSClean
  • TrendMicroClean
  • TrendMicro-HouseCallClean
  • TrustlookNo result
  • VaristClean
  • VBA32Clean
  • VIPREClean
  • VirITClean
  • ViRobotClean
  • WebrootClean
  • XcitiumClean
  • YandexClean
  • ZillyaClean
  • ZoneAlarmClean
  • ZonerClean
Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

2 heuristics
MITRE ATT&CK profile
Defense evasion× 1Cred access× 1
Behavior heuristics
Deterministic patterns derived from scan data and observed runtime behavior
  • ProcessInjection
    T1055
    low

    VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.

    Evidence
    T1055 (sandbox MITRE mapping)
  • CredentialDumper
    T1003T1003.001
    low

    VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.

    Evidence
    T1003 (sandbox MITRE mapping)
PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 7.02Unpacked
Section entropy5 sections
.text
6.45
.rdata
5.10
.data
4.12
.ndata
0.00
.rsrc
7.76
0.0Packed threshold 7.28.0
Prevalence

How widely this file has been seen

Barely seen in the wild and first surfaced recently. 3 antivirus detections make that low prevalence materially relevant, but rarity alone is not proof of malware.

Rare & new
Unique uploaders
1
Very few people have ever uploaded this — rare.
Total submissions
1
Includes repeat uploads by the same source.
First seen
2d ago
Nov 9, 2026
Prevalence quadrant
here
Rare · New
Needs evidence-led scrutiny
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is OxnaPDF-2.1.1-win-x64-Setup.exe safe, or is it malware?
OxnaPDF-2.1.1-win-x64-Setup.exe is rated Suspicious: some signs point to a problem, but nothing confirms it is harmful. 3 of the 68 antivirus engines that checked it flag it. Don't install it unless you're sure where it came from. If you need the software, download a fresh installer from the developer's own website.
What is OxnaPDF-2.1.1-win-x64-Setup.exe?
OxnaPDF-2.1.1-win-x64-Setup.exe is a software installer, about 34.5 MB. Its version information says it is “OxnaPDF installer” (OxnaPDF). Version information is written by whoever built the file, so it is a claim, not proof of who made it. VirusTotal first saw it on Nov 9, 2026.
How many antivirus engines detected OxnaPDF-2.1.1-win-x64-Setup.exe?
3 of the 68 antivirus engines that checked it flag OxnaPDF-2.1.1-win-x64-Setup.exe, including ESET and Deep Instinct. We weigh which engines flagged it and what else the scan found, not just the count.
What should I do if I already installed OxnaPDF-2.1.1-win-x64-Setup.exe?
No infection is confirmed: the rating is a caution, not a malware finding. 1) Check where it came from. If you can't confirm the source, delete it. 2) Run a full scan with your security software. 3) If the scan finds something, follow its removal steps and change passwords you typed on the device since then.
What is the SHA-256 hash of OxnaPDF-2.1.1-win-x64-Setup.exe?
The SHA-256 fingerprint of OxnaPDF-2.1.1-win-x64-Setup.exe is 4cdebaaabe49c40b91c59a10de6d79cfed55ec6551dff8461933102721367307, and its MD5 is b1b142ea7a92a40a29c858ecdcdb3b05. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.
How up to date is this analysis of OxnaPDF-2.1.1-win-x64-Setup.exe?
This report reflects the scan on Nov 9, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.
Chapter 06

Community

Member reviews and reports for this exact file hash.

Related file reports

Recent reports on other files with the same rating.

All file reports
Scan another
Check a different file
URL instead?
Check if a link is safe
This report and its SHA-256 fingerprint are public, so the next person who checks the same file gets an instant answer; documents and images are listed by type instead of their file name. A file we had not seen before is uploaded to VirusTotal, whose security partners and subscribers can download it; MalwareTips deletes its own copy after the scan. If you ran this file and are worried, scan your device with up-to-date security software.