Malicious
Unsigned keygen installer with tier-1 hacktool detection, process injection, and YARA shellcode matches; prior imphash verdicted malicious.
658063b9a8e4469a01…6efc9412b8The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
This unsigned setup.exe exhibits multiple malicious indicators. Four tier-1 engines (Microsoft, GData, Sophos, TrendMicro) flagged it malicious, with Microsoft explicitly labelling it a hacktool and GData naming the pseb family. The file demonstrates process injection and process hollowing techniques — evasion tactics exclusive to malware. Four community YARA rules matched, including shellcode detection, indicating external researcher consensus on suspicious patterns. A prior file with the same imphash was previously verdicted malicious with the same pseb family. The popular threat label 'trojan.crack/keygen' and Malwarebytes' 'RiskWare.Crack' classification confirm the file is a crack/keygen tool. While the sandbox did not reach a malicious verdict, the combination of tier-1 detections, offensive behaviour, and external intelligence converges on malicious classification.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
Microsoft Defender tier-1 flags 'HackTool:Win32/Keygen' (hacktool=true); GData tier-1 names 'Generic.Trojan.PSEB.MOOG6L'
4 tier-1 engines malicious (Microsoft, GData, Sophos, TrendMicro) + 7 tier-2/low-trust = 11/60 total; tier1FamilyConsensus.family='pseb' (1 engine, not strong but named)
Behaviour: T1055 (Process Injection) + T1134 (Process Hollowing) observed; triggeredHeuristics 'MalwareTips.Synth.ProcessInjection' (high severity) confirms CreateRemoteThread/APC injection
YARAify matched 4 community rules including 'shellcode' and 'pe_detect_tls_callbacks' — external researcher consensus on evasion patterns
similarHashes: prior imphash verdict 'malicious' (9b7c34eefa6d…, ai:tier1_consensus_pseb, score=18) on same imphash; prevalence common_new (2815 submitters)
- No malicious sandbox verdict recorded
- No malicious contacted hosts detected
- No malicious dropped children confirmed (6 inspected, all unknown)
- No brand mismatch detected
- Tier-1 hacktool detection (Microsoft Defender)
- Process injection and process hollowing techniques (T1055, T1134)
- Four community YARA rules matched, including shellcode patterns
- Unsigned executable with no signer history
- Prior imphash verdict: malicious (pseb family)
- Crack/keygen tool classification (inherently malicious)
Block and quarantine this file immediately. Do not execute or allow distribution. If encountered on a system, perform a full antivirus scan and monitor for indicators of compromise related to the pseb family and process injection techniques.
crack corroborated by 3 sources
- 4 YARA rulesBorland, HUNTING_SUSP_TLS_SECTION, pe_detect_tls_callbacks
- VT (74 engines)crack
- MT AI Enginepseb
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\Users\<USER>\AppData\Local\Temp\is-84C9Q.tmp\setup.tmp
- C:\Users\<USER>\AppData\Local\Temp\is-D6UDN.tmp\_isetup\_setup64.tmp
- C:\Users\<USER>\AppData\Local\Temp\is-D6UDN.tmp\_isetup\_shfoldr.dll
- C:\Users\<USER>\AppData\Local\Temp\is-D6UDN.tmp\idp.dll
- C:\Users\<USER>\AppData\Local\Temp\is-D6UDN.tmp\innocallback.dll
- \Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
- \Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
Files this sample writes at runtime
This file drops 6 children at runtime. None are currently flagged malicious in our cache.
- 09af8004b85478e1eca0…47b449Never scannednever seen before
- a4c86fc4836ac728d7bd…95fd81Never scannednever seen before
- 9884e9d1b4f8a873ccbd…360d87Never scannednever seen before
- f4fc0187491a9cb89e23…bc44bbNever scannednever seen before
- 6afa2d104be6efe3d9a2…29809fNever scannednever seen before
- c652b4b564b3c85c3991…412c74Never scannednever seen before
1 corroborating signal from researcher-curated sources
- Borlandby malware-lu
- HUNTING_SUSP_TLS_SECTIONby chaosphereDetect PE files with .tls section that can be used for anti-debugging
- pe_detect_tls_callbacks
- shellcodeby nexMatched shellcode byte patterns
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
- Borland
- HUNTING_SUSP_TLS_SECTION
- pe_detect_tls_callbacks
- shellcode
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
EvidenceC:\Users\<USER>\AppData\Local\Temp\is-84C9Q.tmp\setup.tmp /SL5=$20194,4901458,140800,C:\Users\<USER>\Downloads\setup.exe
11 detections across 74 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Forensic fingerprint
- File name
- setup.exe
- Size
- 5.23 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 658063b9a8e4469a01e7d5e2146deb17f534468cd581d8d6ca62166efc9412b8
- MD5
- b6992eaec6dfec0e51805251c0803050
- SHA-1
- c575f190d7abd6a662b6e0ebe9246f7c4f211c65
- PE imphash
- 483f0c4259a9148c34961abbda6146c1
- First seen (VT)
- 6/9/2026, 7:06:36 PM
- Last analysis (VT)
- 6/24/2026, 5:44:06 AM
- First scan (MalwareTips)
- 6/24/2026, 6:18:07 AM
- Last scan (MalwareTips)
- 6/24/2026, 6:18:07 AM
- Community reputation
- +3trusted
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.