File scan report
Verdict Safe
Is KH358-
Only Cylance raised a generic detection among 75 engines, while the completed sandbox found no malicious outcome despite an unconfirmed mapping.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 70 flagged
- Flagged 1
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 8d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 70 antivirus engines that checked it flagged this installer, and that was a generic Cylance detection with no support from major antivirus engines.
The strongest indicator is the highly isolated antivirus result: Cylance alone reported a generic “Unsafe” label, while no major antivirus engines detected malware. One completed sandbox run produced no malicious verdict and showed installer-like temporary execution. It mapped T1055, but no injected process, target, or exact injection method was recorded, substantially limiting that signal. The executable is nevertheless unsigned and so publisher identity and longer-term reputation remain unestablished. No malware-specific YARA rule, named family consensus, malicious child verdict, or external malware listing corroborates the lone detection. The host-reputation cross-check was not completed or saved, although the runtime record contains no sample-attributed network contacts to evaluate.
What We Detected
Cylance was the only engine to flag the file, using the generic label “Unsafe.” None of the major antivirus engines identified malware, and there is no consensus on a named threat family. This less reliable-only pattern makes a false positive substantially more likely than a confirmed infection.
Threat Behavior
One completed sandbox run launched the executable and temporary installer copies, without producing a malicious sandbox verdict. The runtime record mapped T1055, which can indicate process injection, but it named no injection technique or target and recorded no injected processes. One dropped file lacks a saved verdict; that is missing coverage rather than evidence against the parent. No complete contacted-host reputation result is available.
What To Do Now
Because the file is unsigned and has only obtain it from the project's expected distribution channel and verify any publisher-provided checksum before running it. Keep security software enabled, and consider waiting for broader reputation or testing it in an isolated environment if the source cannot be verified.
Where this verdict could be wrong3 caveats
- The executable is unsigned and so its claimed origin cannot be authenticated.
- The sandbox mapped possible process injection under T1055, although it did not identify a method or target process.
- Two samples built with the same import table were previously associated with OfferCore, but they had different publishers and the import-table fingerprint is also shared by benign installers.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 70 antivirus engines that checked it flagged the file, and the sole result was a generic less reliable detection.
- No major antivirus engines detected malware or agreed on a threat family.
- The completed sandbox run did not return a malicious result.
- No malware-specific research rule or external malware listing matched the sample.
- No inspected child had a saved malicious verdict.
- The Windows executable has no digital signature, so its publisher cannot be authenticated.
- It is and has only one recorded submitter, leaving little reputation history.
- The sandbox mapped possible process injection, but did not identify a target or method.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 5spawned processes
- 0network contacts
- 4filesystem & mutex artifacts
Includes the sandbox verdicts, 11 mapped techniques, every process, file, registry and network entry and 1 dropped file.
Show the technical evidenceChapter 04
Technical details
1 of the 70 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- CylanceUnsafe
File fingerprint
- Last analyzed
- Oct 18, 2026, 12:52 AM UTC
- SHA-256
793dd9b6db2010fc1780cdcacdd942911144a0be8374a7b8331f4c8faa773429- SHA-1
38942679b6338a3a578dd488eac24e9b7ed6e659- MD5
2a17ca3a73e2812fb0dbbb39b3a2ccaf
About this file
KH358-2-Days-Port-Setup-0.1.2.exe is a Win32 EXE file of 28.6 MB.
- Type and size
- Win32 EXE · 28.6 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 18, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 6.36 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is KH358-2-Days-Port-Setup-0.1.2.exe safe?
What is KH358-2-Days-Port-Setup-0.1.2.exe?
How many antivirus engines detected KH358-2-Days-Port-Setup-0.1.2.exe?
What is the SHA-256 hash of KH358-2-Days-Port-Setup-0.1.2.exe?
Is it safe to install KH358-2-Days-Port-Setup-0.1.2.exe?
How up to date is this analysis of KH358-2-Days-Port-Setup-0.1.2.exe?
Community
Member reviews and reports for this exact file hash.