MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Suspicious

Unsigned installer showing process-injection and LSASS activity flagged by one low-trust engine.

Trust score45Caution
MT AI confidence · 55%
AirwindowsConsolidated-2026-06-27-9cf9ddf-Windows-64bit-setup.exe
10.3 MB
7a2be93276d1d19142…cf1908c457
Antivirus engines
1 of 73 flagged
Code signing
Unsigned
Age
First seen 10 days ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

55%Confidence
Moderate
Reasoning

The file is an unsigned Windows installer with medium prevalence. Engines show only a single low-trust detection and zero tier-1 malicious flags. Sandbox reports offensive MITRE techniques T1055 and T1134 plus two synthesis heuristics for injection and credential-dumping behaviour. Similar-hash RAG returns one safe verdict on an imphash match that lacks signer correlation. The combination of unsigned status, suspicious runtime activity, and lack of strong malicious consensus places the sample in mixed-signals territory.

Key signals · 4

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines: 1/69 malicious (APEX low_trust), tier1Malicious=0, onlyLowTrustFlagging=true

  2. behaviour.offensiveTechniques: T1055, T1134; triggeredHeuristics: MalwareTips.Synth.ProcessInjection (high), MalwareTips.Synth.CredentialDumper (medium)

  3. signing.verified=false, prevalence.classification=medium, similarHashes[0].verdict=safe (imphash match)

  4. droppedChildren.hasMaliciousChild=false, externalIntel no hits, behaviour.hasMaliciousSandboxVerdict=false

Points in its favour
  • Zero tier-1 malicious detections
  • No malicious dropped children
  • No malicious contacted hosts
  • Medium prevalence with 6 submitters
Points against
  • Unsigned binary
  • Sandbox observed T1055 process injection
  • Sandbox observed LSASS access (T1134)
  • High-severity synthesis heuristic fired
What to do

Treat as suspicious pending further verification; do not execute on production systems without sandboxing.

Sources disagree

1 contradiction resolved by the scoring engine

Only low-trust / heuristic engines flagged this file
1 engine from the heuristic / generic-AI set flagged it. No tier-1 engine agreed.
Detection weight reduced in scoring.
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
17

Adversary techniques mapped to the MITRE ATT&CK framework.

T1012T1027T1027.002T1033T1036T1055T1059T1070T1071T1082T1083T1129T1134T1497.001T1529T1614T1614.001
Spawned processes
11
$(unnamed)
"C:\Users\<USER>\Desktop\ndowsConsolidated-2026-06-27-9cf9ddf-Windows-64bit-setup.exe"
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\is-92UUN.tmp\ndowsConsolidated-2026-06-27-9cf9ddf-Windows-64bit-setup.tmp" /SL5="$50026,9953561,832512,C:\Users\<USER>\Desktop\ndowsConsolidated-2026-06-27-9cf9ddf-Windows-64bit-setup.exe"
$(unnamed)
C:\Windows\system32\services.exe
$(unnamed)
C:\Windows\System32\svchost.exe -k NetworkService -p
$(unnamed)
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
$(unnamed)
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
$(unnamed)
C:\Windows\system32\lsass.exe
$(unnamed)
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
+3 more processes captured.
Filesystem & mutexes
14
Files written12
  • C:\Users\<USER>\AppData\Local\Temp\is-92UUN.tmp\ndowsConsolidated-2026-06-27-9cf9ddf-Windows-64bit-setup.tmp
  • C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
  • C:\Users\<USER>\AppData\Local\Temp\is-PFBTO.tmp\AirwindowsConsolidated-2026-06-27-9cf9ddf-Windows-64bit-setup.tmp
  • C:\Users\<USER>\AppData\Local\Temp\is-1PP91.tmp\_isetup\_setup64.tmp
  • C:\Users\user\AppData\Local\Programs
+7 more
Mutexes created2
  • \Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
  • \Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
Dropped payload

Files this sample writes at runtime

This file drops 2 children at runtime. None are currently flagged malicious in our cache.

2 unseen
  • 3badd233a5a6cc372e7e…1f1850Never scanned
    never seen before
  • 388a796580234efc95f3…136f95Never scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

2 synthesis
MITRE ATT&CK profile
Defense evasion× 1Cred access× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • ProcessInjection
    T1055
    high

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    C:\Windows\System32\svchost.exe -k NetworkService -p
  • CredentialDumper
    T1003T1003.001
    medium

    Sandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.

    Evidence
    C:\Windows\system32\lsass.exe
Antivirus engine breakdown

1 detection across 73 engines

1 malicious0 suspicious72 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-240 engines
0flag
Mainstream engines with mixed FP rates
Low-trust16 engines
1flag
Heuristic / generic-AI engines (high FP rate)
APEX
malicious
Malicious
Hash 7a2be93276d1… cross-referenced against 73 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked
Section entropy10 sections
.text
6.36
.itext
5.97
.data
5.05
.bss
0.00
.idata
5.03
.didata
2.75
.edata
1.88
.tls
0.00
.rdata
1.38
.rsrc
3.70
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
6
Moderate upload volume.
Total submissions
6
Includes repeat uploads by the same source.
First seen by VT
10d ago
Jun 28, 2026
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
6/28/2026, 2:31:55 AM
First seen (MalwareBazaar)
—
Last analysis (VT)
7/7/2026, 12:32:26 PM
Scanned here
7/8/2026, 12:50:56 AM
File name
AirwindowsConsolidated-2026-06-27-9cf9ddf-Windows-64bit-setup.exe
Size
10.28 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
7a2be93276d1d191429eabb82c1fd99b0f4955904941a911dee3f6cf1908c457
MD5
6ffcb9a0238e86427428e97569981fca
SHA-1
e7c08eec92472ab1dbdb9d1e92c09d5441dfff55
PE imphash
e569e6f445d32ba23766ad67d1e3787f
First seen (VT)
6/28/2026, 2:31:55 AM
Last analysis (VT)
7/7/2026, 12:32:26 PM
First scan (MalwareTips)
7/7/2026, 12:22:21 PM
Last scan (MalwareTips)
7/8/2026, 12:50:56 AM
Behavior tags
peexeoverlay
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.