File scan report
Verdict Suspicious
Is Outloud
Three of the 71 antivirus engines that checked it raised generic alerts, but the unsigned, installer lacks enough publisher history or corroboration to dismiss them confidently.
Read the whole reasonShow less
Why Suspicious? 3 antivirus engines flag it, but no major engine agrees; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Verify the download source and obtain publisher confirmation before execution. Keep security protection enabled and avoid production systems until the dropped components receive separate analysis.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already installed it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
3 of 71 flagged
- Flagged 3
- No detection 68
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 8d ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only three of the 71 antivirus engines that checked it flagged this installer, with no major detections or named-family consensus. Its unsigned and status warrants caution, although one sandbox run found no offensive behavior and external intelligence supplied no malware-specific corroboration.
DeepInstinct, Skyhigh, and APEX flagged the sample, but none is a detection from a major antivirus engine and their labels are generic. The installer is unsigned and has only one known submission on its first observed day, so there is no established publisher or prevalence history to offset those alerts. One completed sandbox run showed temporary installer components and Restart Manager registry activity without offensive techniques, persistence, network contacts, or a malicious sandbox result. Malware-specific researcher rules and the malware repository did not match the hash. Prior files sharing its import-table fingerprint have sharply mixed outcomes and different signers, indicating a common installer-framework collision rather than trustworthy similarity. Host-reputation checking and final verdicts for two dropped files are unavailable, leaving meaningful uncertainty.
What We Detected
Three of the 71 antivirus engines that checked it flagged the executable. DeepInstinct and Skyhigh supplied smaller generic or obfuscation-oriented labels, while APEX supplied a less reliable generic alert; none of the major antivirus engines flagged it, and there is no named-family consensus.
Threat Behavior
One sandbox run launched an installer component from a temporary directory, wrote setup-related temporary files, and updated Windows Restart Manager session keys. It recorded no offensive MITRE techniques, persistence indicators, process injection, sample-attributed network contacts, or malicious sandbox verdict. Two dropped files lack saved verdicts, and no complete contacted-host reputation result is available.
Context and Limitations
The executable is unsigned and from one submitter, which limits confidence in its provenance. No malware-specific researcher rule or malware-repository match corroborated the alerts. Similar files sharing this import-table fingerprint have mixed outcomes and unrelated signers, so that similarity is weak because installer frameworks commonly reuse import-table fingerprint.
What To Do Now
Do not run it on a production system until its source and publisher can be independently verified. Keep security software enabled and, if testing is necessary, use an isolated disposable environment while obtaining verdicts for the two dropped components.
Where this verdict could be wrong3 caveats
- No major antivirus engines flagged the file, and the three detections are generic rather than a consensus on a named malware family.
- The completed sandbox run produced no malicious verdict or offensive technique, although one run offers limited behavioral coverage.
- No malware-specific researcher rule or malware-repository match corroborated the detections.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 17 major antivirus engines flagged the sample.
- The completed sandbox run reported no malicious outcome or offensive technique.
- No persistence, process injection, or sample-attributed network contact was observed.
- No malware-specific researcher rule or malware-repository match was found.
- Static analysis did not identify packing or high-entropy code.
- The Windows executable is unsigned, so its publisher cannot be authenticated.
- It was first observed on Oct 18, 2026 and has only one known submitter.
- Three antivirus engines raised generic malicious or obfuscation-related alerts.
- Two files created during execution have no saved verdict.
- A complete reputation check for contacted hosts is unavailable.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 1spawned processes
- 0network contacts
- 3filesystem & mutex artifacts
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 4: FileSeen in the test run
OutloudSAPI_Setup.exe
7baf845264263619fd1f6af200c5d8ee5ba567ef1b211ce7c4fa4ac3b9edc7f4
Uploaded file
- 1
Processes
What ran
- Evidence 2 of 4: ProcessSeen in the test run
OutloudSAPI_Setup.exe
C:\Users\<USER>\AppData\Local\Temp\is-OFBC16SN5B.tmp\OutloudSAPI_Setup.tmp /SL5=$2018C,10803176,893952,C:\Users\<USER>\Downloads\OutloudSAPI_Setup.exe
Test run
- 2
Files
Created or changed
- Evidence 3 of 4: Written fileSeen in the test run
OutloudSAPI_Setup.tmp
C:\Users\<USER>\AppData\Local\Temp\is-OFBC16SN5B.tmp\OutloudSAPI_Setup.tmp
Test run - Evidence 4 of 4: Written fileSeen in the test run
Setup Log 2026-10-16 #001.txt
C:\Users\<USER>\AppData\Local\Temp\Setup Log 2026-10-16 #001.txt
Test run - +1 more recorded observation
4 facts from the test run. See the full activity list.
Includes every process, file, registry and network entry and 1 dropped file.
Show the technical evidenceChapter 04
Technical details
3 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 3
- APEXMalicious
- DeepInstinctMALICIOUS
- SkyhighBehavesLike.Win32.ObfuscatedPoly.wc
File fingerprint
- Last analyzed
- Oct 18, 2026, 5:22 AM UTC
- SHA-256
7baf845264263619fd1f6af200c5d8ee5ba567ef1b211ce7c4fa4ac3b9edc7f4- SHA-1
0562f1b68bfae945850167b79269587dba24883f- MD5
4bb4550d07806121de9cff4e13116e53
About this file
OutloudSAPI_Setup.exe is a Win32 EXE file of 12.0 MB.
- Type and size
- Win32 EXE · 12.0 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 18, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 6.36 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is OutloudSAPI_Setup.exe safe, or is it malware?
What is OutloudSAPI_Setup.exe?
How many antivirus engines detected OutloudSAPI_Setup.exe?
What should I do if I already installed OutloudSAPI_Setup.exe?
What is the SHA-256 hash of OutloudSAPI_Setup.exe?
How up to date is this analysis of OutloudSAPI_Setup.exe?
Community
Member reviews and reports for this exact file hash.