File scan report
Verdict Safe
Is Classic
No antivirus engine detected this long-established, verified-signed installer, although generic YARA matches and several offensive-technique mappings justify normal source…
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Ivaylo Beltchev
- Test run Completed
- First seen 8y ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 71 antivirus engines that checked it returned no detection, including 17 major antivirus engines, and the verified-signed file has circulated widely since 2018. Several YARA rules and offensive-technique mappings are concerning, but they are not corroborated by an engine detection, a malicious sandbox verdict, or a known-malicious file it created.
The strongest evidence is the complete absence of detections across 75 antivirus engines, including 17 major antivirus engines. The file is verified-signed by Ivaylo Beltchev, has no detected brand mismatch, and has been submitted 5,270 times by 3,310 sources since 2018. One completed sandbox recorded installer execution through msiexec and mapped four offensive techniques, but it produced no malicious sandbox verdict. Seven researcher YARA rules matched, including an Elysium-oriented rule, creating meaningful uncertainty despite the much broader contrary evidence. Host-reputation coverage was incomplete because only one host was inspected despite numerous recorded contacts, so the network activity cannot be described as fully checked. Overall, the long prevalence, signing, and unanimous antivirus results outweigh the uncorroborated behavioral and YARA alerts.
What We Detected
The sample is a Windows installer signed with a verified certificate issued to Ivaylo Beltchev. None of the 71 antivirus engines that checked it detected it, and all 17 reporting major antivirus engines—including BitDefender, ESET-NOD32, and Kaspersky—returned undetected results. It has also been observed since 2018 across 3,310 sources and 5,270 submissions.
Threat Behavior
One completed sandbox observed MSI installation activity and mapped T1055, T1543.003, T1547.001, and T1562.001. No malicious sandbox verdict was recorded, and no inspected child was identified as malicious, although all ten child verdicts remain individually unknown. Seven YARA rules matched, including “elysium,” but other matches concern certificates, debugging checks, overlays, or obfuscation and may be generic. Only one contacted host received a reputation cross-check despite numerous recorded IP and URL contacts, so no complete network-reputation result is available.
What To Do Now
Confirm that the SHA-256 hash 942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2 came from the intended Classic Shell release channel before running it. Keep security software enabled and avoid copies obtained from unofficial download mirrors.
Where this verdict could be wrong5 caveats
- YARAify matched 7 rules, including the malware-specific-looking 'elysium' rule; researcher rules can produce false positives, but this remains meaningful contrary evidence.
- The completed sandbox mapped activity to T1055, T1543.003, T1547.001, and T1562.001, techniques that warrant caution despite the absence of a malicious sandbox verdict.
- The cross-check of 1 host does not cover all 15 listed IP contacts and two URLs, so no complete host-reputation result is available.
- All 10 inspected files it created have unknown individual verdicts; the absence of a known-malicious dropped file does not establish that each child is benign.
- A community comment appeared to contain instructions aimed at automated analysis, so contaminated community commentary was ignored rather than treated as trustworthy evidence.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/71 antivirus engines detected the sample.
- All 17 reporting major antivirus engines returned undetected results.
- The signature for 'Ivaylo Beltchev' is verified and no brand mismatch was detected.
- The file has 5,270 submissions from 3,310 sources dating to 2018.
- No sandbox returned a malicious verdict and no dropped file is known to be malicious.
- A count of 7 matching community YARA rules includes the 'elysium' rule associated with stealer detection.
- Runtime mappings include T1055, T1543.003, T1547.001, and T1562.001.
- The cross-check of 1 host provides incomplete coverage of the recorded network contacts.
- droppedChildren inspected 10 files, but each child's individual verdict is unknown.
- This signer has no saved history, so no internal signer-history record is available.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 28sandbox rule tags
- 7spawned processes
- 2network contacts
- 40filesystem & mutex artifacts
Includes 28 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Ivaylo Beltchev.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 12, 2026, 2:19 PM UTC
- SHA-256
942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2- SHA-1
317604eba6e94e8777741d577b0ef160a0af3258- MD5
230d1965a035bc4c894941caa3d19a32
About this file
ClassicShellSetup.exe is a Win32 EXE file of 7.2 MB.
- Type and size
- Win32 EXE · 7.2 MB
- Signer
- Ivaylo BeltchevValid code signature.
- First seen
- Jul 28, 2018On VirusTotal.
- Submitted by
- 3,310 distinct sources
- Packer
- None detected
- Entropy
- 7.34 of 8
First scanned
Includes every engine result (75), 8 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is ClassicShellSetup.exe safe?
What is ClassicShellSetup.exe?
How many antivirus engines detected ClassicShellSetup.exe?
Is ClassicShellSetup.exe digitally signed?
What is the SHA-256 hash of ClassicShellSetup.exe?
Is it safe to run ClassicShellSetup.exe?
How up to date is this analysis of ClassicShellSetup.exe?
Community
Member reviews and reports for this exact file hash.