File scan report
Verdict Safe
Is Classic
No antivirus engine detected this long-established, verified-signed installer, although generic YARA matches and several offensive-technique mappings justify normal source…
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Ivaylo Beltchev
- Test run Completed
- First seen 8y ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 71 antivirus engines that checked it returned no detection, including 17 major antivirus engines, and the verified-signed file has circulated widely since 2018. Several YARA rules and offensive-technique mappings are concerning, but they are not corroborated by an engine detection, a malicious sandbox verdict, or a known-malicious file it created.
The strongest evidence is the complete absence of detections across 75 antivirus engines, including 17 major antivirus engines. The file is verified-signed by Ivaylo Beltchev, has no detected brand mismatch, and has been submitted 5,270 times by 3,310 sources since 2018. One completed sandbox recorded installer execution through msiexec and mapped four offensive techniques, but it produced no malicious sandbox verdict. Seven researcher YARA rules matched, including an Elysium-oriented rule, creating meaningful uncertainty despite the much broader contrary evidence. Host-reputation coverage was incomplete because only one host was inspected despite numerous recorded contacts, so the network activity cannot be described as fully checked. Overall, the long prevalence, signing, and unanimous antivirus results outweigh the uncorroborated behavioral and YARA alerts.
What We Detected
The sample is a Windows installer signed with a verified certificate issued to Ivaylo Beltchev. None of the 71 antivirus engines that checked it detected it, and all 17 reporting major antivirus engines—including BitDefender, ESET-NOD32, and Kaspersky—returned undetected results. It has also been observed since 2018 across 3,310 sources and 5,270 submissions.
Threat Behavior
One completed sandbox observed MSI installation activity and mapped T1055, T1543.003, T1547.001, and T1562.001. No malicious sandbox verdict was recorded, and no inspected child was identified as malicious, although all ten child verdicts remain individually unknown. Seven YARA rules matched, including “elysium,” but other matches concern certificates, debugging checks, overlays, or obfuscation and may be generic. Only one contacted host received a reputation cross-check despite numerous recorded IP and URL contacts, so no complete network-reputation result is available.
What To Do Now
Confirm that the SHA-256 hash 942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2 came from the intended Classic Shell release channel before running it. Keep security software enabled and avoid copies obtained from unofficial download mirrors.
Where this verdict could be wrong5 caveats
- YARAify matched 7 rules, including the malware-specific-looking 'elysium' rule; researcher rules can produce false positives, but this remains meaningful contrary evidence.
- The completed sandbox mapped activity to T1055, T1543.003, T1547.001, and T1562.001, techniques that warrant caution despite the absence of a malicious sandbox verdict.
- The cross-check of 1 host does not cover all 15 listed IP contacts and two URLs, so no complete host-reputation result is available.
- All 10 inspected files it created have unknown individual verdicts; the absence of a known-malicious dropped file does not establish that each child is benign.
- A community comment appeared to contain instructions aimed at automated analysis, so contaminated community commentary was ignored rather than treated as trustworthy evidence.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/71 antivirus engines detected the sample.
- All 17 reporting major antivirus engines returned undetected results.
- The signature for 'Ivaylo Beltchev' is verified and no brand mismatch was detected.
- The file has 5,270 submissions from 3,310 sources dating to 2018.
- No sandbox returned a malicious verdict and no dropped file is known to be malicious.
- A count of 7 matching community YARA rules includes the 'elysium' rule associated with stealer detection.
- Runtime mappings include T1055, T1543.003, T1547.001, and T1562.001.
- The cross-check of 1 host provides incomplete coverage of the recorded network contacts.
- droppedChildren inspected 10 files, but each child's individual verdict is unknown.
- This signer has no saved history, so no internal signer-history record is available.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 28sandbox rule tags
- 7spawned processes
- 2network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
28MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1016· Network recon
- T1018
- T1027· Obfuscated code
- T1036
- T1053· Scheduled task
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1070.004· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1091· USB spreading
- T1095· Custom network
- T1120
- T1129· Loads modules
- T1176
- T1185
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1543.003· Service install
- T1547.001· Auto-start
- T1562.001· Disables security
- T1573
- T1574.001· Execution hijack
- T1574.002· Execution hijack
Observed activity
Processes started
7Programs the file ran, with their command lines.
ClassicShellSetup.exe"C:\Users\<USER>\AppData\Local\Temp\ClassicShellSetup.exe"msiexec.exemsiexec.exe /i "C:\ProgramData\ClassicShellSetup64_4_3_1.msi"wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -EmbeddingClassicShellSetup.exe%SAMPLEPATH%\ClassicShellSetup.exemsiexec.exeC:\Windows\SysWOW64\msiexec.exeClassicShellSetup_4_3_1.exe%SAMPLEPATH%\ClassicShellSetup_4_3_1.exe
Show all 7 entries for processes started
classic-shell.exe%SAMPLEPATH%\classic-shell.exe
Network contacts
22 hosts, listed as 1 address, 2 links. Links show the host and path only.
- IP address
168.62.240.75 - URL
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg= - URL
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAO8Mw76cwRWJWQVB4vPpBA=
Files
30Files the file created, changed or deleted.
- Written
C:\ProgramData\ClassicShellSetup64_4_3_1.msi - Written
C:\MSIdf5f2.tmp - Written
C:\ProgramData - Written
C:\ProgramData\Microsoft\Windows\Templates - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Caches - Written
C:\Users\user\AppData\Local\Temp\MSI7F75.tmp
Show all 30 entries for files
- Written
C:\Windows\Fonts - Written
C:\MSIfe800.tmp - Written
C:\Users\user\AppData\Local\Temp\MSI62DD.tmp - Written
C:\MSI74f75.tmp - Written
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log - Written
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\ngen.log - Written
C:\Users\user\AppData\Local\Temp\MSIF79B.tmp - Written
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations - Written
\Device\ConDrv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1392.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER13A4.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER13B5.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_cbbb49d6-b7ff-44ca-aba5-8a5e250d4d42 - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E1F.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2ECB.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2EFB.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E0B.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E1D.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E2D.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3C6.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3C7.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF491.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF492.tmp.csv
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 10 entries for mutexes
MSCTF.Shared.MUTEX.EBH\Sessions\1\BaseNamedObjects\Local\SM0:6924:168:WilStaging_02\Sessions\1\BaseNamedObjects\Local\SM0:6988:168:WilStaging_02\Sessions\1\BaseNamedObjects\Local\SM0:6988:64:WilError_01
Sandbox background — not the file
27The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p - VM process
msiexec.exeC:\Windows\system32\msiexec.exe /V - VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
updater.exeC:\Program Files (x86)\Google2228_1582862326\bin\updater.exe - VM process
updater.exeC:\Program Files (x86)\Google2836_1520658031\bin\updater.exe
Show all 27 entries for sandbox background — not the file
- VM process
updater.exeC:\Program Files (x86)\Google1300_46605728\bin\updater.exe - VM process
updater.exeC:\Program Files (x86)\Google3728_1257117673\bin\updater.exe - VM host
13.107.4.50 - VM host
a83f:8110:2800:1800:4000:1800:1800:100 - VM host
131.253.33.203 - VM host
192.168.0.20 - VM host
a83f:8110:a0a3:a8a3:b0a3:b8a3:c0a3:c8a3 - VM host
a83f:8110:0:0:1400:0:200:3000 - VM host
a83f:8110:584a:b5b1:17cb:1ec8:0:0 - VM host
a83f:8110:e0:ffff:e0:ffff:e0:ffff - VM host
192.168.0.74 - VM host
a83f:8110:22:3cff:d39:50ff:e39:4cff - VM host
23.216.147.76 - VM host
23.216.147.64 - VM host
a83f:8110:0:0:902:0:0:0 - VM host
20.99.132.105 - VM host
20.80.129.13 - VM host
23.216.147.62 - VM host
20.99.184.37 - VM host
a83f:8110:0:0:700:700:2800:4000 - VM host
20.99.133.109
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 37065dc9fa0b843d5be2…c69c97Not checkedno saved verdict
- e094d2ed40e5b375b9e1…51fcd5Not checkedno saved verdict
- fcb396c990b74afc267c…139d28Not checkedno saved verdict
- 7766768a210dcf8c4ab7…682759Not checkedno saved verdict
- 347d8e65f200ea8c4eb9…fbffcfNot checkedno saved verdict
- 79b0a1d7ef25ba27066e…b49217Not checkedno saved verdict
- 4290bf0069acc5fb40a9…0d8bc7Not checkedno saved verdict
- 680677a7a060490f5944…ee3189Not checkedno saved verdict
- eacfe2b4db968adc2ad0…7fdbbbNot checkedno saved verdict
- 30279aef794d838ccea3…976412Not checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Ivaylo Beltchev.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 12, 2026, 2:19 PM UTC
- SHA-256
942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2- SHA-1
317604eba6e94e8777741d577b0ef160a0af3258- MD5
230d1965a035bc4c894941caa3d19a32
About this file
ClassicShellSetup.exe is a Win32 EXE file of 7.2 MB.
- Type and size
- Win32 EXE · 7.2 MB
- Signer
- Ivaylo BeltchevValid code signature.
- First seen
- Jul 28, 2018On VirusTotal.
- Submitted by
- 3,310 distinct sources
- Packer
- None detected
- Entropy
- 7.34 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.
Showing the 5 saved rule names of 7 matched.
- DebuggerCheck__APIgeneric
- elysium
- golang_bin_JCorn_CSC846generic
- PE_Digital_Certificategeneric
- Sus_Obf_Enc_Spoof_Hide_PEgeneric
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is ClassicShellSetup.exe safe?
What is ClassicShellSetup.exe?
How many antivirus engines detected ClassicShellSetup.exe?
Is ClassicShellSetup.exe digitally signed?
What is the SHA-256 hash of ClassicShellSetup.exe?
Is it safe to run ClassicShellSetup.exe?
How up to date is this analysis of ClassicShellSetup.exe?
Community
Member reviews and reports for this exact file hash.