File scan report
Verdict Safe
Is setup.
None of the 60 antivirus engines that checked it flag this long-circulating unsigned Inno Setup installer, and its sandbox activity shows ordinary installer unpacking with no…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Use this installer only if it came from the software's official source, and keep your security software enabled during installation.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 60 flagged
- Flagged 0
- No detection 60
- No result 16
- Code signing Unsigned
- Test run Completed
- First seen 6y ago
Chapter 02
Why we think so
2 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This unsigned installer has circulated since 2020 among 140 submitters, and none of the 60 antivirus engines that checked it flag it. The sandbox runs show a typical Inno Setup unpacking sequence with helper DLLs and no injection targets or persistence. It carries no publisher signature, so download it only from the software's official source.
None of the 60 antivirus engines that checked it flagged the file, including 13 major antivirus engines that returned clean results. It has been seen for more than six years by 140 distinct submitters, which is a strong sign of established software rather than a fresh threat. Activity in the test run matches an Inno Setup installer: temporary launcher processes and standard skin and extraction helper libraries, with no named injection target and no persistence recorded. The direct IP connections largely fall in cloud and content-delivery ranges, many of them background traffic of the analysis machine, though no complete host-reputation result is available. The lack of a code signature is the main weakness, keeping confidence moderate.
What We Detected
None of the 60 antivirus engines that checked it flagged this installer; 13 major antivirus engines such as ESET-NOD32, Avira, DrWeb and Fortinet reported it clean. The file is unsigned and has been circulating since March 2020 among 140 submitters.
Threat Behavior
The sandbox runs show an Inno Setup installer extracting itself to a temporary folder and loading common installer helper libraries for skins and archive extraction. No process injection target, persistence entry or high-risk technique was recorded. Some direct IP connections were observed, most matching the analysis machine's background traffic; no complete reputation check of those hosts is available.
What To Do Now
If you obtained this installer from the software's official website or a trusted distributor, it can be used normally. Because it is unsigned, avoid copies from unofficial download sites and keep your antivirus protection enabled while installing.
Where this verdict could be wrong3 caveats
- The installer is unsigned, so there is no publisher identity confirming who built it.
- The sandbox recorded direct connections to several IP addresses without a domain, and no complete host-reputation result is available for them.
- Other installers built with the same framework have previously drawn mixed results, including one bundled game-hack tool.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 60 antivirus engines that checked it flag the file.
- Seen by 140 distinct submitters over more than six years without detections.
- Sandbox activity matches a standard Inno Setup installer with no high-risk techniques or injection targets.
- The installer carries no digital signature identifying its publisher.
- Direct connections to IP addresses without a domain were recorded, with no complete reputation check of those hosts.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 17sandbox rule tags
- 13spawned processes
- 7network contacts
- 40filesystem & mutex artifacts
Includes 17 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 60 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 5, 2026, 12:09 AM UTC
- SHA-256
a76a101852e3b35cf6e1ad0f3a61e67b8110ddc235e5447b96caf834f8895644- SHA-1
163bb594ea08fae109dfe8e9f5c3bef709835d0b- MD5
546b74f37ec92a6275e9489bb9caefbd
About this file
setup.exe is a Win32 EXE file of 3.8 MB.
- Type and size
- Win32 EXE · 3.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 8, 2020On VirusTotal.
- Submitted by
- 140 distinct sources
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Includes every engine result (76), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is setup.exe safe?
What is setup.exe?
How many antivirus engines detected setup.exe?
What is the SHA-256 hash of setup.exe?
Is it safe to install setup.exe?
How up to date is this analysis of setup.exe?
Community
Member reviews and reports for this exact file hash.