File scan report

Verdict Safe

Analyzed Sep 4, 20261 month ago

Is MyCodes24_Office2024_Setup.exe safe? Yes, no threats found.

Widely distributed, fully clean across 75 engines, signed installer with no malicious sandbox or file it created findings.

Read the whole reasonShow less

Strong evidence · A verified publisher signature, and no engine flags it.

Install it as usual if it came from the official source

The evidence supports treating the file as a benign installer; continue normal security practices and do not disable protection.

Good practice2 tips

We found nothing harmful in this file.

Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

0 of 71 flagged

Flagged 0
No detection 71
No result 4

FileMyCodes24_Office2024_Setup.exe2.9 MBSHA-256 bfb93fb908a0…06e1fd

Code signing WORLD WIDE ELECTRONIC SOFTWARE DELIVERY LLC
Test run Completed
First seen 1y ago

None of the 71 antivirus engines that checked it flag it.

Chapter 02

Why we think so

0 points against it and 4 in its favour, checked against the scan evidence.

Analyst conclusion

Zero of the 71 antivirus engines that checked it flagged the file. The installer is signed and has been submitted by 934 sources over 523 days. Sandbox runs and files it created show no malicious indicators.

Where this verdict could be wrong1 caveat

communityComments contain researcher annotations labeling the file malicious with score 43/100, but these lack corroboration from engines or external intel.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

34sandbox rule tags
7spawned processes
15network contacts
40filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1010
T1012
T1018
T1027· Obfuscated code
T1027.002· Obfuscated code
T1033· Reads user info
T1036
T1047
T1055· Process injection
T1056· Keylogging
T1059· Runs commands
T1064
T1070· Covers its tracks
T1070.004· Covers its tracks
T1070.006· Covers its tracks
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1112
T1129· Loads modules
T1134
T1140· Deobfuscation
T1202
T1213
T1222
T1497· Sandbox evasion
T1518· Checks your AV
T1518.001· Checks your AV
T1539
T1547.009· Auto-start
T1564.003· Hides artifacts
T1573
+2 more

Observed activity

Processes started

Programs the file ran, with their command lines.

software.exe"C:\Users\<USER>\Desktop\software.exe"
cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\<USER>\AppData\Local\Temp\RarSFX0\Office\setup.bat" "
setup"C:\Users\<USER>\AppData\Local\Temp\RarSFX0\Office\setup" /configure "C:\Users\<USER>\AppData\Local\Temp\RarSFX0\Office\Config.xml"
Office 2024 Pro Plus.exe%SAMPLEPATH%\Office 2024 Pro Plus.exe
cmd.exeC:\Windows\SysWOW64\cmd.exe
setup.exe%USERPROFILE%\AppData\Local\Temp\RarSFX0\Office\setup.exe

Show all 7 entries

bfb93fb908a0a1b36c07f50a28da8217cae9c13b57814e8f87f472308706e1fd.exe%SAMPLEPATH%\bfb93fb908a0a1b36c07f50a28da8217cae9c13b57814e8f87f472308706e1fd.exe

Network contacts

15 hosts, listed as 11 addresses, 14 links. Links show the host and path only.

IP address52.109.8.89
IP address52.123.129.14
IP address52.110.2.48
IP address104.98.118.162
IP address104.208.16.95
IP address52.109.13.124

Show all 25 entries

IP address52.110.2.44
IP address51.132.193.104
IP address20.75.60.91
IP address23.46.228.44
IP address20.24.125.47
URLhttp://f.c2r.ts.cdn.office.net/pr/7983bac0-e531-40cf-be00-fd24fe66619c/Office/Data/v64_16.0.17932.20638.cab
URLhttp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D
URLhttp://ocsp.comodoca.com
URLhttp://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D
URLhttp://ocsp.sectigo.com
URLhttp://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl
URLhttp://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEHuvqg%2BlF3QmO9fNk4n2KIo%3D
URLhttp://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl
URLhttp://f.c2r.ts.cdn.office.net/pr/7983bac0-e531-40cf-be00-fd24fe66619c/Office/Data/v64_16.0.17932.20286.cab
URLhttp://f.c2r.ts.cdn.office.net/pr/7983bac0-e531-40cf-be00-fd24fe66619c/Office/Data/16.0.17932.20286/i640.cab
URLhttp://f.c2r.ts.cdn.office.net/pr/7983bac0-e531-40cf-be00-fd24fe66619c/Office/Data/16.0.17932.20286/s641033.cab
URLhttp://f.c2r.ts.cdn.office.net/pr/7983bac0-e531-40cf-be00-fd24fe66619c/Office/Data/16.0.17932.20286/s640.cab
URLhttp://f.c2r.ts.cdn.office.net/pr/7983bac0-e531-40cf-be00-fd24fe66619c/Office/Data/16.0.17932.20286/stream.x64.x-none.dat
URLhttp://f.c2r.ts.cdn.office.net/pr/7983bac0-e531-40cf-be00-fd24fe66619c/Office/Data/16.0.17932.20286/a640_exp.cab

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_49875
WrittenC:\Users\<USER>\AppData\Local\Temp\RarSFX0\Office\Config.xml
WrittenC:\Users\<USER>\AppData\Local\Temp\RarSFX0\Office\setup.bat
WrittenC:\Users\<USER>\AppData\Local\Temp\RarSFX0\Office\setup.exe
WrittenC:\Users\<USER>\AppData\Local\Temp\RarSFX0\Office
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\67A0FC1F-782E-4664-8722-62C5AD5CA272

Show all 30 entries

WrittenC:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\setup.exe.db
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\setup.exe.db-journal
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\setup.exe.db-wal
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\setup.exe.db-shm
WrittenC:\Users\<USER>\AppData\Local\Temp\DESKTOP-ET51AJO-20260116-1836.log
WrittenC:\Users\<USER>\AppData\Local\Temp\OfficeC2RDFF47A21-5282-42F0-AF63-6AF661A2002COfficeC2R9F64D2A0-4B86-4D2A-96A0-6128D3D04949\v64.hash
WrittenC:\Users\<USER>\AppData\Local\Temp\OfficeC2RDFF47A21-5282-42F0-AF63-6AF661A2002COfficeC2R9F64D2A0-4B86-4D2A-96A0-6128D3D04949\VersionDescriptor.xml
WrittenC:\Users\<USER>\AppData\Local\Temp\OfficeC2RDFF47A21-5282-42F0-AF63-6AF661A2002C\v64.hash
WrittenC:\Users\<USER>\AppData\Local\Temp\OfficeC2RDFF47A21-5282-42F0-AF63-6AF661A2002C\VersionDescriptor.xml
DeletedC:\Users\<USER>\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_49875
DeletedC:\Users\<USER>\AppData\Local\Temp\RarSFX0
DeletedC:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\setup.exe.db-journal
DeletedC:\Users\<USER>\AppData\Local\Temp\v64_16.0.17932.20638CheckReachable2F16B199-B21D-455B-A3BB-6B6D039DCA6A
DeletedC:\Users\<USER>\AppData\Local\Temp\OfficeC2RDFF47A21-5282-42F0-AF63-6AF661A2002COfficeC2R9F64D2A0-4B86-4D2A-96A0-6128D3D04949\v64.hash
DeletedC:\Users\<USER>\AppData\Local\Temp\OfficeC2RDFF47A21-5282-42F0-AF63-6AF661A2002COfficeC2R9F64D2A0-4B86-4D2A-96A0-6128D3D04949\VersionDescriptor.xml
DeletedC:\Users\<USER>\AppData\Local\Temp\OfficeC2RDFF47A21-5282-42F0-AF63-6AF661A2002COfficeC2R9F64D2A0-4B86-4D2A-96A0-6128D3D04949
DeletedC:\Users\<USER>\AppData\Local\Temp\OfficeC2RDFF47A21-5282-42F0-AF63-6AF661A2002C\v64.hash
DeletedC:\Users\<USER>\AppData\Local\Temp\OfficeC2RDFF47A21-5282-42F0-AF63-6AF661A2002C\v64_16.0.17932.20638.cab
DeletedC:\Users\<USER>\AppData\Local\Temp\OfficeC2RDFF47A21-5282-42F0-AF63-6AF661A2002C\VersionDescriptor.xml
DeletedC:\Users\<USER>\AppData\Local\Temp\OfficeC2RDFF47A21-5282-42F0-AF63-6AF661A2002C
DeletedC:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin
Deleted%USERPROFILE%\AppData\Local\Microsoft\Office\OTele\setup.exe.db-journal
Deleted%USERPROFILE%\AppData\Local\Temp\OfficeC2R7ADDCC92-14AB-46C9-84F3-24C5D202F928\v64.hash
Deleted%USERPROFILE%\AppData\Local\Temp\OfficeC2R7ADDCC92-14AB-46C9-84F3-24C5D202F928\v64_16.0.17932.20286.cab

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

DeletedHKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\odc-stat-images-OneDriveUpsell.png-lcid=1033&syslcid=1033&uilcid=1033&ver=16
DeletedHKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\odc-stat-images-OneDriveUpsell.png-lcid=1033&syslcid=1033&uilcid=1033&ver=16\0
DeletedHKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\odc-stat-images-sm-onedrive_16_2.png\0
DeletedHKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\odc-stat-images-sm-onedrive_32_2.png
DeletedHKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\odc-stat-images-sm-onedrive_32_2.png\0
DeletedHKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\setup.exe\ULSMonitor

Show all 7 entries

DeletedHKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\setup.exe

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

Global\SyncRootManager
Office.16.916BB0BF-2D21-4499-83C7-555DB4C3F8E8
Local\OfficeSetupBootstrapper
Local\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office16
\Sessions\1\BaseNamedObjects\Global\SyncRootManager
\Sessions\1\BaseNamedObjects\Local\OfficeSetupBootstrapper

Show all 10 entries

\Sessions\1\BaseNamedObjects\Office.16.916BB0BF-2D21-4499-83C7-555DB4C3F8E8
\Sessions\1\BaseNamedObjects\Local\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office16
\Sessions\1\BaseNamedObjects\Local\ExtractClient
\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processservices.exeC:\Windows\system32\services.exe
VM processExplorer.EXEC:\Windows\Explorer.EXE
VM processsvchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p
VM processsvchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
VM processlsass.exeC:\Windows\system32\lsass.exe

Show all 17 entries

VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
VM processUI0Detect.exeC:\Windows\System32\UI0Detect.exe
VM hosta83f:8110:0:0:64ca:1f00:0:0
VM host192.168.0.32
VM host23.196.193.245
VM host104.71.214.69
VM hosta83f:8110:100:0:436f:6e66:6967:7572
VM host192.168.0.16
VM host151.101.22.172
VM host23.196.145.221
VM host23.55.140.42

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

aff6b444159c277ac4b6…9455c7Not checked
no saved verdict
380c4ea68834600e6fbf…8ce474Not checked
no saved verdict
14469967c269e753b8b1…5a8fd7Not checked
no saved verdict
4d2a271248b921295681…0fe511Not checked
no saved verdict
6584cfdbbc24bf0c1ba3…cce12dNot checked
no saved verdict
08f271887ce94707da82…7473f1Not checked
no saved verdict
335932e68d7a8bfa4fa0…3b7744Not checked
no saved verdict
453c337b78c334e7c2f4…d9f0deNot checked
no saved verdict
08c71258148843c5f342…399de6Not checked
no saved verdict
1d5b3b2ec11826763cd2…7aa81eNot checked
no saved verdict

Chapter 04

Technical details

None of the 71 antivirus engines that checked it flag it; signed by WORLD WIDE ELECTRONIC SOFTWARE DELIVERY LLC.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete0 of 71 engines flagged it · 4 gave no result DetailsSep 2, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsOct 18, 2026

Contacted hostsMalwareTips URL scannerPartial4 of 20 contacted hosts were cross-checked; coverage is incomplete DetailsOct 18, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsOct 18, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedSep 4, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchSep 4, 2026

File fingerprint

Last analyzed: Sep 4, 2026, 10:35 PM UTC

SHA-256: bfb93fb908a0a1b36c07f50a28da8217cae9c13b57814e8f87f472308706e1fd
SHA-1: 4d8a2ef15e87406267d35d43ad802643d797fd48
MD5: a464ff988bcd69c52591efb24e93bdaf

About this file

MyCodes24_Office2024_Setup.exe is a Win32 EXE file of 2.9 MB.

Type and size: Win32 EXE · 2.9 MB
Signer: WORLD WIDE ELECTRONIC SOFTWARE DELIVERY LLCValid code signature.
First seen: Mar 31, 2025On VirusTotal.
Submitted by: 934 distinct sources
Packer: None detected
Entropy: 8.00 of 8

First scanned Sep 4, 2026Updated Oct 18, 2026

Antivirus consensus

0 of 71 engines flagged this file

0 malicious0 suspicious71 not flagged4 no result

4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-236 engines
0flagged
Low-trust17 engines
0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 8.00Unpacked

Section entropy6 sections

.text

6.71

.rdata

5.22

.data

4.08

.didat

3.52

.rsrc

5.65

.reloc

6.67

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

934

Hundreds of people have uploaded this — common.

Total submissions

1,058

Includes repeat uploads by the same source.

First seen

2y ago

Mar 31, 2025

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is MyCodes24_Office2024_Setup.exe safe?

We found nothing harmful in MyCodes24_Office2024_Setup.exe. None of the 71 antivirus engines that checked it flag it. It has a valid digital signature from WORLD WIDE ELECTRONIC SOFTWARE DELIVERY LLC. Install it only if it came from the developer's own website or an official app store.

What is MyCodes24_Office2024_Setup.exe?

MyCodes24_Office2024_Setup.exe is a software installer, about 2.9 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Mar 31, 2025.

How many antivirus engines detected MyCodes24_Office2024_Setup.exe?

None of the 71 antivirus engines that checked it flag MyCodes24_Office2024_Setup.exe. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

Is MyCodes24_Office2024_Setup.exe digitally signed?

Yes. MyCodes24_Office2024_Setup.exe has a valid digital signature from WORLD WIDE ELECTRONIC SOFTWARE DELIVERY LLC, which shows the file hasn't been changed since that publisher signed it. Malware is sometimes signed with stolen certificates, so a signature alone isn't proof of safety.

What is the SHA-256 hash of MyCodes24_Office2024_Setup.exe?

The SHA-256 fingerprint of MyCodes24_Office2024_Setup.exe is bfb93fb908a0a1b36c07f50a28da8217cae9c13b57814e8f87f472308706e1fd, and its MD5 is a464ff988bcd69c52591efb24e93bdaf. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to install MyCodes24_Office2024_Setup.exe?

We found nothing harmful in MyCodes24_Office2024_Setup.exe, and its digital signature checks out. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of MyCodes24_Office2024_Setup.exe?

This report reflects the scan on Sep 4, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is MyCodes24_Office2024_Setup.exe safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

File fingerprint

About this file

0 of 71 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is MyCodes24_Office2024_Setup.exe safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

File fingerprint

About this file

Related file reports