File scan report
Verdict Safe
Is UPDFSetup.
No engine detected malware, the installer carries a verified signature, and the limited runtime concerns lack malicious corroboration, though one contacted IP remains unchecked.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Superace Software Technology Co.
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 71 antivirus engines that checked it produced no detection, including 17 major antivirus engines, and the executable is validly signed by Superace Software Technology Co.
The strongest evidence is the complete absence of detections across 75 antivirus engines, with all 17 major participants reporting no detection. The executable is validly signed by Superace Software Technology Co., and no brand conflict was identified, although there is no historical signer record. One completed sandbox run recorded and T1562.001, but it produced no malicious sandbox verdict or persistence indicators. Ten dropped files were inspected without a malicious child finding, though their individual verdicts remain unknown. A low-severity rule noted direct traffic to 162.159.36.2, and no complete host-reputation result is available. The five similar-file results are weak counter-evidence because they share only an import-table fingerprint and do not match this signer.
What We Detected
No malware or suspicious detections were reported among 75 antivirus engines, including 17 major antivirus engines. The executable has a verified signature from Superace Software Technology Co., and the available metadata shows no signer-to-brand mismatch. No malware family was identified by external research intelligence.
Threat Behavior
One completed sandbox run observed T1134 and T1562.001 alongside common installer activity, but it did not issue a malicious sandbox verdict or record persistence indicators. The sample contacted 162.159.36.2 directly; because the host-reputation cross-check was not completed or saved, that endpoint cannot be described as clean. Ten dropped files were inspected without a malicious-child finding, although their individual classifications remain unknown.
What To Do Now
Use a copy obtained from the publisher's official download channel and verify that Windows still reports the signature as valid before installation. Keep security software enabled and rescan if the signature changes, the installer came from an unofficial source, or unexpected network or system activity appears.
Where this verdict could be wrong5 caveats
- and can be associated with token manipulation and impaired defenses, so their appearance deserves caution despite the absence of a malicious sandbox verdict.
- The sample contacted 162.159.36.2 directly, and the missing contacted-host reputation result means no complete reputation cross-check is available for that endpoint.
- This signer has no saved history, so the verified certificate is not backed by established historical sample statistics.
- All 10 verdicts for files it created are unknown; no dropped file is known to be malicious therefore does not establish that each child is benign.
- similarHashes contains 5/5 prior suspicious results, but all are matches on the import table alone with signerMatchesSubject=false and different filenames.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/71 antivirus engines reported a malicious or suspicious detection.
- The signature for 'Superace Software Technology Co.' is verified.
- No sandbox returned a malicious verdict after one completed sandbox run.
- No dropped file is known to be malicious across 10 inspected children.
- Sandbox observed offensive-associated techniques and T1562.001.
- The signer's lack of a saved history provides no established publisher history.
- The 10 files it created have unknown individual verdicts.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 17sandbox rule tags
- 5spawned processes
- 0network contacts
- 19filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
17MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1115
- T1125
- T1129· Loads modules
- T1134
- T1222
- T1497.001· Sandbox evasion
- T1529
- T1547.009· Auto-start
- T1562.001· Disables security
Observed activity
Processes started
5Programs the file ran, with their command lines.
taskkill.exeC:\Windows\system32\taskkill.exe /im UPDFSetup /f /ttaskkill.exeC:\Windows\system32\taskkill.exe /im UPDF_Downloader /f /ttaskkill.exeC:\Windows\system32\taskkill.exe /im UPDFSetup.exe /f /tupdf-9010100000-win-installer.exe"C:\Users\user\Desktop\updf-9010100000-win-installer.exe"taskkill.exeC:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /im UPDFSetup /f /t
Files
19Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nsj1A4C.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\nsExec.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\UserInfo.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\downloader\7z.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\downloader\7z.exe - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\downloader\api-ms-win-core-console-l1-1-0.dll
Show all 19 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\downloader\api-ms-win-core-console-l1-2-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\downloader\api-ms-win-core-datetime-l1-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\downloader\api-ms-win-core-debug-l1-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\downloader\api-ms-win-core-errorhandling-l1-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\downloader\api-ms-win-core-file-l1-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\downloader\api-ms-win-core-file-l1-2-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\downloader\api-ms-win-core-file-l2-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\downloader\api-ms-win-core-handle-l1-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp\downloader\api-ms-win-core-heap-l1-1-0.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nss172E.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nso1ABA.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsl4F45.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsl7FED.tmp
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 3a101fa91d4e8831dfb7…9b473cNot checkedno saved verdict
- 0893c4d31c7d9c2106ee…6a7d15Not checkedno saved verdict
- 016aadeaa19a82439900…7abd77Not checkedno saved verdict
- cef4206f94ca7b2fa0c0…3140e2Not checkedno saved verdict
- 1c057286bdf0cb90f7dd…9ca43dNot checkedno saved verdict
- 73e4264dd66696163fbb…89a7aaNot checkedno saved verdict
- 7ea1c2902a47fcd4a301…ea9bd3Not checkedno saved verdict
- 273516d86d92975ba14f…236775Not checkedno saved verdict
- be330de7aa8f2f33bcda…405bddNot checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Superace Software Technology Co..
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 9, 2026, 12:14 PM UTC
- SHA-256
d7aa816e49f31f588de8e073d23fd8a14e8b62ef7ca5e64fbe80e87c5a88e339- SHA-1
a9ca0f73320cdecbc84b8c7e3c357f8f719d1615- MD5
b9c784460ead6dddb935f165bedbe258
About this file
UPDFSetup.exe is a Win32 EXE file of 21.5 MB.
- Type and size
- Win32 EXE · 21.5 MB
- Signer
- Superace Software Technology Co.Valid code signature.
- First seen
- Aug 1, 2026On VirusTotal.
- Submitted by
- 15 distinct sources
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is UPDFSetup.exe safe?
What is UPDFSetup.exe?
How many antivirus engines detected UPDFSetup.exe?
Is UPDFSetup.exe digitally signed?
What is the SHA-256 hash of UPDFSetup.exe?
Is it safe to run UPDFSetup.exe?
How up to date is this analysis of UPDFSetup.exe?
Community
Member reviews and reports for this exact file hash.