Is Adobe Installer safe?
Sparse, uncorroborated antivirus detections conflict with numerous YARA matches, an unverified Adobe signature, and incompletely checked direct-IP activity.
Only 2 of 75 engines raised alerts, with no tier-1 detection or agreed malware family, and the file is old and widely submitted. However, 17 YARA rules matched, the Adobe signature was not verified, and one sandbox recorded service-related activity plus direct-IP connections whose reputation was not fully checked.
f9a8849d7aa95783b6…1b6a72e0e8ee19Recommended next actions
Before opening
Do not open it until the source can be verified independently.
If you already opened it
Stop using it, scan the device, and watch for unexpected behavior or security alerts. Get a fresh copy from the original trusted source and verify its exact hash when possible.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
Only 2 of 75 engines raised alerts, with no tier-1 detection or agreed malware family, and the file is old and widely submitted. However, 17 YARA rules matched, the Adobe signature was not verified, and one sandbox recorded service-related activity plus direct-IP connections whose reputation was not fully checked.
The antivirus result is weak: 2 of 75 engines flagged the file, no tier-1 engine did so, and the two labels do not establish a consistent family. Its long history, broad prevalence, and three benign-leaning similar-file decisions reduce the likelihood of commodity malware. Conversely, 17 YARA rules are meaningful researcher corroboration, including rules associated with plaintext botnet communication and obfuscated PowerShell. The displayed Adobe Inc. signer is not a trust anchor because signature verification was unavailable, despite the absence of a detected brand mismatch. One sandbox observed T1543.003 and direct-IP activity but issued no malware verdict, and no complete host-reputation cross-check is available. These conflicting indicators warrant caution rather than relying solely on either the sparse engine alerts or the apparent publisher identity.
What We Detected
Two of 75 antivirus engines raised alerts: VirIT identified GenusC and Webroot identified a riskware repack. None of the 17 reporting tier-1 engines detected the sample, and there is no agreed family. However, externalIntel.yaraify.ruleCount=17 includes botnet_plaintext_c2, Detect_PowerShell_Obfuscation, and debugger-checking rules, which is substantial conflicting evidence.
Threat Behavior
One completed sandbox run observed T1543.003, a service-related persistence technique, alongside 12 installer-common techniques. It also recorded direct-IP contacts without application domains. Because contactedHosts=null, no complete reputation determination is available for those external addresses. The sandbox produced no malware verdict, and none of eight inspected children was identified as malicious, although all eight child verdicts remain unknown.
What To Do Now
Do not rely on the displayed Adobe Inc. signer because signing.verified=null and signing.trustedPublisher.matched=false. Obtain a fresh installer directly from Adobe's official download channel and compare its hash or verified digital signature. Keep endpoint protection enabled and avoid running this copy on a production system until its origin is confirmed.
Where this verdict could be wrong4 caveats
- VirIT reported Trojan.Win32.GenusC.IMC and Webroot reported W32.Riskware.Repack, but no tier-1 engine corroborated either label.
- T1543.003 and direct-IP traffic were observed in one sandbox, while contactedHosts=null leaves those external contacts without a complete reputation check.
- The Adobe Inc. signer string is not authenticated because signing.verified=null; its 2/2 safe history is also too small for automatic trust.
- All eight inspected dropped children lack individual verdicts, so hasMaliciousChild=false does not establish that those children are benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 2/75 engines detected the sample, with tier1Malicious=0.
- All 17 reporting tier-1 engines returned no detection.
- The sample has 3,663 sources and 11,204 submissions dating to 2021.
- similarHashes contains three prior safe decisions against one suspicious decision.
- behaviour.hasMaliciousSandboxVerdict=false and peAnalysis.likelyPacked=false.
- 17 YARAify rules matched, including botnet_plaintext_c2 and Detect_PowerShell_Obfuscation.
- The 'Adobe Inc.' signature is not verified and is therefore spoofable.
- One sandbox observed T1543.003 service-related activity.
- Direct-IP traffic was observed without a complete contacted-host reputation check.
- VirIT and Webroot produced Trojan or riskware detections.
- All eight dropped children have unknown individual verdicts.
Replace this copy with one downloaded directly from Adobe and require a successfully verified Adobe digital signature before execution. Keep endpoint protection enabled and quarantine the current file if its source cannot be established.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete2 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial20 runtime contacts were observed without a completed reputation cross-check.
YARA
Complete6 signature or behavior rules matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 13MITRE ATT&CK techniques
- 15spawned processes
- 20network contacts
- 32filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Created or modified a system service, which can keep code running.
High concern: Changed an auto-start location that can make code run after sign-in or restart.
High concern: Manipulated how the operating system loads code, which can redirect execution.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Moderate concern: Communicates over the network in a non-standard way.
Moderate concern: Checked the environment for virtualisation or analysis tools.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
Adobe Installer
f9a8849d7aa95783b611099a0fee8c353a61ba61e4632bedf51b6a72e0e8ee19
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
C:\Windows\system32\services.exe
02Isolated runtime analysis - ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\file.exe"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
HDInstaller.log
C:\Users\<USER>\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log
04Isolated runtime analysis - Written fileObserved
DiscoverCacheData.dat
C:\Users\<USER>\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
a83f:8110:725:38ff:1324:39ff:131f:37ff
Contact observed during runtime.
06Isolated runtime analysis - Contacted hostObserved
131.253.33.203
Contact observed during runtime.
07Isolated runtime analysis - +1 more recorded observation in Analyst mode
7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- a83f:8110:725:38ff:1324:39ff:131f:37ff
- 131.253.33.203
- 23.59.190.193
- 23.216.147.76
- 104.18.11.39
- 104.18.10.39
- 192.168.0.1
- a83f:8110:766b:500:1600:0:5013:1d00
- 20.80.129.13
- a83f:8110:1a1a:1aff:1a1a:1aff:1a1a:1aff
- C:\Users\<USER>\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log
- C:\Users\<USER>\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
- C:\Users\RDHJ0C~1\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log
- C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
- C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser
- C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin
- C:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A.tmp.WERInternalMetadata.xml
- C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6.tmp.csv
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER105.tmp.txt
- HDInstaller.log
- \Sessions\1\BaseNamedObjects\HDInstaller.log
Files this sample writes at runtime
This file drops 8 children at runtime. None are currently flagged malicious in our cache.
- 271aef38d506c2c58893…06beacNever scannednever seen before
- b3d510ef04275ca8e698…9a2209Never scannednever seen before
- 9c77149fd6f071372256…c5b363Never scannednever seen before
- d25c3be543bbf435e2ee…05b1a0Never scannednever seen before
- 74ef2d16c06a7140d3a0…9214fdNever scannednever seen before
- 46f7b5e5b9f3577f36c2…7bcd53Never scannednever seen before
- 6a38e3e07c3786d4b806…2e75f1Never scannednever seen before
- 5d9ed028bc838e865eda…b30db4Never scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 6rule hits recorded
- 2 / 75engines flagged
- 3,663sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
5 high-confidence signature or behavior rules matched this file.
Verdict inputView chapterProvenanceObservedSourceSignature and behavior rulesObserved at - 02
2 of 75 antivirus engines flagged the file, including VirIT and Webroot.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
The hash has a long, established submission history across 3,663 sources.
ProvenanceDerivedSourceSubmission historyObserved at - 04
Scanned file: Adobe Installer — f9a8849d7aa95783b611099a0fee8c353a61ba61e4632bedf51b6a72e0e8ee19
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — C:\Windows\system32\services.exe
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — "C:\Users\<USER>\Desktop\file.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: HDInstaller.log — C:\Users\<USER>\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: DiscoverCacheData.dat — C:\Users\<USER>\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: a83f:8110:725:38ff:1324:39ff:131f:37ff — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at - 10
Contacted host: 131.253.33.203 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
The available sources did not agree on a named threat category.
One or more independent reference databases matched this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
- botnet_plaintext_c2
- Check_OutputDebugStringA_iat
- DebuggerCheck__API
- Detect_PowerShell_Obfuscation
- golang_bin_JCorn_CSC846
The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidencea83f:8110:725:38ff:1324:39ff:131f:37ff · 131.253.33.203 · 23.59.190.193
2 of 75 engines flagged this file
View all 75 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Fingerprint and provenance
- File name
- Adobe Installer
- Format
- Win32 EXE
- Code signing
- Signature not verified: Adobe Inc.
- Size
- 7.3 MB
- Last analyzed
- Sep 12, 2026, 2:19 PM UTC
f9a8849d7aa95783b611099a0fee8c353a61ba61e4632bedf51b6a72e0e8ee19Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
We couldn't fully clear this file. Treat it with caution.
- Recovery step 01
Don't open it unless you're certain it came from a source you trust.
- Recovery step 02
Check where you got it — an unexpected attachment or a random download link is a red flag.
- Recovery step 03
If its origin cannot be confirmed, delete this file and use a fresh copy from a trusted source. Get a fresh copy from the original trusted source and verify its exact hash when possible.
- Recovery step 04
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is Adobe Installer safe, or is it malware?
What is Adobe Installer?
How many antivirus engines detected Adobe Installer?
What should I do if I already opened Adobe Installer?
How do I remove Adobe Installer?
Is Adobe Installer digitally signed?
What is the SHA-256 hash of Adobe Installer?
How up to date is this analysis of Adobe Installer?
Community
Member reviews and reports for this exact file hash.