Gridinsoft Logo
File Icon

The Setup.exe (Node.js JavaScript Runtime) File Analysis

Updated 1 month ago
Checked by Malware Check
Setup.exe

Technical Analysis

File Name Setup.exe
File Type
Win32 EXE
Magic Bytes PE32+ executable (console) x86-64, for MS Windows
SSDEEP Hash
393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfb:fMguj8Q4VfvGqFTrY3
Scanner Version 1.0.229.174
Database Version 2025-11-24 10:00:25 UTC
⚠

Suspicious File Detected

Detected by 18 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
26%
Detection Rate
37,908,619
File Size (bytes)
18/70
Engines Detected
2025-11-24
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
32bee34f9efde8fc3ef208b1ab0b5241
SHA1
d4a0c29ec804e38bc5063cb761cfb7586c14b9be
SHA256
22b4d2deaa69245e87ffea632292c1fdec73b7f3d04c8f136ed652b0ba78c26d
SHA512
80e7c409b99be9a52f6d3fcdd571171d57b5599bd7dea7b3c92b2f68271a919abbc5661a8ef9816612b9d5df01cc1750a82ad348c163df5c7de87db5eadbb481
ImpHash
4d0fb8dc9ee470058274f448bebbb85f

Security Engines with Detections (18 of 70)

MicroWorld-eScan
QD:Trojan.GenericKDQ.17F4F35415 Malicious
CTX
exe.trojan.generickdq Malicious
ALYac
QD:Trojan.GenericKDQ.17F4F35415 Malicious
VIPRE
QD:Trojan.GenericKDQ.17F4F35415 Malicious
K7AntiVirus
Riskware ( 00584baa1 ) Malicious
BitDefender
QD:Trojan.GenericKDQ.17F4F35415 Malicious
K7GW
Riskware ( 00584baa1 ) Malicious
Arcabit
QD:Trojan.GenericQ.17F4F35415 Malicious
ESET-NOD32
Generik.BBOEMJB trojan Malicious
DrWeb
Trojan.Siggen32.5646 Malicious
McAfeeD
ti!22B4D2DEAA69 Malicious
Emsisoft
QD:Trojan.GenericKDQ.17F4F35415 (B) Malicious
Google
Detected Malicious
GData
QD:Trojan.GenericKDQ.17F4F35415 Malicious
AhnLab-V3
Trojan/Win.Generic.C5811485 Malicious
Ikarus
Trojan.PowerShell.Runner Malicious
AVG
Win64:Malware-gen Malicious
Avast
Win64:Malware-gen Malicious
52 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 5b68da4010f12363d151f409ceb33d34
Fuzzy: e487424e8b5cee3808f28e6462b06171
dHash: 70f8bcf8f8f2f070
Image Base 0x140000000
Entry Point 0x14125e198
Compilation Time 2022-07-08 23:42:38
Checksum 0x00000000 (Actual: 0x024358f2)
OS Version 6.0
PEiD Signatures PE32+ executable (console) x86-64, for MS Windows
PDB Path C:\Users\runneradmin\AppData\Local\Temp\pkg.24e0b2b2d51e47b9dba34c30\node\out\Release\node.pdb
Digital Signature No valid SignedData structure was found.
Imports 11 libraries
Exports 17255 functions
Resources 9 Resources
Sections 7 Sections

Version Information

▼
CompanyName Node.js
ProductName Node.js
FileDescription Node.js JavaScript Runtime
FileVersion 18.5.0
ProductVersion 18.5.0
OriginalFilename node.exe
InternalName node
LegalCopyright Copyright Node.js contributors. MIT license.
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 19,570,560 bytes 19,570,688 bytes 6.46 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ A68BF38C27F1C9777E7256DBF52A2E32
.rdata 0x012ab000 16,669,688 bytes 16,669,696 bytes 6.21 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F51BC4DF41BB3526CB732A252FDA0C75
.data 0x02291000 2,983,884 bytes 141,312 bytes 3.86 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE EC94C9183EEEA0A1DEE0F4E89CA6F8D7
.pdata 0x0256a000 917,196 bytes 917,504 bytes 6.80 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 9E7C8D93702D4532DB1795A99911A4B0
_RDATA 0x0264a000 244 bytes 512 bytes 2.91 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ ECB4BBE56E47C45A2388A28F6B547D3A
.rsrc 0x0264b000 141,944 bytes 142,336 bytes 6.16 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ DB6ED472B000243688D70FC984344BE5
.reloc 0x0266e000 131,572 bytes 131,584 bytes 5.49 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ D5809755CA5D408E8A1E4C3932B51246
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 9 (141,386 bytes)
Resource Type Count Total Size Percentage
RT_ICON 6 139,730 bytes
98.8%
RT_GROUP_ICON 1 90 bytes
0.1%
RT_VERSION 1 744 bytes
0.5%
RT_MANIFEST 1 822 bytes
0.6%

Certificate Chain Analysis

▼
Certificate Information
Product Node.js
Description Node.js JavaScript Runtime
File Version 18.5.0
Original Name node.exe
Internal Name node
Copyright Copyright Node.js contributors. MIT license.

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
18 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware