IOCSCAPE

Verdict

LIKELY BENIGNMedium confidence

1Supporting signals

1Independent sources

0Recent observations

10 / 100Threat score

Why the engine decided this

VALID_CODE_SIGNATURE The file carries a valid code signature: the signer's certificate chain verifies.

View all evidence and rules

Deterministic engine · activity none

Key indicators

MD5: f36eb756889f377f934b8a6099e248de
File name: OktaVerifySetup.exe
File type: Win32 EXE
Signature: Valid · Okta, Inc.
First submitted: 2026-09-24
First seen: 2026-09-24 (5 days before · VirusTotal)
Last seen: 2026-09-29 (0 days before)

Relationship graph

Expand

Evidence

2 of 6 sources returned a record · ages computed by the engineView all evidence

Evidence from 6 sources
Source	Finding	Confidence	Age	Signal
Code signature	Validly signed by Okta, Inc. (certificate from DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1): this shows who published the file, not that it is safe.	—	—	Benign
VirusTotal	Only 1/75 vendors (1.3%) flag it: an isolated detection, not corroboration; label trojan.. Sandboxes: 0 of 1 sandboxes: malicious.	1/75	0 days recent	Neutral

Coverage · checked, no record: MalwareBazaar, ThreatFox, AlienVault OTX, CIRCL hashlookup · failed: none

Analyst summary

Consistent with engine

This file is likely benign (medium confidence): it is validly signed by Okta, Inc. and no source reports it as malicious. A signature identifies the publisher; it does not prove the file is safe.

Why the evidence points to likely benign

[Code signature] Validly signed by Okta, Inc. (certificate from DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1): this shows who published the file, not that it is safe.

A valid signature identifies the publisher; it is not proof the file is safe. No trusted catalogue lists this exact file yet. Static intelligence only; no execution context from our environment.

Evidence pointing the other way

[VirusTotal] Only 1/75 vendors (1.3%) flag it: an isolated detection, not corroboration; label trojan.. Sandboxes: 0 of 1 sandboxes: malicious.

Attribution

The evidence does not establish who operates this indicator.

Written by rules from the engine's evidenceSuggested pivots

Threat context

Context only

No group is directly linked to this indicator by any source.

All evidence

6 sources queried · click a row for its raw fields · ages computed by the engine

Evidence from 6 sources
Source	Finding	Confidence	Age	Signal
Code signature	Validly signed by Okta, Inc. (certificate from DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1): this shows who published the file, not that it is safe.	—	—	Benign
VirusTotal	Only 1/75 vendors (1.3%) flag it: an isolated detection, not corroboration; label trojan.. Sandboxes: 0 of 1 sandboxes: malicious.	1/75	0 days recent	Neutral
MalwareBazaar	No record.	—	—	No record
ThreatFox	No record.	—	—	No record
AlienVault OTX	No record.	—	—	No record
CIRCL hashlookup	No record.	—	—	No record

Engine rules applied

VALID_CODE_SIGNATUREThe file carries a valid code signature: the signer's certificate chain verifies.
VT_ISOLATED_DETECTIONOnly 1-2 VirusTotal vendors (under 3%) flag the indicator.

Each code maps to a written rule in the scoring policy. The verdict never comes from the language model.

Analyst summary

Consistent with engine

This file is likely benign (medium confidence): it is validly signed by Okta, Inc. and no source reports it as malicious. A signature identifies the publisher; it does not prove the file is safe.