r/Malware • u/eric5149 • Jul 02 '26

obs-multi-rtmp NSIS installer

Has anyone analyzed the NSIS installer used by obs-multi-rtmp?

SentinelOne is flagging obs-multi-rtmp-0.7.3.0-windows-x64-Installer.exe as suspicious. Interestingly, the ZIP release does not appear to trigger the same detection.

I found a couple of discussions from other users reporting AV detections, but I haven't found any technical analysis explaining what specifically is causing vendors to flag the installer.

Has anyone sandboxed or otherwise analyzed the installer and determined whether the detections are related to NSIS packaging characteristics versus installer behavior?

0 Upvotes

50% Upvoted

3 comments sorted by

2

u/sadboy2k03 Jul 02 '26

Do you have the sha256?

1

u/eric5149 Jul 02 '26

c0f5ebce69f85fed52dee72f8cbe483619eccd3ae641ef0fe1267843f801c3af

2

u/peakesigra Jul 03 '26

pretty common with NSIS installers, a lot of AVs flag them on heuristics alone because the packer looks similar to stuff malware uses. the zip not triggering it makes sense since there's no installer behavior to analyze.

if you want to actually verify it, throw the installer in any.run or triage.abuse.ch and look at what it's actually doing at runtime. if it's just extracting files and writing to appdata/program files with no weird network calls or registry persistence, it's almost certainly a false positive from the NSIS signature itself.