File scan report
Verdict Safe
Is Zero
None of the 65 antivirus engines that checked it flagged this ZIP archive, and the sandbox runs only showed it installing official Python from python.org through a batch launcher.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This archive can be used. Download it only from the developer's official page, and keep your antivirus enabled while running its scripts.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The combined sandbox verdict was clean: the bundled batch file installed the official Python 3.12 package from python.org and checked pip. No malicious hosts, dropped files or malware-specific rules were found.
All 18 major antivirus engines that reported, and every other engine, returned no detection. In both sandbox runs the archive's start.bat used Windows Package Manager to install Python 3.12.10 from python.org and then ran pip version checks. No injection target, persistence or high-risk technique was recorded. External reference databases and community rules returned no matches, and none of the contacted hosts is listed as malicious or suspicious. The tool has been submitted by 584 different sources in its first 38 days. One caveat remains: the bundled scripts run with full user rights once Python is installed.
What We Detected
None of the 65 antivirus engines that checked it flagged this ZIP archive, including all major antivirus engines that analysed it. There were no matches in public malware-sharing databases or in malware-specific YARA rules.
Threat Behavior
The combined sandbox verdict was clean. The included start.bat installs Python 3.12.10 from the official python.org site through Windows Package Manager, then verifies that pip is available. No process injection target, persistence mechanism or high-risk technique was observed. The sandbox did note long sleeps and debug-environment checks, but no hostile activity followed.
What To Do Now
The archive appears safe to use. It installs Python and runs bundled scripts, so only run it if you trust where you got it, and keep your antivirus enabled.
Where this verdict could be wrong2 caveats
- The archive's batch launcher silently installs Python and then runs bundled scripts. That pattern is also used by script-based stealers, and the script contents themselves carry no detection either way.
- The sandbox tagged the sample for long sleeps and debug-environment detection, which can indicate sandbox evasion, although no hostile behaviour followed.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 65 antivirus engines that checked it flagged the archive.
- The combined sandbox verdict was clean, with no injection or persistence recorded.
- The only download observed was the official Python installer from python.org.
- No listings in public malware databases or malware-specific rule sets.
- Submitted by 584 different sources.
- The batch launcher installs Python automatically and then runs bundled scripts with your user rights.
- The sandbox noted long sleep calls and checks for a debugging environment.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 15sandbox rule tags
- 15spawned processes
- 6network contacts
- 23filesystem & mutex artifacts
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
15MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1033· Reads user info
- T1055· Process injection
- T1059· Runs commands
- T1064
- T1070· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1106
- T1202
- T1497· Sandbox evasion
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1573
- T1574· Execution hijack
Observed activity
Processes started
15Programs the file ran, with their command lines.
python-3.12.10-amd64.exe"C:\Users\<USER>\AppData\Local\Temp\WinGet\Python.Python.3.12.3.12.10\python-3.12.10-amd64.exe" /passive /norestart /log "C:\Users\<USER>\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir\Python.Python.3.12.3.12.10-26-09-10-11-18-52.log" InstallAllUsers=0 PrependPath=1python-3.12.10-amd64.exe"C:\Users\<USER>\AppData\Local\Temp\{38261CF3-A823-40F7-8CC1-4894DA3093CA}\.cr\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\<USER>\AppData\Local\Temp\WinGet\Python.Python.3.12.3.12.10\python-3.12.10-amd64.exe" -burn.filehandle.attached=756 -burn.filehandle.self=560 /passive /norestart /log "C:\Users\<USER>\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir\Python.Python.3.12.3.12.10-26-09-10-11-18-52.log" InstallAllUsers=0 PrependPath=1pypy -3 -m pip --versionpython.exeC:\Users\<USER>\AppData\Local\Programs\Python\Python310-32\python.exe -m pip --versionpythonpython -m pip --versioncmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\ZeroScript-Free-1.5.5/start.bat^"
Show all 15 entries for processes started
cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\ZeroScript-Free-1.5.5/start.batchcpchcp 65001cmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && C:\Windows\system32\wscript.exe ^"C:\Users\<USER>\AppData\Local\Temp\ZeroScript-Free-1.5.5/zeroscript-extension/background.js^"wscript.exeC:\Windows\system32\wscript.exe "C:\Users\<USER>\AppData\Local\Temp\ZeroScript-Free-1.5.5/zeroscript-extension/background.jscmd.exeC:\Windows\system32\cmd.exe /c vercmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && C:\Windows\system32\wscript.exe ^"C:\Users\<USER>\AppData\Local\Temp\ZeroScript-Free-1.5.5/zeroscript-extension/core/config.js^"wscript.exeC:\Windows\system32\wscript.exe "C:\Users\<USER>\AppData\Local\Temp\ZeroScript-Free-1.5.5/zeroscript-extension/core/config.jswherewhere pycmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && C:\Windows\system32\wscript.exe ^"C:\Users\<USER>\AppData\Local\Temp\ZeroScript-Free-1.5.5/zeroscript-extension/core/main.js^"
Network contacts
66 hosts, listed as 1 domain, 5 addresses, 1 link. Links show the host and path only.
- Domain
www.python.org - IP address
150.171.73.13 - IP address
151.101.0.223 - IP address
151.101.64.223 - IP address
151.101.128.223 - IP address
151.101.192.223
Show all 7 entries for network contacts
- URL
https://www.python.org/ftp/python/3.12.10/python-3.12.10-amd64.exe
Files
20Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\{38261CF3-A823-40F7-8CC1-4894DA3093CA}\.cr\python-3.12.10-amd64.exe - Written
C:\Users\<USER>\AppData\Local\Temp\{B7E260FB-3E7D-44EE-9774-0F2C030C4E1F}\.ba\PythonBA.dll - Written
C:\Users\<USER>\AppData\Local\Temp\{B7E260FB-3E7D-44EE-9774-0F2C030C4E1F}\.ba\Default.thm - Written
C:\Users\<USER>\AppData\Local\Temp\{B7E260FB-3E7D-44EE-9774-0F2C030C4E1F}\.ba\Default.wxl - Written
C:\Users\<USER>\AppData\Local\Temp\{B7E260FB-3E7D-44EE-9774-0F2C030C4E1F}\.ba\SideBar.png - Written
C:\Users\<USER>\AppData\Local\Temp\{B7E260FB-3E7D-44EE-9774-0F2C030C4E1F}\.ba\BootstrapperApplicationData.xml
Show all 20 entries for files
- Written
C:\Users\<USER>\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir\Python.Python.3.12.3.12.10-26-09-10-11-18-52.log - Written
C:\Users\<USER>\AppData\Local\Temp\{B7E260FB-3E7D-44EE-9774-0F2C030C4E1F}\.be\python-3.12.10-amd64.exe - Written
C:\Users\<USER>\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe - Written
C:\Users\<USER>\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir\AppInstaller-2026-09-10-11-19-51.772.log - Written
C:\Users\<USER>\AppData\Local\Temp\ZeroScript-Free-1.5.5\logs\start.log - Written
\Device\VRegDriver - Written
C:\Users\<USER>\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir\AppInstaller-2026-09-10-18-17-25.642.log - Written
C:\Users\<USER>\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir\WinGet-2026-09-10-18-18-10.162.log - Written
C:\Users\<USER>\AppData\Local\Temp\WinGet\Microsoft.Winget.Source_8wekyb3d8bbwe.msix - Deleted
C:\Users\<USER>\AppData\Local\Temp\{38261CF3-A823-40F7-8CC1-4894DA3093CA}\.cr\python-3.12.10-amd64.exe - Deleted
C:\Users\<USER>\AppData\Local\Temp\{38261CF3-A823-40F7-8CC1-4894DA3093CA}\.cr\ - Deleted
C:\Users\<USER>\AppData\Local\Temp\{38261CF3-A823-40F7-8CC1-4894DA3093CA}\ - Deleted
C:\Users\<USER>\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\Microsoft.Winget.Source_8wekyb3d8bbwe\installed.db-journal - Deleted
C:\Users\<USER>\AppData\Local\Temp\WinGet\Python.Python.3.12.3.12.10\67b5635e80ea51072b87941312d00ec8927c4db9ba18938f7ad2d27b328b95fb
Registry and auto-start
7Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\BundleCachePath - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\BundleUpgradeCode - Set
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\ProxyBypass - Set
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\IntranetName - Set
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\UNCAsIntranet - Set
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\AutoDetect
Show all 7 entries for registry and auto-start
- Set
\REGISTRY\A\{3b58a584-1fd2-0f38-bffc-6ccb5322f18b}\LocalState\sources_metadata
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
PreIndexedSourceCPL_Microsoft.Winget.Source_8wekyb3d8bbwePackageTrackingCPL_Microsoft.Winget.Source_8wekyb3d8bbweWinGetCrossProcessInstallLock
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM host
edge-mobile-static.azureedge.net - VM host
business.bing.com
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 524844d019864d6905ac…86a22aNot checkedno saved verdict
- 2efddf202c0f6c9a6d9e…d43d18Not checkedno saved verdict
- 130d21c44e76108742a2…9b1ef3Not checkedno saved verdict
- 5921797bc6f728a40854…32108aNot checkedno saved verdict
- f4b54f2e20b8b6340b23…bdaf56Not checkedno saved verdict
- 772d826f3af013ee148c…8fe2a2Not checkedno saved verdict
- 61f6b1a5a7fca7531bb2…f6019aNot checkedno saved verdict
- 97f318a349e73d50d1ae…48f116Not checkedno saved verdict
- b68d689899ceefc6d240…522980Not checkedno saved verdict
- 9008488a6ac8a32e330e…9e2a36Not checkedno saved verdict
Chapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 18, 2026, 11:13 PM UTC
- SHA-256
6c464e9069611908bcc7ada79ed643343fcf3476ace55dceb4064e8928845c8a- SHA-1
e23afae3944884d0fdfbbe26f4d114b81ca876c8- MD5
764986c14c0f4c127226e55982dd7b95
About this file
ZeroScript-Free-1.5.5.zip is a ZIP file of 1.3 MB.
- Type and size
- ZIP · 1.3 MB
- Signer
- Not applicable
- First seen
- Sep 10, 2026On VirusTotal.
- Submitted by
- 584 distinct sources
First scanned
Antivirus consensus
0 of 65 engines flagged this file
10 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ZeroScript-Free-1.5.5.zip safe?
What is ZeroScript-Free-1.5.5.zip?
How many antivirus engines detected ZeroScript-Free-1.5.5.zip?
What is the SHA-256 hash of ZeroScript-Free-1.5.5.zip?
Is it safe to open or extract ZeroScript-Free-1.5.5.zip?
How up to date is this analysis of ZeroScript-Free-1.5.5.zip?
Community
Member reviews and reports for this exact file hash.