File scan report
Verdict Safe
Is ZEDZONE.
Only 2 of the 70 antivirus engines that checked it flagged this unsigned SteamStub-wrapped executable, while higher-trust scanners and completed the test run found no…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Use a copy obtained directly through the official game or Steam channel, and keep antivirus protection enabled. If its source cannot be verified, compare its hash with the publisher's distributed copy before running it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 70 flagged
- Flagged 2
- No detection 68
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 8d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Cylance and Trapmine produced generic detections, but no higher-trust engine flagged the file or identified a malware family. Three completed sandbox runs showed no high-risk activity, and the encrypted section is attributable to SteamStub DRM rather than unexplained packing.
Only 2 of the 70 antivirus engines that checked it flagged the sample, and both detections came from less reliable scanners using generic labels. None of the higher-trust engines identified malware or agreed on a family. Three completed sandbox runs recorded no malicious assessment, named injection target, persistence, file it created, or sample-originated network contact. The high-entropy section is associated with SteamStub, Valve's DRM wrapper, so it is not persuasive evidence of concealment by itself. The file is unsigned and very recently observed, which limits identity assurance, but those concerns do not corroborate the two detections.
What We Detected
Only 2 of the 70 antivirus engines that checked it flagged the executable. Cylance returned a generic unsafe label and Trapmine returned a generic machine-learning score; no higher-trust engine flagged it, and no engine consensus identified a real malware family.
Threat Behavior
Three completed sandbox runs showed no high-risk techniques, process injection, persistence, files it created, or sample-originated network traffic. The sole observed domain was identified as analysis-environment background traffic and was also checked without a malicious or suspicious reputation result. The high-entropy section belongs to SteamStub DRM, which commonly protects game code and does not establish malicious packing.
What To Do Now
The available evidence strongly suggests the two detections are false alarms. Because the executable is unsigned and obtain it from the official game or Steam distribution channel and keep security software enabled when launching it.
Where this verdict could be wrong2 caveats
- The executable is unsigned and was first observed very recently by only two submitters, so publisher identity and broad reputation are not established.
- Cylance and Trapmine both flagged the file, although neither supplied a named malware family and no higher-trust engine agreed.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No higher-trust antivirus engine flagged the executable.
- Three completed sandbox runs found no malicious assessment or high-risk behavior.
- No malicious dropped files or contacted hosts were identified.
- No malware-specific community rules or public malware-database listing matched the hash.
- The encrypted high-entropy section is explained by SteamStub DRM.
- The executable has no verified publisher signature.
- It was first observed very recently and has only two known submitters.
- Cylance and Trapmine produced generic detections.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 9sandbox rule tags
- 1spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
Includes the sandbox verdicts, 9 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
2 of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- CylanceUnsafe
- Trapminemalicious.moderate.ml.score
File fingerprint
- Last analyzed
- Oct 18, 2026, 4:52 PM UTC
- SHA-256
857be319a897d02341b7d5af78f577f1b7c57e2d870d73c7d4faebff9fa1a820- SHA-1
07700e7734cf779f4616a3807226157ce3dacf78- MD5
aab96ddb52083d20c4fe29b02921a2be
About this file
ZEDZONE.exe is a Win32 EXE file of 901.1 kB.
- Type and size
- Win32 EXE · 901.1 kB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 18, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- Possibly packedPacking hides code; legitimate installers use it too.
- Entropy
- 6.53 of 8A code section is highly compressed or encrypted.
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ZEDZONE.exe safe?
What is ZEDZONE.exe?
How many antivirus engines detected ZEDZONE.exe?
What is the SHA-256 hash of ZEDZONE.exe?
Is it safe to run ZEDZONE.exe?
How up to date is this analysis of ZEDZONE.exe?
Community
Member reviews and reports for this exact file hash.