File scan report
Verdict Suspicious
Is Game Setup.
Two major antivirus engines flag a ZIP containing PE with no prior reputation.
Why Suspicious? 7 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Treat the archive as untrusted until sandbox or additional prevalence data becomes available.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or extract it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already opened or extracted it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
7 of 67 flagged
- Flagged 7
- No detection 60
- No result 8
- Code signing Not applicable
- Test run Not run
- First seen 1mo ago
Chapter 02
Why we think so
3 points against it and 2 in its favour, checked against the scan evidence.
The reasoning behind this verdict
7 of the 67 antivirus engines that checked it detect the file, including two major detections on a trojan-downloader family. The sample was first seen on Sep 5, 2026, has zero reputation, and matches a previous malicious ZIP by file type only.
The combination of two major detections and a rare-new classification outweighs the filename rule that normally signals AV-on-AV false positives. No sandbox data, no external-intel hits, and no contacted-host reputation check are available, leaving the evidence mixed. The single similar-hash result is only a file-type match and therefore weak. Overall the file sits in the suspicious band until more runtime or prevalence data appears.
What We Detected
Two major antivirus engines (ESET-NOD32, Fortinet) and five additional engines flagged the ZIP. Labels reference TrojanDownloader and InnoMod families. The archive was first seen on Sep 5, 2026, submitted by a single source, and carries zero reputation.
Threat Behavior
No sandbox execution or network-contact data is present. The file contains at least one PE, but no files it created or control-server hosts were recorded. Filename behaviour rules matched an AV-on-AV false-positive pattern, yet the major detections and extreme rarity override that pattern.
What To Do Now
Do not open the archive. Keep security software enabled and wait for additional submissions or sandbox results before trusting the file.
Where this verdict could be wrong1 caveat
- filenameAnalysis.looksLikeSecuritySoftware=true and triggeredHeuristics filename_security_software — classic AV-on-AV false-positive pattern, but rarity and major detections outweigh it.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- majority of engines (60/75) undetected
- no external-intel hits
- rare and with zero reputation
- two malicious detections from major antivirus engines
- contains PE inside archive
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
7 of the 67 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 7
- ESET-NOD32 (major engine)Win32/TrojanDownloader.Agent.IPE trojan
- Fortinet (major engine)Riskware/InnoMod
- AhnLab-V3Infostealer/Win.InnoLoader.R790171
- DeepInstinctMALICIOUS
- Elasticmalicious (high confidence)
- huorongHEUR:TrojanDownloader/Agent.a!crit
- MalwarebytesTrojan.Downloader.FFO.Generic
File fingerprint
- Last analyzed
- Sep 5, 2026, 2:14 PM UTC
- SHA-256
98ec19c969bb7798f070fd738109da4724dfdec26e089110181875c9dfa55901- SHA-1
b863ff44f9f1669e1f6d30ea941940494a8f3d12- MD5
28edc87cff17b89313d3f9ed9b3c7c42
About this file
Game Setup.zip is a ZIP file of 5.7 MB.
- Type and size
- ZIP · 5.7 MB
- Signer
- Not applicable
- First seen
- Sep 5, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Verdict history
- Not fully confirmed
- Suspiciousafter 7 more engines flagged it
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Game Setup.zip safe, or is it malware?
What is Game Setup.zip?
How many antivirus engines detected Game Setup.zip?
I already downloaded and opened or extracted Game Setup.zip — what should I do?
What is the SHA-256 hash of Game Setup.zip?
How up to date is this analysis of Game Setup.zip?
Community
Member reviews and reports for this exact file hash.