File scan report
Verdict Suspicious
Is ZEDZONE.
Three generic engine alerts conflict with uneventful sandbox execution and an identified Steam DRM wrapper, but the unsigned, executable warrants caution.
Read the whole reasonShow less
Why Suspicious? 3 antivirus engines flag it, but no major engine agrees; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
3 of 70 flagged
- Flagged 3
- No detection 67
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 8d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 3 of the 70 antivirus engines that checked it flagged the executable, none of them major, and no detector identified a malware family. Sandbox execution found no high-risk activity, while Steam DRM plausibly explains the encrypted sections; however, the file is unsigned and so its provenance remains uncertain.
The antivirus result is weakly adverse: 3 of the 70 antivirus engines that checked it reported generic detections, but all major antivirus engines were silent and there is no family agreement. Three completed sandbox runs found no malicious verdict, injection target, persistence, file it created, or sample-attributed network activity. The encrypted code and binding section align with the identified SteamStub DRM wrapper and should not be treated as separate evidence of concealment. Prior files sharing the import hash lean benign, but that hash is shared across unrelated publishers using similar frameworks, so those results carry little weight. The unsigned status and extremely limited submission history prevent the benign evidence from establishing trustworthy provenance.
What We Detected
Three of the 70 antivirus engines that checked it flagged the executable: DeepInstinct, Cylance, and Trapmine. Their labels are generic machine-learning assessments rather than a named malware family, and all reporting major antivirus engines remained silent.
Threat Behavior
Three completed sandbox runs produced no malicious verdict. No process injection target, persistence mechanism, file it created, or sample-attributed network connection was recorded. The high-entropy code and binding section correspond to SteamStub, Valve's DRM wrapper, so those encrypted sections are not independent evidence of malware packing.
What To Do Now
The file is unsigned and has only recently appeared, so its publisher cannot be authenticated and its reputation is not established. Keep security software enabled, obtain the executable through the game's official Steam installation or another verified publisher channel, and avoid running this backup copy unless its hash matches a trusted installation.
Where this verdict could be wrong2 caveats
- Three engines raised generic machine-learning detections, including one mid-tier engine, so the alerts cannot be dismissed as exclusively less reliable noise.
- The executable is unsigned and has only just been observed, leaving little publisher or reputation history to support the benign indicators.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- All reporting major antivirus engines remained silent.
- Three completed sandbox runs produced no malicious verdict or high-risk activity.
- No malware family was identified by the detecting engines.
- The encrypted sections are consistent with the identified SteamStub DRM wrapper.
- No hostile external-intelligence listing or malware-specific community rule matched the hash.
- Three antivirus engines raised generic machine-learning alerts, including one mid-tier detector.
- The executable has no digital signature to authenticate its publisher.
- It was first observed very recently and has only two known submitters.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 7sandbox rule tags
- 1spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 2: FileSeen in the test run
ZEDZONE.exe.bak
9af4ef7aaf1c48272a033039df0fe3dd7a397e1de5f5769adceeeffa9810d21f
Uploaded file
- 1
Processes
What ran
- Evidence 2 of 2: ProcessSeen in the test run
file.exe
"C:\Users\user\Desktop\file.exe"
Test run
2 facts from the test run. See the full activity list.
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
7MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1071· Application protocol
- T1129· Loads modules
- T1553
- T1553.002
Observed activity
Processes started
1Programs the file ran, with their command lines.
file.exe"C:\Users\user\Desktop\file.exe"
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
assets.msn.com
Chapter 04
Technical details
3 of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 3
- CylanceUnsafe
- DeepInstinctMALICIOUS
- Trapminesuspicious.low.ml.score
File fingerprint
- Last analyzed
- Oct 18, 2026, 4:53 PM UTC
- SHA-256
9af4ef7aaf1c48272a033039df0fe3dd7a397e1de5f5769adceeeffa9810d21f- SHA-1
4b1b45bddcd2bd1e85092ef2a70bcf283c75f5fd- MD5
cd0f7fcef20ffb717f0d1facfd315f3c
About this file
ZEDZONE.exe.bak is a Win32 EXE file of 900.7 kB.
- Type and size
- Win32 EXE · 900.7 kB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 18, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- Possibly packedPacking hides code; legitimate installers use it too.
- Entropy
- 6.62 of 8A code section is highly compressed or encrypted.
First scanned
Antivirus consensus
3 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines1flagged
- Low-trust17 engines2flagged
View all 75 engine results
- CylanceMalicious: Unsafe
- DeepInstinctMalicious: MALICIOUS
- TrapmineMalicious: suspicious.low.ml.score
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
Executable sections have high entropy (7.2+) — the code is compressed or encrypted and only decrypted at runtime. Classic packing behaviour.
How widely this file has been seen
Barely seen in the wild and first surfaced recently. 3 antivirus detections make that low prevalence materially relevant, but rarity alone is not proof of malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ZEDZONE.exe.bak safe, or is it malware?
What is ZEDZONE.exe.bak?
How many antivirus engines detected ZEDZONE.exe.bak?
I already downloaded and ran ZEDZONE.exe.bak — what should I do?
What is the SHA-256 hash of ZEDZONE.exe.bak?
How up to date is this analysis of ZEDZONE.exe.bak?
Community
Member reviews and reports for this exact file hash.