File scan report
Verdict Safe
Is Screen
Only 1 of the 66 antivirus engines that checked it flagged this long-established archive, while major antivirus engines found nothing and the test run produced no malicious…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Keep protection enabled and use the archive only if it came from the official ScreenWings distribution channel. Re-scan the extracted executable and verify its hash before execution when provenance is uncertain.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 6y ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The lone Themida detection lacks support from any major antivirus engine or external research source. Although one sandbox recorded two potentially offensive techniques and direct-IP traffic, it issued no malicious conclusion, and complete reputation results for those IP addresses are unavailable.
Zillya alone flagged the archive as Trojan.Themida, while all 17 reporting major antivirus engines remained silent. The archive has circulated for more than six years across 206 sources and 258 submissions, which strongly lowers concern around a solitary detection. One completed sandbox run recorded and T1562.001, but it produced no malicious sandbox verdict, persistence indicator, or registry modification. Ten dropped hashes were inspected without a malicious child finding, though their individual classifications remain unknown. Two direct IP contacts were observed, but no complete host-reputation cross-check is available. Overall, the Themida label is more consistent with a packer-related false positive than a corroborated trojan finding.
What We Detected
Zillya was the only detector among 75 engines, reporting Trojan.Themida.Win32.163854. No major antivirus engines detected the archive, and there was no family consensus or corroboration from CIRCL, MalwareBazaar, or YARAify. The file also has more than six years of submission history, with 206 sources and 258 submissions.
Threat Behavior
One completed sandbox run recorded T1547.001 and T1562.001, techniques associated with startup persistence and impairment of defenses. However, the run produced no malicious sandbox verdict, persistence indicator, or registry modification. It also contacted 2.20.156.175 and 18.213.11.84, but no complete host-reputation result is available. Ten dropped hashes were inspected without a malicious-child finding, although their individual verdicts remain unknown.
What To Do Now
Keep security software enabled and obtain the archive from its official distribution source where possible. If the source is uncertain, scan the extracted executable again before running it and verify its hash against the publisher's release.
Where this verdict could be wrong3 caveats
- Zillya identified Trojan.Themida.Win32.163854, providing one smaller malware signal despite no corroborating engine family consensus.
- and can represent persistence and impairment of defenses, although the runtime report recorded no persistence indicators or malicious sandbox verdict.
- One of our behaviour rules fired after contacts to 2.20.156.175 and 18.213.11.84; the missing contacted-host reputation result leaves their reputation unresolved.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1/66 engines detected the archive
- No major antivirus engines flagged it with 17 major antivirus engines reporting clean
- No sandbox returned a malicious verdict
- No dropped file is known to be malicious
- 206 sources and 258 submissions over 2,339 days
- Zillya detection: Trojan.Themida.Win32.163854
- Runtime technique T1547.001
- Runtime technique T1562.001
- Direct contacts to 2.20.156.175 and 18.213.11.84 lack a completed reputation cross-check
- All 10 inspected child hashes have unknown individual verdicts
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 16sandbox rule tags
- 6spawned processes
- 2network contacts
- 37filesystem & mutex artifacts
Includes 16 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The Safe verdict weighed these detections and treats them as non-decisive.
- ZillyaTrojan.Themida.Win32.163854
File fingerprint
- Last analyzed
- Sep 10, 2026, 7:49 PM UTC
- SHA-256
9d7ca66e18ee49ca15a266c82e2d706477a04dab659dcac442d64df36e7616c9- SHA-1
8e2997696ff5ba3f3584161526a689cde97372fe- MD5
1656cb19fa62a4fbe056c2bd1dd8744a
About this file
ScreenWings.zip is a ZIP file of 4.5 MB.
- Type and size
- ZIP · 4.5 MB
- Signer
- Not applicable
- First seen
- Apr 15, 2020On VirusTotal.
- Submitted by
- 206 distinct sources
First scanned Updated
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ScreenWings.zip safe?
What is ScreenWings.zip?
How many antivirus engines detected ScreenWings.zip?
What is the SHA-256 hash of ScreenWings.zip?
Is it safe to open or extract ScreenWings.zip?
How up to date is this analysis of ScreenWings.zip?
Community
Member reviews and reports for this exact file hash.
