File scan report
Verdict Safe
Is Screen
Only 1 of the 66 antivirus engines that checked it flagged this long-established archive, while major antivirus engines found nothing and the test run produced no malicious…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Keep protection enabled and use the archive only if it came from the official ScreenWings distribution channel. Re-scan the extracted executable and verify its hash before execution when provenance is uncertain.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 6y ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The lone Themida detection lacks support from any major antivirus engine or external research source. Although one sandbox recorded two potentially offensive techniques and direct-IP traffic, it issued no malicious conclusion, and complete reputation results for those IP addresses are unavailable.
Zillya alone flagged the archive as Trojan.Themida, while all 17 reporting major antivirus engines remained silent. The archive has circulated for more than six years across 206 sources and 258 submissions, which strongly lowers concern around a solitary detection. One completed sandbox run recorded and T1562.001, but it produced no malicious sandbox verdict, persistence indicator, or registry modification. Ten dropped hashes were inspected without a malicious child finding, though their individual classifications remain unknown. Two direct IP contacts were observed, but no complete host-reputation cross-check is available. Overall, the Themida label is more consistent with a packer-related false positive than a corroborated trojan finding.
What We Detected
Zillya was the only detector among 75 engines, reporting Trojan.Themida.Win32.163854. No major antivirus engines detected the archive, and there was no family consensus or corroboration from CIRCL, MalwareBazaar, or YARAify. The file also has more than six years of submission history, with 206 sources and 258 submissions.
Threat Behavior
One completed sandbox run recorded T1547.001 and T1562.001, techniques associated with startup persistence and impairment of defenses. However, the run produced no malicious sandbox verdict, persistence indicator, or registry modification. It also contacted 2.20.156.175 and 18.213.11.84, but no complete host-reputation result is available. Ten dropped hashes were inspected without a malicious-child finding, although their individual verdicts remain unknown.
What To Do Now
Keep security software enabled and obtain the archive from its official distribution source where possible. If the source is uncertain, scan the extracted executable again before running it and verify its hash against the publisher's release.
Where this verdict could be wrong3 caveats
- Zillya identified Trojan.Themida.Win32.163854, providing one smaller malware signal despite no corroborating engine family consensus.
- and can represent persistence and impairment of defenses, although the runtime report recorded no persistence indicators or malicious sandbox verdict.
- One of our behaviour rules fired after contacts to 2.20.156.175 and 18.213.11.84; the missing contacted-host reputation result leaves their reputation unresolved.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1/66 engines detected the archive
- No major antivirus engines flagged it with 17 major antivirus engines reporting clean
- No sandbox returned a malicious verdict
- No dropped file is known to be malicious
- 206 sources and 258 submissions over 2,339 days
- Zillya detection: Trojan.Themida.Win32.163854
- Runtime technique T1547.001
- Runtime technique T1562.001
- Direct contacts to 2.20.156.175 and 18.213.11.84 lack a completed reputation cross-check
- All 10 inspected child hashes have unknown individual verdicts
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 16sandbox rule tags
- 6spawned processes
- 2network contacts
- 37filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1057· Lists programs
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1106
- T1112
- T1497· Sandbox evasion
- T1547· Auto-start
- T1547.001· Auto-start
- T1562· Disables security
- T1562.001· Disables security
Observed activity
Processes started
6Programs the file ran, with their command lines.
ScreenWings.exe"C:\Users\<USER>\AppData\Local\Temp\ScreenWings.exe"unarchiver.exeC:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\download.zip7za.exeC:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\vi3fstho.o2e" "C:\Users\user\Desktop\download.zipcmd.exeC:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\vi3fstho.o2e\Help.pdfProgramC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\AppData\Local\Temp\vi3fstho.o2e\Help.pdfRdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
2.20.156.175 - IP address
18.213.11.84
Files
30Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_2 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_3 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0
Show all 30 entries for files
- Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\64766d63a539c3ca_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0
Mutexes
7Named locks a program uses so only one copy runs; malware families often reuse them.
Global\{7e3fd23f-1c67-4c75-9169-ebcda3180d6e}\Sessions\1\BaseNamedObjects\Global\SyncRootManager\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex\Sessions\1\BaseNamedObjects\Local\Acrobat Instance Mutex\Sessions\1\BaseNamedObjects\DBWinMutex
Show all 7 entries for mutexes
\Sessions\1\BaseNamedObjects\com.adobe.acrobat.rna.RdrCefBrowserLock.DC
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- ea524d4334a91b1f0772…2a4b35Not checkedno saved verdict
- ff93f153b4de88eece05…5374d8Not checkedno saved verdict
- 3b064e5eda07d469338a…006091Not checkedno saved verdict
- 906003ced3dfb78b02de…c10835Not checkedno saved verdict
- e9c7f2079c9e58aaeae9…57fa5aNot checkedno saved verdict
- f2b9ad8969a023ec3c31…88c6b7Not checkedno saved verdict
- 27b5c7253a91e9e9e24a…094966Not checkedno saved verdict
- e92dd27286f7cbb60ed4…adb426Not checkedno saved verdict
- 92ec9678b07834a5f2bc…5b1d8aNot checkedno saved verdict
- 481ecd41bef2a3307672…19f214Not checkedno saved verdict
Chapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The Safe verdict weighed these detections and treats them as non-decisive.
- ZillyaTrojan.Themida.Win32.163854
File fingerprint
- Last analyzed
- Sep 10, 2026, 7:49 PM UTC
- SHA-256
9d7ca66e18ee49ca15a266c82e2d706477a04dab659dcac442d64df36e7616c9- SHA-1
8e2997696ff5ba3f3584161526a689cde97372fe- MD5
1656cb19fa62a4fbe056c2bd1dd8744a
About this file
ScreenWings.zip is a ZIP file of 4.5 MB.
- Type and size
- ZIP · 4.5 MB
- Signer
- Not applicable
- First seen
- Apr 15, 2020On VirusTotal.
- Submitted by
- 206 distinct sources
First scanned Updated
Antivirus consensus
1 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines1flagged
- Low-trust12 engines0flagged
View all 75 engine results
- ZillyaMalicious: Trojan.Themida.Win32.163854
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32No result
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ScreenWings.zip safe?
What is ScreenWings.zip?
How many antivirus engines detected ScreenWings.zip?
What is the SHA-256 hash of ScreenWings.zip?
Is it safe to open or extract ScreenWings.zip?
How up to date is this analysis of ScreenWings.zip?
Community
Member reviews and reports for this exact file hash.
