File verdict·Decided by the MT AI Engine
Our call

Safe

Legitimate Zemana AntiMalware installer with detections from common security software behaviors flagged as false positives by our antivirus network.

Verified · Zemana D.O.O. Sarajevo
Trust score88High trust
MT AI confidence · 88%
Zemana.AntiMalware.Setup.exe
13.3 MB
b548f01428cb26a5877bf23fa965
Antivirus engines
5 of 75 flagged
Code signing
Signed by Zemana D.O.O. Sarajevo
Age
First seen 5y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

88%Confidence
Very high
Reasoning

Overwhelming majority of tier-1 engines (16/17) report clean, with only generic/tool detections on a signed security installer. Behavioral signals match typical installer actions like temp file extraction and driver setup, not exploitation. High prevalence and age confirm it's established software. Heuristics for injection/IP contact reflect AV self-protection, not threats.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. DrWeb (tier1) 'Tool.VulnDriver.18'

  2. signing.verified=true, signer='Zemana D.O.O. Sarajevo'

  3. filenameAnalysis.looksLikeSecuritySoftware=true

  4. prevalence.classification='common_old' (3951 submissions)

  5. engines.tier1ReportedClean=16

Points in its favour
  • Verified signature by Zemana D.O.O. Sarajevo
  • 16/17 tier1 engines clean
  • Common_old prevalence (3951 submissions)
  • looksLikeSecuritySoftware=true + installer hint
  • No malicious runtime verdicts
Points against
  • DrWeb tier1 'Tool.VulnDriver.18' (vulnerable driver usage)
  • YARAify 'shellcode' rule match (generic)
  • Direct IP contacts in sandbox (benign Windows/Microsoft)
What to do

This file is safe and appears to be a genuine Zemana AntiMalware installer. Download fresh from Zemana's official site to confirm integrity.

Threat family attribution

PE Digital Certificate corroborated by 1 source

  • 4 YARA rules
    PE_Digital_Certificate, PE_Potentially_Signed_Digital_Certificate, shellcode
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
28

Adversary techniques mapped to the MITRE ATT&CK framework.

T1010T1012T1018T1027T1027.002T1033T1036T1055T1056.004T1057T1059T1070.006T1071T1082T1083T1129T1134T1140T1497T1497.001T1518.001T1529T1543.003T1547.001+4 more
Spawned processes
15
$(unnamed)
"C:\Users\<USER>\Desktop\file.exe"
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\is-1O9ES.tmp\file.tmp" /SL5="$20196,13025042,780800,C:\Users\<USER>\Desktop\file.exe"
$(unnamed)
%SAMPLEPATH%\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.exe
$(unnamed)
%USERPROFILE%\AppData\Local\Temp\is-23RKI.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
$(unnamed)
C:\Windows\System32\wuapihost.exe
$(unnamed)
%USERPROFILE%\AppData\Local\Temp\is-3NTHL.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
$(unnamed)
%USERPROFILE%\AppData\Local\Temp\is-2SAD4.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
$(unnamed)
%USERPROFILE%\AppData\Local\Temp\is-9P5T0.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
+7 more processes captured.
Network activity
23
IP addresses20
  • 204.79.197.203
  • 209.85.200.94
  • a83f:8110:0:0:1b00:100:2800:0
  • a83f:8110:8f:351d:67c6:9a4d:e695:3e9f
  • 192.168.0.13
  • 192.168.0.4
  • a83f:8110:0:0:4e82:21:0:0
  • 13.107.4.50
  • a83f:8110:0:0:1400:1400:2800:3800
  • 209.197.3.8
+10 more
URLs3
  • http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt
  • http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?04b4644238bd8548
  • watson.microsoft.comhttp://watson.microsoft.com/StageOne/Generic/BEX/AntiMalware_exe/3_2_28_0/60633416/clr_dll/4_0_30319_17929/4ffa5753/0023e359/c0000409/00000000.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.48.17514&SM=LENOVO&SPN=2241W2U&BV=7UET92WW%20(3.22%20)&MID=F2EC8DC6-EB4A-4B44-95EF-9B81DC7C287B
Persistence
1
Indicators1
  • amsdk
Filesystem & mutexes
40
Files written15
  • C:\Users\<USER>\AppData\Local\Temp\is-1O9ES.tmp\file.tmp
  • C:\Users\<USER>\AppData\Local\Temp\Setup Log 2024-08-07 #001.txt
  • C:\Users\<USER>\AppData\Local\Temp\is-RRSJP.tmp\_isetup\_setup64.tmp
  • C:\Users\<USER>\AppData\Local\Temp\is-RRSJP.tmp\AMSDKCore399001.dll
  • C:\Users\<USER>\AppData\Local\Temp\is-RRSJP.tmp\Partners.ini
+10 more
Files deleted15
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WERC11.tmp.WERInternalMetadata.xml
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBC.tmp.csv
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WERCEC.tmp.txt
  • C:\Windows\System32\spp\store\2.0\cache\cache.dat
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER298B.tmp.WERInternalMetadata.xml
+10 more
Mutexes created10
  • Local\MSCTF.Asm.MutexDefault1
  • madExceptSettingsMtx$494
  • Global\e4e6189c920c633c7d586a7b8351c7dc.trace
  • DefaultTabtip-MainUI
  • Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwWriterMutex
+5 more
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • c0c7e61f5d7f57f14f67736590Never scanned
    never seen before
  • b6a8596d7d5a2a2b4a8acd29deNever scanned
    never seen before
  • 388a796580234efc95f3136f95Never scanned
    never seen before
  • 9942fff044a14df4a876a94220Never scanned
    never seen before
  • ca10cd00b06593f4ce254cf269Never scanned
    never seen before
  • 2c63c9035a5794423fcf7d3bb5Never scanned
    never seen before
  • bd5acd4d27639792d36aaf48afNever scanned
    never seen before
  • 2b0ee097f75a7af155195ec4f8Never scanned
    never seen before
  • bfef2e8e71c72061bd0fb8c04aNever scanned
    never seen before
  • f7d43b82eaffa7efbf666f6ed6Never scanned
    never seen before
External threat intelligence

1 corroborating signal from researcher-curated sources

YARAify HIT·4 community rules matchedView on YARAify
  • PE_Digital_Certificateby albertzsigovits
  • PE_Potentially_Signed_Digital_Certificateby albertzsigovits
  • shellcodeby nex
    Matched shellcode byte patterns
  • Suspicious_Macro_Presenceby Mehmet Ali Kerimoglu (CYB3RMX)
    This rule detects common malicious/suspicious implementations.
Cross-referenced against MalwareBazaar (abuse.ch), YARAify, and the CIRCL hashlookup reference DB.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

4 YARAify3 synthesis
MITRE ATT&CK profile
Persistence× 1Defense evasion× 1C2× 1
YARAify (community)
Researcher-authored rules via abuse.ch
  • PE_Digital_Certificate
  • PE_Potentially_Signed_Digital_Certificate
  • shellcode
  • Suspicious_Macro_Presence
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • PersistenceScheduledTaskmedium

    Sandbox flagged persistence indicators (registry Run keys / services / scheduled tasks).

    Evidence
    amsdk
  • ProcessInjectionhigh

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    "C:\Users\<USER>\Desktop\file.exe"
  • DirectIpC2medium

    Sample contacted 13 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    204.79.197.203 · 209.85.200.94 · a83f:8110:0:0:1b00:100:2800:0
Antivirus engine breakdown

5 detections across 75 engines

5 malicious0 suspicious70 clean
Tier-117 engines
1flag
Top commercial AVs (low FP rate)
Tier-238 engines
2flag
Mainstream engines with mixed FP rates
Low-trust20 engines
2flag
Heuristic / generic-AI engines (high FP rate)
APEX
malicious
Malicious
Bkav
malicious
W32.AIDetectMalware
DrWeb
malicious
Tool.VulnDriver.18
Google
malicious
Detected
Varist
malicious
W64/VulDriver.D
Hash b548f01428cb… cross-referenced against 75 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked
Section entropy10 sections
.text
6.36
.itext
5.97
.data
5.04
.bss
0.00
.idata
4.90
.didata
2.76
.edata
1.87
.tls
0.00
.rdata
1.38
.rsrc
4.42
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old
Unique uploaders
2,647
Hundreds of people have uploaded this — common.
Total submissions
3,951
Includes repeat uploads by the same source.
First seen by VT
5y ago
Mar 31, 2021
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
here
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
3/31/2021, 4:21:07 AM
First seen (MalwareBazaar)
Last analysis (VT)
4/29/2026, 3:08:08 AM
Scanned here
5/2/2026, 6:49:57 AM
File name
Zemana.AntiMalware.Setup.exe
Size
13.28 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965
MD5
048ea3233e0e7611ab414684583c1421
SHA-1
026e20baca271cbfea44fa2ce6f3e405ca5d263d
PE imphash
5a594319a0d69dbc452e748bcf05892e
First seen (VT)
3/31/2021, 4:21:07 AM
Last analysis (VT)
4/29/2026, 3:08:08 AM
First scan (MalwareTips)
5/2/2026, 6:49:58 AM
Last scan (MalwareTips)
5/2/2026, 6:49:57 AM
Code signer
Zemana D.O.O. Sarajevoverified
Community reputation
+10trusted
Behavior tags
runtime-modulespeexelong-sleepschecks-disk-spacedirect-cpu-clock-accessdetect-debug-environmentsignedoverlay
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scanned by
harlan4096Staff
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.