Safe
Legitimate Zemana AntiMalware installer with detections from common security software behaviors flagged as false positives by our antivirus network.
b548f01428cb26a587…7bf23fa965The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
Overwhelming majority of tier-1 engines (16/17) report clean, with only generic/tool detections on a signed security installer. Behavioral signals match typical installer actions like temp file extraction and driver setup, not exploitation. High prevalence and age confirm it's established software. Heuristics for injection/IP contact reflect AV self-protection, not threats.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
DrWeb (tier1) 'Tool.VulnDriver.18'
signing.verified=true, signer='Zemana D.O.O. Sarajevo'
filenameAnalysis.looksLikeSecuritySoftware=true
prevalence.classification='common_old' (3951 submissions)
engines.tier1ReportedClean=16
- Verified signature by Zemana D.O.O. Sarajevo
- 16/17 tier1 engines clean
- Common_old prevalence (3951 submissions)
- looksLikeSecuritySoftware=true + installer hint
- No malicious runtime verdicts
- DrWeb tier1 'Tool.VulnDriver.18' (vulnerable driver usage)
- YARAify 'shellcode' rule match (generic)
- Direct IP contacts in sandbox (benign Windows/Microsoft)
This file is safe and appears to be a genuine Zemana AntiMalware installer. Download fresh from Zemana's official site to confirm integrity.
PE Digital Certificate corroborated by 1 source
- 4 YARA rulesPE_Digital_Certificate, PE_Potentially_Signed_Digital_Certificate, shellcode
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 204.79.197.203
- 209.85.200.94
- a83f:8110:0:0:1b00:100:2800:0
- a83f:8110:8f:351d:67c6:9a4d:e695:3e9f
- 192.168.0.13
- 192.168.0.4
- a83f:8110:0:0:4e82:21:0:0
- 13.107.4.50
- a83f:8110:0:0:1400:1400:2800:3800
- 209.197.3.8
- http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?04b4644238bd8548
- watson.microsoft.comhttp://watson.microsoft.com/StageOne/Generic/BEX/AntiMalware_exe/3_2_28_0/60633416/clr_dll/4_0_30319_17929/4ffa5753/0023e359/c0000409/00000000.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.48.17514&SM=LENOVO&SPN=2241W2U&BV=7UET92WW%20(3.22%20)&MID=F2EC8DC6-EB4A-4B44-95EF-9B81DC7C287B
- amsdk
- C:\Users\<USER>\AppData\Local\Temp\is-1O9ES.tmp\file.tmp
- C:\Users\<USER>\AppData\Local\Temp\Setup Log 2024-08-07 #001.txt
- C:\Users\<USER>\AppData\Local\Temp\is-RRSJP.tmp\_isetup\_setup64.tmp
- C:\Users\<USER>\AppData\Local\Temp\is-RRSJP.tmp\AMSDKCore399001.dll
- C:\Users\<USER>\AppData\Local\Temp\is-RRSJP.tmp\Partners.ini
- C:\ProgramData\Microsoft\Windows\WER\Temp\WERC11.tmp.WERInternalMetadata.xml
- C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBC.tmp.csv
- C:\ProgramData\Microsoft\Windows\WER\Temp\WERCEC.tmp.txt
- C:\Windows\System32\spp\store\2.0\cache\cache.dat
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER298B.tmp.WERInternalMetadata.xml
- Local\MSCTF.Asm.MutexDefault1
- madExceptSettingsMtx$494
- Global\e4e6189c920c633c7d586a7b8351c7dc.trace
- DefaultTabtip-MainUI
- Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwWriterMutex
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- c0c7e61f5d7f57f14f67…736590Never scannednever seen before
- b6a8596d7d5a2a2b4a8a…cd29deNever scannednever seen before
- 388a796580234efc95f3…136f95Never scannednever seen before
- 9942fff044a14df4a876…a94220Never scannednever seen before
- ca10cd00b06593f4ce25…4cf269Never scannednever seen before
- 2c63c9035a5794423fcf…7d3bb5Never scannednever seen before
- bd5acd4d27639792d36a…af48afNever scannednever seen before
- 2b0ee097f75a7af15519…5ec4f8Never scannednever seen before
- bfef2e8e71c72061bd0f…b8c04aNever scannednever seen before
- f7d43b82eaffa7efbf66…6f6ed6Never scannednever seen before
1 corroborating signal from researcher-curated sources
- PE_Digital_Certificateby albertzsigovits
- PE_Potentially_Signed_Digital_Certificateby albertzsigovits
- shellcodeby nexMatched shellcode byte patterns
- Suspicious_Macro_Presenceby Mehmet Ali Kerimoglu (CYB3RMX)This rule detects common malicious/suspicious implementations.
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
- PE_Digital_Certificate
- PE_Potentially_Signed_Digital_Certificate
- shellcode
- Suspicious_Macro_Presence
Sandbox flagged persistence indicators (registry Run keys / services / scheduled tasks).
EvidenceamsdkMITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Users\<USER>\Desktop\file.exe"Sample contacted 13 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence204.79.197.203 · 209.85.200.94 · a83f:8110:0:0:1b00:100:2800:0
5 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- Zemana.AntiMalware.Setup.exe
- Size
- 13.28 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965
- MD5
- 048ea3233e0e7611ab414684583c1421
- SHA-1
- 026e20baca271cbfea44fa2ce6f3e405ca5d263d
- PE imphash
- 5a594319a0d69dbc452e748bcf05892e
- First seen (VT)
- 3/31/2021, 4:21:07 AM
- Last analysis (VT)
- 4/29/2026, 3:08:08 AM
- First scan (MalwareTips)
- 5/2/2026, 6:49:58 AM
- Last scan (MalwareTips)
- 5/2/2026, 6:49:57 AM
- Code signer
- Zemana D.O.O. Sarajevoverified
- Community reputation
- +10trusted
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.