File scan report

Verdict Safe

Analyzed May 2, 20265 months ago

Is Zemana.AntiMalware.Setup.exe safe? Yes, no threats found.

Legitimate Zemana AntiMalware installer with detections from common security software behaviors flagged as false positives by the antivirus engines.

Read the whole reasonShow less

Strong evidence · Widely seen for a long time, and nothing harmful found.

Install it as usual if it came from the official source

This file is safe and appears to be a genuine Zemana AntiMalware installer. Download fresh from Zemana's official site to confirm integrity.

Good practice2 tips

We found nothing harmful in this file.

Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

5 of 71 flagged

Flagged 5
No detection 66
No result 4

FileZemana.AntiMalware.Setup.exe13.9 MBSHA-256 b548f01428cb…3fa965

Code signing Zemana D.O.O. Sarajevo
Test run Completed
First seen 5y ago

It has a long history: seen by 2,647 sources over more than six months.

Chapter 02

Why we think so

2 points against it and 5 in its favour, checked against the scan evidence.

Analyst conclusion

This is the official setup executable for Zemana AntiMalware, a reputable security product. Minor flags from engines like DrWeb arise from its use of kernel drivers and protective techniques, which often trigger heuristics. No malicious behavior or payloads detected in our analysis.

Where this verdict could be wrong3 caveats

DrWeb major 'Tool.VulnDriver.18' flags vulnerable driver load, legitimate for kernel-mode security tools but can mimic hacktools.
YARAify rules 'shellcode'/'Suspicious_Macro_Presence' fired, generic matches not specific to malware.
CommunityComments include #malware tags and threat scores 8/10, but zero votes and tria.ge links show no confirmed threats.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

28sandbox rule tags
14spawned processes
5network contacts
40filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1010
T1012
T1018
T1027· Obfuscated code
T1027.002· Obfuscated code
T1033· Reads user info
T1036
T1055· Process injection
T1056.004· Keylogging
T1057· Lists programs
T1059· Runs commands
T1070.006· Covers its tracks
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1129· Loads modules
T1134
T1140· Deobfuscation
T1497· Sandbox evasion
T1497.001· Sandbox evasion
T1518.001· Checks your AV
T1529
T1543.003· Service install
T1547.001· Auto-start
T1547.008· Auto-start
T1574.002· Execution hijack
T1614
T1614.001

Observed activity

Processes started

Programs the file ran, with their command lines.

file.exe"C:\Users\<USER>\Desktop\file.exe"
file.tmp"C:\Users\<USER>\AppData\Local\Temp\is-1O9ES.tmp\file.tmp" /SL5="$20196,13025042,780800,C:\Users\<USER>\Desktop\file.exe"
b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.exe%SAMPLEPATH%\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.exe
b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp%USERPROFILE%\AppData\Local\Temp\is-23RKI.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp%USERPROFILE%\AppData\Local\Temp\is-3NTHL.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp%USERPROFILE%\AppData\Local\Temp\is-2SAD4.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp

Show all 14 entries

b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp%USERPROFILE%\AppData\Local\Temp\is-9P5T0.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp%USERPROFILE%\AppData\Local\Temp\is-QM3PF.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp%USERPROFILE%\AppData\Local\Temp\is-MMRBL.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp%USERPROFILE%\AppData\Local\Temp\is-NQNVE.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp%USERPROFILE%\AppData\Local\Temp\is-ETUGO.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp%USERPROFILE%\AppData\Local\Temp\is-KR7NP.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp%USERPROFILE%\AppData\Local\Temp\is-6IFLM.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp%USERPROFILE%\AppData\Local\Temp\is-TFJV6.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp

Network contacts

5 hosts, listed as 3 addresses, 2 links. Links show the host and path only.

IP address209.85.200.94
IP address209.197.3.8
IP address104.74.71.16
URLhttp://crt.usertrust.com/USERTrustRSAAddTrustCA.crt
URLwatson.microsoft.comhttp://watson.microsoft.com/StageOne/Generic/BEX/AntiMalware_exe/3_2_28_0/60633416/clr_dll/4_0_30319_17929/4ffa5753/0023e359/c0000409/00000000.htm

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Temp\is-1O9ES.tmp\file.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\Setup Log 2024-08-07 #001.txt
WrittenC:\Users\<USER>\AppData\Local\Temp\is-RRSJP.tmp\_isetup\_setup64.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-RRSJP.tmp\AMSDKCore399001.dll
WrittenC:\Users\<USER>\AppData\Local\Temp\is-RRSJP.tmp\Partners.ini
WrittenC:\Users\<USER>\AppData\Local\Temp\is-RRSJP.tmp\2.rtf

Show all 30 entries

WrittenC:\Users\<USER>\AppData\Local\Temp\is-Q5998.tmp\AntiMalware_Setup.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\Setup Log 2021-03-29 #001.txt
WrittenC:\Users\<USER>\AppData\Local\Temp\is-11B33.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\Setup Log 2024-07-15 #001.txt
WrittenC:\Users\<USER>\AppData\Local\Temp\is-7C9MI.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-TC88K.tmp\b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965.tmp
WrittenC:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
WrittenC:\Users\user\AppData\Local\Temp\is-LFQR1.tmp\e4e6189c920c633c7d586a7b8351c7dc.tmp
WrittenC:\Users\user\AppData\Local\Temp\Setup Log 2021-05-04 #001.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WERC11.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WERCBC.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WERCEC.tmp.txt
DeletedC:\Windows\System32\spp\store\2.0\cache\cache.dat
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER298B.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER299D.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER299E.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER2016.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER20D1.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER2101.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER340C.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER346B.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER347B.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER1509.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER15D5.tmp.csv

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

Auto-startamsdk
DeletedHKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Counter
DeletedHKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Counter
DeletedHKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Help
DeletedHKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Help
DeletedHKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Object List

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

Local\MSCTF.Asm.MutexDefault1
madExceptSettingsMtx$494
Global\e4e6189c920c633c7d586a7b8351c7dc.trace
DefaultTabtip-MainUI
Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwWriterMutex
Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:thumbcache_32.db!dfMaintainer

Show all 10 entries

Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:thumbcache_96.db!dfMaintainer
Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:thumbcache_256.db!dfMaintainer
Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1024.db!dfMaintainer
Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:thumbcache_sr.db!dfMaintainer

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processwuapihost.exeC:\Windows\System32\wuapihost.exe
VM host204.79.197.203
VM hosta83f:8110:0:0:1b00:100:2800:0
VM hosta83f:8110:8f:351d:67c6:9a4d:e695:3e9f
VM host192.168.0.13
VM host192.168.0.4

Show all 19 entries

VM hosta83f:8110:0:0:4e82:21:0:0
VM host13.107.4.50
VM hosta83f:8110:0:0:1400:1400:2800:3800
VM host20.80.129.13
VM hosta83f:8110:0:0:1400:0:0:0
VM host192.168.0.92
VM host23.216.147.64
VM host192.168.0.132
VM host192.168.0.24
VM host192.168.0.50
VM host192.168.0.1
VM hosta83f:8110:e0cc:ec97:a230:1ade:e059:47ea
VM URLhttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Dropped payload

Files this sample writes at runtime

This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.

9 not checked

c0c7e61f5d7f57f14f67…736590Not checked
no saved verdict
b6a8596d7d5a2a2b4a8a…cd29deNot checked
no saved verdict
9942fff044a14df4a876…a94220Not checked
no saved verdict
ca10cd00b06593f4ce25…4cf269Not checked
no saved verdict
2c63c9035a5794423fcf…7d3bb5Not checked
no saved verdict
bd5acd4d27639792d36a…af48afNot checked
no saved verdict
2b0ee097f75a7af15519…5ec4f8Not checked
no saved verdict
bfef2e8e71c72061bd0f…b8c04aNot checked
no saved verdict
f7d43b82eaffa7efbf66…6f6ed6Not checked
no saved verdict

Chapter 04

Technical details

5 of the 71 antivirus engines that checked it flag it; signed by Zemana D.O.O. Sarajevo.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete5 of 71 engines flagged it · 4 gave no result · treated as non-decisive DetailsApr 29, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsOct 18, 2026

Contacted hostsMalwareTips URL scannerPartial3 of 10 contacted hosts were cross-checked; coverage is incomplete DetailsOct 18, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete4 community YARA rules (1 malware-specific) · 2 MalwareTips behaviour rules DetailsOct 18, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedOct 18, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchOct 18, 2026

Engines that flagged it 5

The saved verdict treats these detections as likely false positives.

DrWeb (major engine)Tool.VulnDriver.18
APEXMalicious
BkavW32.AIDetectMalware
GoogleDetected
VaristW64/VulDriver.D

File fingerprint

Last analyzed: May 2, 2026, 10:49 AM UTC

SHA-256: b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965
SHA-1: 026e20baca271cbfea44fa2ce6f3e405ca5d263d
MD5: 048ea3233e0e7611ab414684583c1421

About this file

Zemana.AntiMalware.Setup.exe is a Win32 EXE file of 13.9 MB.

Type and size: Win32 EXE · 13.9 MB
Signer: Zemana D.O.O. SarajevoValid code signature.
First seen: Mar 31, 2021On VirusTotal.
Submitted by: 2,647 distinct sources
Packer: None detected
Entropy: 8.00 of 8

First scanned May 2, 2026Updated Oct 18, 2026

Antivirus consensus

5 of 71 engines flagged this file

5 malicious0 suspicious66 not flagged4 no result

4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
1flagged
Tier-236 engines
2flagged
Low-trust17 engines
2flagged

These detections were treated as likely false positives in the saved verdict.

View all 75 engine results

APEXMalicious: Malicious
BkavMalicious: W32.AIDetectMalware
DrWebMalicious: Tool.VulnDriver.18
GoogleMalicious: Detected
VaristMalicious: W64/VulDriver.D
AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.

4 YARA2 heuristics

MITRE ATT&CK profile

Persistence× 1Defense evasion× 1

Community YARA rules

Researcher-authored signatures reported by YARAify

PE_Digital_Certificategeneric
PE_Potentially_Signed_Digital_Certificategeneric
shellcodegeneric
Suspicious_Macro_Presence

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

PersistenceScheduledTask
T1543.003 T1053.005
medium
The sandbox recorded persistence through a service or scheduled task. Installers set these up legitimately for their own updaters and services, so this is context, not proof of malicious intent.
Evidence
amsdk
ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 8.00Unpacked

Section entropy10 sections

.text

6.36

.itext

5.97

.data

5.04

.bss

0.00

.idata

4.90

.didata

2.76

.edata

1.87

.tls

0.00

.rdata

1.38

.rsrc

4.42

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

2,647

Hundreds of people have uploaded this — common.

Total submissions

3,951

Includes repeat uploads by the same source.

First seen

6y ago

Mar 31, 2021

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is Zemana.AntiMalware.Setup.exe safe?

We found nothing harmful in Zemana.AntiMalware.Setup.exe. 5 of the 71 antivirus engines that checked it flag it; after weighing the other evidence we treat those alerts as false alarms. It has a valid digital signature from Zemana D.O.O. Sarajevo. Install it only if it came from the developer's own website or an official app store.

What is Zemana.AntiMalware.Setup.exe?

Zemana.AntiMalware.Setup.exe is a software installer, about 13.9 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Mar 31, 2021.

How many antivirus engines detected Zemana.AntiMalware.Setup.exe?

5 of the 71 antivirus engines that checked it flag Zemana.AntiMalware.Setup.exe, including Dr.Web and Google. We weigh which engines flagged it and what else the scan found, not just the count.

Is Zemana.AntiMalware.Setup.exe digitally signed?

Yes. Zemana.AntiMalware.Setup.exe has a valid digital signature from Zemana D.O.O. Sarajevo, which shows the file hasn't been changed since that publisher signed it. Malware is sometimes signed with stolen certificates, so a signature alone isn't proof of safety.

What is the SHA-256 hash of Zemana.AntiMalware.Setup.exe?

The SHA-256 fingerprint of Zemana.AntiMalware.Setup.exe is b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965, and its MD5 is 048ea3233e0e7611ab414684583c1421. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to install Zemana.AntiMalware.Setup.exe?

We found nothing harmful in Zemana.AntiMalware.Setup.exe, and its digital signature checks out. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of Zemana.AntiMalware.Setup.exe?

This report reflects the scan on May 2, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is Zemana.AntiMalware.Setup.exe safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

Engines that flagged it 5

File fingerprint

About this file

5 of 71 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is Zemana.AntiMalware.Setup.exe safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Engines that flagged it 5

File fingerprint

About this file

Related file reports