File scan report
Verdict Safe
Is dkong.
None of the 65 antivirus engines that checked it flagged this small ZIP archive, first seen on Aug 17, 2009 and submitted by 122 distinct sources, and no reference database lists…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
No action is needed for this archive. If it arrived unexpectedly, confirm the sender before opening it, and keep your antivirus protection switched on.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 17y ago
Chapter 02
Why we think so
0 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No engine detected anything in this ZIP archive, and none of the reference databases we check hold a record for it. It has been circulating since 2009 and has been submitted by 122 distinct sources, which fits an old, widely passed-around archive rather than a targeted lure. Nothing hostile appeared in the sandbox run either.
The archive produced no detection from any engine, and the major antivirus engines that analysed it — BitDefender, Kaspersky, ESET-NOD32, Microsoft and the others in that group — all returned clean results. It is an old file, first seen on Aug 17, 2009, and has been sent to us by 122 distinct sources across 186 submissions, so it has been visible to every major vendor for many years without acquiring a signature. The sandbox run recorded no high-risk techniques, no network contacts by the sample and no dropped files; the only registry writes were ordinary Internet Explorer toolbar and add-on statistics. Reference databases returned nothing either: no public malware listing, no malware-specific community rule and no known-good entry. With no detection, no hostile behaviour and no adverse intelligence, the evidence supports a clean shape.
What We Detected
Nothing. The file is a small ZIP archive of about 22 KB. Zero of the 65 antivirus engines that checked it flagged it, and the 18 major antivirus engines that reported — including BitDefender, Kaspersky, ESET-NOD32, Microsoft, Avast, AVG and Fortinet — all returned clean results. No public malware listing, community rule set or reference database returned a match.
Threat Behavior
A sandbox run was completed and produced no high-risk technique mappings, no network contacts attributed to the sample and no dropped files. The only system changes recorded were ordinary Internet Explorer toolbar and add-on statistics, which the browser writes during normal use and are not a persistence mechanism. There was no evidence of process injection, credential access, defence tampering or encryption activity.
Reputation and History
The archive was first seen on Aug 17, 2009 and has been submitted 186 times from 122 distinct sources. A file in circulation that long, seen by every major vendor, with no detection to show for it, points to ordinary content rather than something hostile. Archives of this size and age often hold DOS-era games, emulator data or small utility files that have simply been passed around for years.
Caveats
The archive itself was not unpacked and inspected byte by byte, so this assessment rests on the absence of any detection plus the sample's long, wide distribution. That is reasonable confidence, not a guarantee about every file inside the container.
What To Do Now
No action is needed. If you did not expect the archive, or it arrived attached to an unsolicited message, check the sender before opening it, and keep your antivirus protection enabled and up to date. Files of unknown origin are safer extracted into a plain folder than run directly from a download.
Where this verdict could be wrong2 caveats
- The archive's contents were never unpacked and inspected, so the clean result reflects engines that scanned the container rather than a detailed look at what it holds.
- The file is small and old enough that few people actively analyse it; a long-circulating archive could still carry an outdated payload that current detections were never tuned for.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 65 antivirus engines that checked it flagged the archive
- All 18 major antivirus engines that analysed it returned clean results
- First seen on Aug 17, 2009 and submitted by 122 distinct sources — a long-circulating, widely shared file
- No malware listing, no community rule match and no reference-database hit
- The sandbox run showed no high-risk techniques, no sample-initiated network contacts and no dropped files
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 1 isolated test; no test environment rated what it did as risky.
Test run summary
Capture complete- 1isolated sandbox run
- 0spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Observed activity
Registry and auto-start
4Settings the file changed, including ways to start again after a restart.
- Set
HKU\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked - Set
HKU\S-1-5-21-575823232-3065301323-1442773979-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Count - Set
HKU\S-1-5-21-575823232-3065301323-1442773979-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Type - Set
HKU\S-1-5-21-575823232-3065301323-1442773979-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Time
Chapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 6, 2026, 11:30 PM UTC
- SHA-256
bcfdad4052be66b40923afb97ff996c7cc0157358fcebe3374c93d270b22c8d5- SHA-1
7511e3d3dd51dcfbd30ee8e5ba2e7b7fca8a5efa- MD5
d57b26931fc953933ee2458a9552541e
About this file
dkong.zip is a ZIP file of 22.3 kB.
- Type and size
- ZIP · 22.3 kB
- Signer
- Not applicable
- First seen
- Aug 17, 2009On VirusTotal.
- Submitted by
- 122 distinct sources
First scanned
Antivirus consensus
0 of 65 engines flagged this file
10 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is dkong.zip safe?
What is dkong.zip?
How many antivirus engines detected dkong.zip?
What is the SHA-256 hash of dkong.zip?
Is it safe to open or extract dkong.zip?
How up to date is this analysis of dkong.zip?
Community
Member reviews and reports for this exact file hash.