Many endpoint and malware scanners flag Impacket a malware. It is a legitimate security tool often used for testing Windows Kerberos secuirity and AD environments. However, it has been also used in a significant number of cyber attacks. If Zscaler is using an inbound content proxy then mirrors may also be blocked because it operates inline to inspect downloads and block malware. Your firewall may need a rule exception to allow downloads.