0859c524b8a63551848f0c246abddcb1d0b7b656b0fbfe879f8d85e61a9e6edd

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-03 11:00:00
Detected languages English - United States
CompanyName Igor Pavlov
FileDescription 7-Zip Installer
FileVersion 26.03
InternalName 7zipInstall
LegalCopyright Copyright (c) 1999-2026 Igor Pavlov
OriginalFilename 7zipInstall.exe
ProductName 7-Zip
ProductVersion 26.03

Plugin Output

Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • LoadLibraryW
  • GetProcAddress
 Can access the registry:
  • RegCreateKeyExW
  • RegSetValueExW
  • RegOpenKeyExW
  • RegCloseKey
  • RegQueryValueExW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Malicious The file contains overlay data. 1615671 bytes of data starting at offset 0xb200.
The file contains a 7-Zip compressed file after the PE data.
Overlay data amounts for 97.257% of the executable.
Suspicious VirusTotal score: 1/70 (Scanned on 2026-09-09 20:08:44) APEX: Malicious

Hashes

MD5 ece29f11bca82d84b4f06a0b73f127dc 🔍
SHA1 9eff75f1f9c2786a1807a220f3cd0f5279b45f5d 🔍
SHA256 0859c524b8a63551848f0c246abddcb1d0b7b656b0fbfe879f8d85e61a9e6edd 🔍
SHA3 cbf4755972f2fe0e66e4ebd0a74d9c77a5da3ce1cbb91760e0410f4743a92a5c 🔍
SSDeep 24576:XUZY27AIDG+y6ln0ofg1iPQYudr10Vpx4H7o4MtZhEZzmaUbqAjmo5vW3AQbrx:XUu27AAFifiPo6U3MZkijmo5vW3AQbrx 🔍
Imports Hash d00af420812a39241f821fb057cc3154 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 5
TimeDateStamp 2026-Sep-03 11:00:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 8.0
SizeOfCode 0x7c00
SizeOfInitializedData 0x6a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000008630 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x11000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x800000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 655e7192e2b9eac34efe46dfd2de8684 🔍
SHA1 62aa3157262fe2dbb55b6ef610c183fc319e34ca 🔍
SHA256 d08266657c4e613792d39b348f6c457af5b7d4a33cbcbd0a108c68122f843086 🔍
SHA3 1c0289b7cf32c0826bc83494303082b0185a1562f4a619cabdc9fc53fcba637a 🔍
VirtualSize 0x7b24
VirtualAddress 0x1000
SizeOfRawData 0x7c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.26224

.rdata

MD5 681e2c4ca53431b4982dc12cd68d68d2 🔍
SHA1 fd7e9bf17a6f212037482f08e5c27f374bd5f5a8 🔍
SHA256 87abc402109f56775a763c2fba04252da44fbecd65bfadcb54388c8416cd055b 🔍
SHA3 e57ea51d5e1488e55548ab3ac79bd62bbab8a2a5e457f0e4bb82ecfed32d1c07 🔍
VirtualSize 0x1a98
VirtualAddress 0x9000
SizeOfRawData 0x1c00
PointerToRawData 0x8000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.4372

.data

MD5 9475a59226943a3ad422e18169989f66 🔍
SHA1 4174927c59854c80d33c69e7a43856b2b6c6af84 🔍
SHA256 d839a3521723b8a55d09d8eed9848940b284828e4d09218202c3ee11046bc16d 🔍
SHA3 6a93cc87909571d767d237e39dc48f437ee4242cf646fe335698b2b191003d4e 🔍
VirtualSize 0x3960
VirtualAddress 0xb000
SizeOfRawData 0x200
PointerToRawData 0x9c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0203931

.pdata

MD5 16e43926b928a72ab0b9278e0d6c3bbd 🔍
SHA1 d1a80901de649e4ef03ffff5da85f0e4d6ae09c4 🔍
SHA256 3fd71067f895a87d482e7a8185bde0f152bd0a976b35908ce0bd016d4b1471dd 🔍
SHA3 7422fb3dc12df9a57b5b9f299464cbbc4c93f69de44f4b6904f152e61a50043d 🔍
VirtualSize 0x36c
VirtualAddress 0xf000
SizeOfRawData 0x400
PointerToRawData 0x9e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.80102

.rsrc

MD5 8366ec4907bd2b6043cc4f725bc22408 🔍
SHA1 050e77c79de569baff25d85b4695e7bb7af6074f 🔍
SHA256 f6f90e22750b2c4fc19f4f281cf5e4ab1f56357cc5933697d8b30e3c4fda3d96 🔍
SHA3 9c442eab777dc10ac5a018cd23308e8cd0fa4db93f7fcf9b45434f7d91a2af4c 🔍
VirtualSize 0xfe8
VirtualAddress 0x10000
SizeOfRawData 0x1000
PointerToRawData 0xa200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.3701

Imports

ole32.dll CoInitialize
CoCreateInstance
USER32.dll MessageBoxW
DestroyWindow
ShowWindow
SetWindowTextW
EnableWindow
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
ExitWindowsEx
PeekMessageW
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
LoadIconW
CreateDialogParamW
SendMessageW
ADVAPI32.dll LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
OpenProcessToken
SHELL32.dll SHGetFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
msvcrt.dll memcpy
_c_exit
__C_specific_handler
free
malloc
memmove
memcmp
exit
__set_app_type
_fmode
_commode
__setusermatherr
_initterm
__getmainargs
_acmdln
_cexit
memset
_exit
_XcptFilter
KERNEL32.dll CloseHandle
CreateFileW
GetCommandLineW
GetModuleFileNameW
ReadFile
SetFileTime
MoveFileExW
GetCurrentProcess
FormatMessageW
LocalFree
DeleteFileW
WriteFile
SetFilePointer
GetModuleHandleW
LoadLibraryExW
GetStartupInfoA
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
GetLastError
GetSystemDirectoryW
lstrcpyW
LoadLibraryW
GetProcAddress
lstrcatW
lstrlenW
GetVersion

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.39918
MD5 28683b6aa3bf8a170d1ceb9fa05bf362 🔍
SHA1 40845066b357fff695ee2d3e41c19e28442671ac 🔍
SHA256 728d514fdcaab8770f1a113f141428b4860027f6685356d74274c03e194d68a6 🔍
SHA3 43d751bf866f5bd39b82678daca2d56a0ad157584ad31fdd9433508ff72fd4d8 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.68942
MD5 794fe7995c967ebd479f68359353ebc4 🔍
SHA1 7454c492fdd935a58fad5713290c48b8abb277ba 🔍
SHA256 d06002f9e317adc6377c0bc9af92fa7e9392fd74cd9928fd911729a1e8e3e6df 🔍
SHA3 6262f83326cca2298109be4fca6a38bc56c2410be8c357b160a2992d551489b5 🔍

100

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x176
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.19524
MD5 656a46a1469ab351cbbabb430222cfef 🔍
SHA1 c51ce11d8aa49e4f06f57b7a25273aa561626a2b 🔍
SHA256 ed65f792943b4496d98ae4ffeb6cf2879f66659a5ccf4a97d757aa8ac01158ca 🔍
SHA3 a6093ef8743a6e5c998fb509d5fb10f93e8b7153fb8a44c7bb9099ad34a2fb2b 🔍

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.37086
Detected Filetype Icon file
MD5 d59e0d372ea5fd8c1f4de744376a6af4 🔍
SHA1 6883ce60e71a83424db0b41d0ab6bf61080e3de2 🔍
SHA256 b10e28a32eddb2ab20a46ceae59d9c0786911eb20f0c8dd2a28421f226ea2b8b 🔍
SHA3 5e39df982879204dd9f129a37d1e1c2ff906e88de9ae01b4418db5e8455e7ae1 🔍

1 (#3)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x2d0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.43218
MD5 b83ddedec560dca728a3f7dabbb1f82c 🔍
SHA1 fc6d4139058055104db2d55792b2764efe3679ac 🔍
SHA256 27fb1ff30fe99a0cce999ab5eb110fa8992af2af1e3adc00dbc7616707e550e0 🔍
SHA3 420f4d28d850feb7b6d1f1362e355343bec1a1b25af4f179b8d4702d0c6d195d 🔍

1 (#4)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x5b2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.38456
MD5 cb155a58b9738e2ce7f0202ecfa2558a 🔍
SHA1 e3300091ba9256654a3cbb470c7533830a34cab1 🔍
SHA256 26a6223f5623e45cd64181ff93c6d178abd00d3f2ad41f1d1222381f90bbf0b5 🔍
SHA3 823e467a392d62a5179d167fd51a877fce14316bb37203ba25e30d439cc024c2 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 26.3.0.0
ProductVersion 26.3.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Igor Pavlov
FileDescription 7-Zip Installer
FileVersion (#2) 26.03
InternalName 7zipInstall
LegalCopyright Copyright (c) 1999-2026 Igor Pavlov
OriginalFilename 7zipInstall.exe
ProductName 7-Zip
ProductVersion (#2) 26.03
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x76eaf7c3
Unmarked objects 0
ASM objects (40310) 1
Imports (40310) 13
Total imports 81
C objects (40310) 24
ASM objects (VS2019 Update 8 (16.8.4) compiler 29336) 1
Resource objects (40310) 1
Linker (40310) 1

Errors

Leave a comment

No comments yet.