4b0071ee84de42c00ec75aa946db74c0c8d4e1a7cb965b069bcd71d331444889

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2024-Jun-12 14:58:14
Detected languages English - United States
CompanyName Igor Pavlov
FileDescription 7z Setup SFX
FileVersion 23.01
InternalName 7zS.sfx
LegalCopyright Copyright (c) 1999-2023 Igor Pavlov
OriginalFilename 7zS.sfx.exe
ProductName 7-Zip
ProductVersion 23.01

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
Info The PE is digitally signed. Signer: Opera Norway AS
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 7946ad28150dccce5a59274a8b0aab42 🔍
SHA1 c08e96cb7e80d4bb0230e9db6b4b6ce0c6250af4 🔍
SHA256 4b0071ee84de42c00ec75aa946db74c0c8d4e1a7cb965b069bcd71d331444889 🔍
SHA3 9dd75ce6bf84c9c36c39ecbb9e7c658a187c42f3b641192a47d63d2b9dca4b73 🔍
SSDeep 98304:pAaRBCh77/uyxABDPPtCsLAYnwDYXmCEHQ/KsWPdT:fRBCh77/taBDPPt9ESe4vEHQlWPdT 🔍
Imports Hash e59d00b0d90522ee1a983f13d4ff7e50 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2024-Jun-12 14:58:14
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x3a200
SizeOfInitializedData 0x1ba00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000213C0 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x3c000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x5d000
SizeOfHeaders 0x400
Checksum 0x31dba7
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 6a0f9d03234355958a7550e0435cb0aa 🔍
SHA1 21dcbd8530697a7aa1626fecc00f50e394ccd698 🔍
SHA256 e853f10bf06bb065d2396e9cd8f2d842cff0318d6664841495eddf3d945233ba 🔍
SHA3 f7f39cbef1c1d59e28519991ccabbdf14762669b11c4a84631a520dcb353e0f0 🔍
VirtualSize 0x3a1b9
VirtualAddress 0x1000
SizeOfRawData 0x3a200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.61138

.rdata

MD5 429e9929dc8ce421b0f1567fb15adc2b 🔍
SHA1 4daee6530e51c82db06b63343165d05c9773696d 🔍
SHA256 e1017b9490f37194073dcb82b3146326bd49660eafe91c739ef7c7c3f6875819 🔍
SHA3 b993136439661a641c3d08b5822dc9badaf54502694144b23aa89ac55adaa4d5 🔍
VirtualSize 0xe87a
VirtualAddress 0x3c000
SizeOfRawData 0xea00
PointerToRawData 0x3a600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.61164

.data

MD5 e00a51642ea77ddea3af17cfd1e49f31 🔍
SHA1 9b16952a67b6fe27e387b7ed7f5d35cc80583ce5 🔍
SHA256 99b6af3a1f78416e8ea7ab4b84d695fccae864156656721a96530a40cac18c71 🔍
SHA3 f3e38d587d7df270a70381330257077ad6edf88ed8c9d166870bdd241a776f83 🔍
VirtualSize 0x4be0
VirtualAddress 0x4b000
SizeOfRawData 0x1c00
PointerToRawData 0x49000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.07885

.rsrc

MD5 c9ec685712a200b76d822f3859bda492 🔍
SHA1 586f8e088d2b4c62afd1234c9d3b0460e749247e 🔍
SHA256 64ae65bd6653b7c653c0315bf5aa5afa866e5eb591375c7d63c3adcda3673b29 🔍
SHA3 0ba7806a5c0331c95dcc081572eecf3a3d93a0a72904ff33e8d157f40423127b 🔍
VirtualSize 0x8170
VirtualAddress 0x50000
SizeOfRawData 0x8200
PointerToRawData 0x4ac00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.78456

.reloc

MD5 8eb911e96942ed9a5d44944725dd52df 🔍
SHA1 844bd26e5145eadbe101b1db92211a53b80625ba 🔍
SHA256 f6147a6a80cfb9e4123d7639eb345934ab54a9052688483f9f792f634ff541f4 🔍
SHA3 0c605afeda9ce6d090acebd9f999c00c77b33572b327d8f1a764e81ec2c1412b 🔍
VirtualSize 0x31a8
VirtualAddress 0x59000
SizeOfRawData 0x3200
PointerToRawData 0x52e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.51604

Imports

KERNEL32.dll VirtualFree
VirtualAlloc
GetVersion
IsProcessorFeaturePresent
GetSystemDirectoryW
GetProcAddress
GetModuleHandleW
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
InitializeCriticalSection
WaitForSingleObject
CreateEventW
GetLastError
SetEvent
CloseHandle
ResetEvent
CreateSemaphoreW
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetModuleFileNameW
FormatMessageW
LocalFree
CreateFileW
SetFileTime
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetFileInformationByHandle
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetCurrentProcess
GetProcessAffinityMask
GetSystemInfo
GlobalMemoryStatus
GetStdHandle
Sleep
GetVersionExW
GetCommandLineW
CreateProcessW
GetExitCodeProcess
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleHandleExW
WriteConsoleW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
FormatMessageA
QueryPerformanceFrequency
GetLocaleInfoEx
FindFirstFileExW
AreFileApisANSI
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
USER32.dll LoadIconW
EndDialog
KillTimer
SetTimer
DestroyWindow
SendMessageW
SetWindowTextW
MessageBoxW
PostMessageW
LoadStringW
DialogBoxParamW
GetDlgItem
GetWindowLongW
SetWindowLongW
ShowWindow
CharUpperW
SHELL32.dll ShellExecuteExW
OLEAUT32.dll VariantClear
SysStringLen
SysAllocStringLen

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.82939
MD5 2ba6711ca166cf68474a4ad3f998516a 🔍
SHA1 e77c77c0739478097b7b54d116ccf1e0f6cee6af 🔍
SHA256 95c7ae1455ab767eb7921a453a4300f629b45053e4802f3527efd462280cbbc8 🔍
SHA3 5a424786e753bc49b1d19d3a85ad7058738ba50cdc4e46a9fb40dc8dca63f475 🔍

2

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x1e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.96057
MD5 bf24dc7b1db75264748f691e5813104c 🔍
SHA1 89e9b6f5e2da353b4538243458b926b6a168affa 🔍
SHA256 81ca03b67def0c66250ddaa3d30a9e24e039e30069a675174b9d4ba3a3128b83 🔍
SHA3 0125d06b7c1d8e3813b0c0ca863bb67ea96a99340abc87b40675fd4864b3c277 🔍

3

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.78424
MD5 df886d492d52b50f40e797d012a0a10e 🔍
SHA1 651ba39172d21d9b44d3470f125a6ae0ff97beaf 🔍
SHA256 037006931a435076cd42f74355846c1d00b733c7cf5f23c8d5c1b69ce4bf7d3b 🔍
SHA3 ad49c37167bfe6e86933cf9aa1c3febd74bf19470c225b7331e02797a763dd68 🔍

4

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x668
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.55697
MD5 8bd7266366992526c129cf16b2792bed 🔍
SHA1 6aa038a21710aa26731bd4c72e65fe16467340f1 🔍
SHA256 a4da0d2e71b6d08a330728374066652bd093d48221e91365f4d8583661de384f 🔍
SHA3 da5e6198e54cb644b4f0e3e9ea2a6e829e1f9d25b3da9e7bc58def366de44f62 🔍

5

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.43345
MD5 47d69ca58e1996ff2f281ecbc2b942ea 🔍
SHA1 c0dfc3159843847ea71fde98aa8cd20283fa78a7 🔍
SHA256 ca77a6f5d2f57ebdd5a2f0a1beb1ac29f645f89db31652374dcd77c956ab5d1d 🔍
SHA3 a562d9fab6febf257f66fe9172fa75f9482a9f7ddc85c14dcba1d669e9bc2017 🔍

6

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x6c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.88737
MD5 1648fac1619b358fb1bab30ca3923e9c 🔍
SHA1 9e9194dee82255ac981e35e4f6a3a915a8a16b77 🔍
SHA256 b08e2921a54b9551c4c8c1d2c9c4cbc155b850452ba9b015302e054d6d60845b 🔍
SHA3 ae1a2a384c6bbf1af52159fb85370fc6a16dc9aca8eb0605e3a4352b9bdb58a7 🔍

7

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.93769
MD5 f34028281a7cecaf6248ef0d50f3f40d 🔍
SHA1 5461c1af2b7fd16163d312390c713c92a0e59524 🔍
SHA256 f100b99743b1134d13c60c015762cc99b5463dd7a3a2630f04aec2dd3d05f36c 🔍
SHA3 1c3b684355089df4e83a29556d76134546bdc871b427ec2287205d63baabdb5a 🔍

8

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.74304
MD5 7a6f9c93490b7fba2acfd1b240972657 🔍
SHA1 5c3be2bf45a1b90b550397833932dd8c97ba5667 🔍
SHA256 8592a3b911eac400161eee01d983b03c4a33506fdf9469624eb4b85bbdc27361 🔍
SHA3 80e33d4baefc8452ae6c0a37f237f3d1b48a7afcd2900fb2d82b69cf3ec968b2 🔍

9

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.7783
MD5 b4dcc2e308e846dd9a0c1810e432487e 🔍
SHA1 0c2a43b92c9d94732e418c6eb6f510ba20e64a6c 🔍
SHA256 358ed8a226944798a10500c6738eda2d201059253640df01a4f1f88287c0242b 🔍
SHA3 89ee7bae5908058177e5818ca9c8e398080705d0a80beecd660f4693c638c51c 🔍

10

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.9419
MD5 0e41ecce96406654a90aed3eeea97c44 🔍
SHA1 39c72add9d8f133bc2a9def4439c7195c9259529 🔍
SHA256 f3b0e54a52796236da08a854d767fe19062013916fb675dc5162f34a18c1462e 🔍
SHA3 61a117054b7411074bb605674601aa6966d46b15d4b4ac34f2f113c8ba5dd1c1 🔍

11

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28088
MD5 44e2f91ed6b51d8dd872bc3c568e86cf 🔍
SHA1 d611277a69e3f357b7c622ee9bf166c64af6b078 🔍
SHA256 40d2c18613ad7bd58910724dde4c550385fa7549ca72624160f6bfe5be79d0d9 🔍
SHA3 931aaff66e32c2c290ca0fb30956c495b08c091a2210b43793137c8dc0376a97 🔍

12

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.09644
MD5 d11b10beee618677781c9e69e31903fc 🔍
SHA1 1a7622303a5ed4650c714b50f6e5916d39072c28 🔍
SHA256 57ae8652a08970a5765f0ac313f458275c0eb5d906bb044e05b20bfbe46c5326 🔍
SHA3 143ecefcf38f351d7b7bfdcd16abbcd4b55f710d7fb87b3aa92de14c0533680c 🔍

97

Type RT_DIALOG
Language English - United States
Codepage Latin 1 / Western European
Size 0xb8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04857
MD5 13729251ed97317c9483a16420c70648 🔍
SHA1 8aba410ab7390e4da137156c84ee6263eec1f36f 🔍
SHA256 06ca7a5a0698f88a5692f9d598ff7334209bf2272b5a2798929a1fc3b60b8677 🔍
SHA3 26bf54dacf79edac57656f57f5b7ecef59d1b97d05d3f6d93a3c811a1c9a2e9a 🔍

1 (#2)

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x60
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.38262
MD5 6e4db8988b0449f6512d49ce3a9517a7 🔍
SHA1 1eab5aa4c5fdda84410577afb775aa3d9b09d6c3 🔍
SHA256 4a208f52d1765405454937584c93131b2acee7c9baf7a7a288ad6244ff47a2b4 🔍
SHA3 95f7fdefb0b4787b0c30006573b2d7dd1789a56ad66d87acc9eb9899a607a2c6 🔍

188

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x54
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.17822
MD5 a70f26327fbf4252448d9ccccd842faf 🔍
SHA1 3a015c9d0f7e490a25be55e204d844c7de9f9d2e 🔍
SHA256 b5e7c4be8f403ccb671414c2a534c72cdaf1a8461edf59caba03ac7216780749 🔍
SHA3 70eb8333298da9ef6c413c220399886dc44d013e16ec266aa66b044066dda1c7 🔍

207

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x34
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.43775
MD5 716f3259b70c376b8757003128391219 🔍
SHA1 a1b172c455640670db67ade9d9c7b62d9d2d3396 🔍
SHA256 5b51218d289f8381b271c6d4d224c67e99c9cdbf9d3f529bb8da29687f7180ec 🔍
SHA3 d9f9ec98368534575af8442776bcb377303669e86ec003f9af3b5508c1d21d26 🔍

1 (#3)

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0xae
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.06492
Detected Filetype Icon file
MD5 6ecca286914d6ab1bfa1c72c66ce9b44 🔍
SHA1 85b7bb80b4c4aae52384597e8a5786655185b468 🔍
SHA256 9e67995af355128e94eeba7fa7abf1656b677d6e9358897a69718ce812ca6299 🔍
SHA3 1df15d20e27072d1a4fe75909a4deb4783707ff7e532a4d842307e9e593f569a 🔍

1 (#4)

Type RT_VERSION
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x27c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.40782
MD5 5fa8a27de72e16a6dfbba3d00fb4924f 🔍
SHA1 7d40e19aff64c583d206960bd764839e9d6f43aa 🔍
SHA256 50d9abafcf1bf50c3dc46a09f8e9db567640341b7f226cb6b481dac2fe5e7c54 🔍
SHA3 2db7a40dd429eee6127f0edf7bbd3f82cdeb20ac8ace40ab8fa05a04f52e0fe1 🔍

1 (#5)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x2bc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.45489
MD5 108760e8a94263c41e619b98419fabf6 🔍
SHA1 c9d80cf2b45408f1b70b9ccec5cf013ac9037aeb 🔍
SHA256 ba11a8b98601c1eb3e8dbe84fc572b30ddce82c0347ff475a2a6f7ccaa8fb7a2 🔍
SHA3 901d1ef06e6468b4f92e0d16996ba2e13b8e037f1124abec0a230d99bdb5d3a4 🔍

1 (#6)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

String Table contents

Extraction Failed
File is corrupt
Cannot create folder '{0}'
Extracting

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2024-Jun-12 14:58:14
Version 0.0
SizeofData 852
AddressOfRawData 0x473e8
PointerToRawData 0x459e8

TLS Callbacks

Load Configuration

Size 0xc0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x44b040
SEHandlerTable 0x446ed0
SEHandlerCount 123

RICH Header

XOR Key 0x84a76d0a
Unmarked objects 0
ASM objects (30795) 13
C++ objects (30795) 176
C++ objects (33218) 85
C objects (33218) 20
ASM objects (33218) 23
C objects (30795) 22
Imports (30795) 9
Total imports 203
C objects (LTCG) (33523) 86
Resource objects (33523) 1
151 1
Linker (33523) 1

Errors

[*] Warning: Multiple nodes using the name Version Info in a dictionary.
Leave a comment

No comments yet.