Manalyze report for 8117e40ee7f824f63373a4f5625bb62749f69159d0c449b3ce2f35aad3b83549

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2019-Feb-21 16:00:00
Detected languages	English - United States
CompanyName	Igor Pavlov
FileDescription	7-Zip Standalone Console
FileVersion	`19.00`
InternalName	7za
LegalCopyright	Copyright (c) 1999-2018 Igor Pavlov
OriginalFilename	7za.exe
ProductName	7-Zip
ProductVersion	`19.00`

Plugin Output

Info	Cryptographic algorithms detected in the binary:	`Uses constants related to SHA1` `Uses constants related to SHA256` `Uses constants related to AES`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryW GetProcAddress` `Can create temporary files: CreateFileW GetTempPathW` `Functions related to the privilege level: OpenProcessToken AdjustTokenPrivileges` `Enumerates local disk drives: GetLogicalDriveStringsW` `Changes object ACLs: SetFileSecurityW`
Safe	VirusTotal score: 0/71 (Scanned on 2026-08-03 10:59:26)	`All the AVs think this file is safe.`

Hashes

MD5	`e86eff95691b1c0e7e4f3e9cb1ae2e49`
SHA1	`d0acbf9ae29ec74acc67b53b2063bbc9739bc9e8`
SHA256	`8117e40ee7f824f63373a4f5625bb62749f69159d0c449b3ce2f35aad3b83549`
SHA3	`75f2e89f98fd1ab842ae23d63a45d449c2b718e57c3518fdb4ef91d293cc923d`
SSDeep	`24576:IyotkuwTgCfs7Ck+PCZbS1IJdJ0FAH48fw2:ITtkVxkdyCZbS1oCFo/fw`
Imports Hash	`7232d06dc00920698f0cad2452012553`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xe8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2019-Feb-21 16:00:00
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`8.0`
SizeOfCode	`0xcea00`
SizeOfInitializedData	`0x51600`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000000CD730 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0x123000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`145dec869fd1ffe449f161d363bf2bc1`
SHA1	`ae21c5888e38ec4aadbd3ea262cc1749ef51542a`
SHA256	`25d71817feaaf6f38c13962fbbe9cc966e03b78281a4223c051ddafa9c426c17`
SHA3	`9160ab21574402842f9c6e8c624571573d23caea1ed3dee83097cb67f67dc47b`
VirtualSize	`0xce9be`
VirtualAddress	`0x1000`
SizeOfRawData	`0xcea00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.35384`

.rdata

MD5	`de9ef9262e9af43ebe444e01ae7e423e`
SHA1	`8cb885616c3e1efea22dbd2ee97365ba98f622c0`
SHA256	`a732557a76dfa2d4092fef35087b8c50c4ad82806d6c2be8bb5693646a5f9bab`
SHA3	`f3e732df7f09c47b09fe3e2ad6afcd3057173772bb4ec598f6410d4d910e53f5`
VirtualSize	`0x38fbc`
VirtualAddress	`0xd0000`
SizeOfRawData	`0x39000`
PointerToRawData	`0xcee00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.95381`

.data

MD5	`999f0fc5b0eb74f7b8e974dabc29d583`
SHA1	`a6e8e4732047b3c9951b25c643477aeb5340f253`
SHA256	`abd315dd064c85b676d1d985c8f4e9fd7ae5be3bbd38a0e63b4c03b306ca5131`
SHA3	`a2360bfbc1eaf8bef861fe450b966268b22ed80d385ea20a79fb4bcb1c4054ea`
VirtualSize	`0x7850`
VirtualAddress	`0x109000`
SizeOfRawData	`0xa00`
PointerToRawData	`0x107e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`1.80193`

.pdata

MD5	`092b79b3bb187326ddcaf4cfed6eb9cd`
SHA1	`5c8d8b9432e68f13d0ae4630bb6902e0d0603cec`
SHA256	`f7af9103785b1874e7ecc9255fd1c9e5cc3df9dbed0cf37bf745e92de7691431`
SHA3	`99b7b70ad4a8f37bf4059895318e8dfdf35c4d94054e13d42bf3774b747139eb`
VirtualSize	`0xe34c`
VirtualAddress	`0x111000`
SizeOfRawData	`0xe400`
PointerToRawData	`0x108800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.09139`

.rsrc

MD5	`a30892748cd91310d5e3640995708714`
SHA1	`b7e43b6370103a9afd36f6a65412689d5b30972c`
SHA256	`5a21fe91ec958f1c5d8718a9f4d6ec9eba4fe30197d0e0e85010cc6cbcc75ab5`
SHA3	`4abfcc0ad44af1425213af0b0c544cf0c9239dd9bcf291d64d624c33c57be253`
VirtualSize	`0x6f8`
VirtualAddress	`0x120000`
SizeOfRawData	`0x800`
PointerToRawData	`0x116c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.45458`

.reloc

MD5	`07bbcdc7f2c837f954ceccd70c327746`
SHA1	`b3cffb7f80e71008efbae9963c185177a5a264af`
SHA256	`21edf586d8a673c0f561f6cf23c7c58868eb94842ec56b263254b0e5a70a80ca`
SHA3	`336b0e72f5609fa363b23f0972c233b4d5af85e13f3421fb5cf8f3fecddb685f`
VirtualSize	`0x1fac`
VirtualAddress	`0x121000`
SizeOfRawData	`0x2000`
PointerToRawData	`0x117400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`3.86872`

Imports

OLEAUT32.dll	`SysStringLen` `VariantClear` `VariantCopy` `SysAllocString` `SysFreeString` `SysAllocStringLen`
USER32.dll	`CharUpperW` `CharPrevExA`
ADVAPI32.dll	`GetFileSecurityW` `SetFileSecurityW` `OpenProcessToken` `LookupPrivilegeValueW` `AdjustTokenPrivileges` `SystemFunction036`
msvcrt.dll	`_exit` `_c_exit` `_XcptFilter` `_onexit` `__dllonexit` `??1type_info@@UEAA@XZ` `?terminate@@YAXXZ` `__C_specific_handler` `_beginthreadex` `_isatty` `realloc` `strlen` `memset` `wcsstr` `strstr` `wcscmp` `_cexit` `memmove` `fflush` `fputc` `fputs` `_iob` `fgetc` `fclose` `free` `_CxxThrowException` `malloc` `memcmp` `_purecall` `__CxxFrameHandler` `memcpy` `exit` `__getmainargs` `__initenv` `_initterm` `__setusermatherr` `_commode` `_fmode` `__set_app_type` `strcmp`
KERNEL32.dll	`ResetEvent` `CreateSemaphoreW` `CreateEventW` `ReleaseSemaphore` `InitializeCriticalSection` `GetVersionExW` `SetEvent` `SetFileAttributesW` `WaitForSingleObject` `VirtualFree` `VirtualAlloc` `QueryPerformanceCounter` `LocalFileTimeToFileTime` `GetConsoleMode` `SetConsoleMode` `SetFileApisToOEM` `GetCommandLineW` `GetConsoleScreenBufferInfo` `SetConsoleCtrlHandler` `IsProcessorFeaturePresent` `GetProcessTimes` `DeleteCriticalSection` `SetProcessAffinityMask` `OpenEventW` `UnmapViewOfFile` `MapViewOfFile` `OpenFileMappingW` `WaitForMultipleObjects` `LeaveCriticalSection` `EnterCriticalSection` `GetStdHandle` `GetSystemTimeAsFileTime` `FileTimeToDosDateTime` `DosDateTimeToFileTime` `GlobalMemoryStatusEx` `GetSystemInfo` `GetProcessAffinityMask` `FileTimeToLocalFileTime` `FileTimeToSystemTime` `CompareFileTime` `GetCurrentProcess` `GetDiskFreeSpaceW` `GetFileInformationByHandle` `SetEndOfFile` `WriteFile` `ReadFile` `SetFilePointer` `GetFileSize` `DeviceIoControl` `GetLastError` `MultiByteToWideChar` `WideCharToMultiByte` `FreeLibrary` `LoadLibraryW` `GetModuleFileNameW` `LocalFree` `FormatMessageW` `CloseHandle` `SetFileTime` `CreateFileW` `RemoveDirectoryW` `MoveFileW` `GetProcAddress` `GetModuleHandleW` `CreateDirectoryW` `DeleteFileW` `SetCurrentDirectoryW` `GetCurrentDirectoryW` `GetTempPathW` `SetLastError` `GetCurrentProcessId` `GetTickCount` `GetCurrentThreadId` `FindClose` `FindFirstFileW` `FindNextFileW` `GetModuleHandleA` `GetFileAttributesW` `GetLogicalDriveStringsW`

Delayed Imports

1

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2c4`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.37313`
MD5	`9367f48e4495213fbf99b99e198281c5`
SHA1	`23677f5d4e6f866dafc0d7dcd4e01cd5d620e332`
SHA256	`7d3442f73c622afb970432561170d579ec7e902e7de2d86d512157230a4aaa85`
SHA3	`c08b8ce3376387171afe78836ca027c1772abdc21cd678cf6b05e3044cac001a`

1 (#2)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x38e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.36954`
MD5	`445ab0be1ebbb45eac34dd03f4204971`
SHA1	`cda51970a44a9b2ca92f1ce56607bffd3d39bf5f`
SHA256	`fd3f18e6ec417eb0f63a003d9808553b3194f6fab33a8bf618d18a476944a5e6`
SHA3	`b5552a2682a529c160d7341b7b2ed8173a8ed7082e2c10f7513dd6b3e206c045`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	19.0.0.0
ProductVersion	19.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	Igor Pavlov
FileDescription	7-Zip Standalone Console
FileVersion (#2)	19.00
InternalName	7za
LegalCopyright	Copyright (c) 1999-2018 Igor Pavlov
OriginalFilename	7za.exe
ProductName	7-Zip
ProductVersion (#2)	19.00

Resource LangID	English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0xfb814440`
Unmarked objects	`0`
ASM objects (40310)	`1`
Imports (40310)	`11`
Total imports	`144`
C++ objects (40310)	`185`
C objects (40310)	`48`
ASM objects (VS2010 SP1 build 40219)	`4`
Resource objects (40310)	`1`
Linker (40310)	`1`

Errors

Leave a comment

No comments yet.