9b697f65ecc2d9b0152f5ee96d72dde522a7827690349d9307935dacf40f42ec
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Nov-06 09:00:00 |
| Detected languages |
English - United States
|
| CompanyName | Igor Pavlov |
| FileDescription | 7-Zip Installer |
| FileVersion | 26.06 |
| InternalName | 7zipInstall |
| LegalCopyright | Copyright (c) 1999-2026 Igor Pavlov |
| OriginalFilename | 7zipInstall.exe |
| ProductName | 7-Zip |
| ProductVersion | 26.06 |
Plugin Output
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | The file contains overlay data. |
1614136 bytes of data starting at offset 0xb200.
The file contains a 7-Zip compressed file after the PE data. Overlay data amounts for 97.2545% of the executable. |
| Suspicious | VirusTotal score: 1/71 (Scanned on 2026-11-10 09:51:36) | APEX: Malicious |
Hashes
| MD5 | 8ac81970cf3be1d03cc18328324287bc 🔍 |
|---|---|
| SHA1 | 3428f8fe3d826203dc4a66b33a5b52d66aa4664d 🔍 |
| SHA256 | 9b697f65ecc2d9b0152f5ee96d72dde522a7827690349d9307935dacf40f42ec 🔍 |
| SHA3 | d7c2ec9ee64e84438579d86abe5314120a0d788e4c1eab54b099244348667574 🔍 |
| SSDeep | 24576:P4yPiQwrr3SsGWGr4T/G9KO2OMy4mXGSgzUHDAjbM8d2y9zQ7/2J3mvhOax+C9mY:P4Vr3SzWGUy9M24wI4H4wy9zM2FeELc 🔍 |
| Imports Hash | d00af420812a39241f821fb057cc3154 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xe0 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 5 |
| TimeDateStamp | 2026-Nov-06 09:00:00 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x7c00 |
| SizeOfInitializedData | 0x6a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000008630 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x11000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x800000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | 5f09cec8387011a160234439a27f0589 🔍 |
|---|---|
| SHA1 | caa30773a6ed42a3da743115a58ea8f92d4f851f 🔍 |
| SHA256 | bdf6d8b3daedd1fc407627cb567698ed3e5b07081918c39e9415b3f950df683d 🔍 |
| SHA3 | 921fdd5fbc1a16ec507f0e3a93ba55a5289a54bfc0ba515cebe7704302b4d7dc 🔍 |
| VirtualSize | 0x7b24 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x7c00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.26232 |
.rdata
| MD5 | 208988320f6d8c4baaa12314b18234cf 🔍 |
|---|---|
| SHA1 | 2da4f7ea99d5d649a430d7cc2476d4a0bface302 🔍 |
| SHA256 | 76dd980bfd18f09ac0529a7c48947be617926b5e87c69dd6e9bfa930b4b797a8 🔍 |
| SHA3 | d1eafe7aa48fd2d5badd30c2dc696e687e6c88e431f70f4ac13729201497fde6 🔍 |
| VirtualSize | 0x1a98 |
| VirtualAddress | 0x9000 |
| SizeOfRawData | 0x1c00 |
| PointerToRawData | 0x8000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.43694 |
.data
| MD5 | 9475a59226943a3ad422e18169989f66 🔍 |
|---|---|
| SHA1 | 4174927c59854c80d33c69e7a43856b2b6c6af84 🔍 |
| SHA256 | d839a3521723b8a55d09d8eed9848940b284828e4d09218202c3ee11046bc16d 🔍 |
| SHA3 | 6a93cc87909571d767d237e39dc48f437ee4242cf646fe335698b2b191003d4e 🔍 |
| VirtualSize | 0x3960 |
| VirtualAddress | 0xb000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x9c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.0203931 |
.pdata
| MD5 | de400f075077a1733765a032f58f83c8 🔍 |
|---|---|
| SHA1 | 101940ebb4d28da254e715e40b5f181cc1db71a2 🔍 |
| SHA256 | 54e2bd958b6758517960ece9bf9dee30c41a3155e008ddc3c74efe5ad01e0c63 🔍 |
| SHA3 | 51c8785d16bfbdeb2116ce171071a08b62ca823c7924c4071f5f009f677c5826 🔍 |
| VirtualSize | 0x36c |
| VirtualAddress | 0xf000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x9e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.79967 |
.rsrc
| MD5 | 91db9a717b545bd5033c8379cbdd03aa 🔍 |
|---|---|
| SHA1 | bde33cb65f3b44b7259835f12afd6565b7d64b08 🔍 |
| SHA256 | 80bd78d8acc1bcde1d0cb329383d622539d52cbecd4fa19c9c7e08970d2928d3 🔍 |
| SHA3 | b1d24d236a21af35310ac67950315f3ac4fcaa88ffafac46dd0e67975608a77e 🔍 |
| VirtualSize | 0xfe8 |
| VirtualAddress | 0x10000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0xa200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.37037 |
Imports
| ole32.dll |
CoInitialize
CoCreateInstance |
|---|---|
| USER32.dll |
MessageBoxW
DestroyWindow ShowWindow SetWindowTextW EnableWindow GetDlgItem SetDlgItemTextW GetDlgItemTextW ExitWindowsEx PeekMessageW DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW LoadIconW CreateDialogParamW SendMessageW |
| ADVAPI32.dll |
LookupPrivilegeValueW
AdjustTokenPrivileges RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW OpenProcessToken |
| SHELL32.dll |
SHGetFolderPathW
SHGetPathFromIDListW SHBrowseForFolderW |
| msvcrt.dll |
memcpy
_c_exit __C_specific_handler free malloc memmove memcmp exit __set_app_type _fmode _commode __setusermatherr _initterm __getmainargs _acmdln _cexit memset _exit _XcptFilter |
| KERNEL32.dll |
CloseHandle
CreateFileW GetCommandLineW GetModuleFileNameW ReadFile SetFileTime MoveFileExW GetCurrentProcess FormatMessageW LocalFree DeleteFileW WriteFile SetFilePointer GetModuleHandleW LoadLibraryExW GetStartupInfoA SetFileAttributesW GetFileAttributesW CreateDirectoryW GetLastError GetSystemDirectoryW lstrcpyW LoadLibraryW GetProcAddress lstrcatW lstrlenW GetVersion |
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2e8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.39918 |
| MD5 | 28683b6aa3bf8a170d1ceb9fa05bf362 🔍 |
| SHA1 | 40845066b357fff695ee2d3e41c19e28442671ac 🔍 |
| SHA256 | 728d514fdcaab8770f1a113f141428b4860027f6685356d74274c03e194d68a6 🔍 |
| SHA3 | 43d751bf866f5bd39b82678daca2d56a0ad157584ad31fdd9433508ff72fd4d8 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x128 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.68942 |
| MD5 | 794fe7995c967ebd479f68359353ebc4 🔍 |
| SHA1 | 7454c492fdd935a58fad5713290c48b8abb277ba 🔍 |
| SHA256 | d06002f9e317adc6377c0bc9af92fa7e9392fd74cd9928fd911729a1e8e3e6df 🔍 |
| SHA3 | 6262f83326cca2298109be4fca6a38bc56c2410be8c357b160a2992d551489b5 🔍 |
100
| Type |
RT_DIALOG
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x176 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.19524 |
| MD5 | 656a46a1469ab351cbbabb430222cfef 🔍 |
| SHA1 | c51ce11d8aa49e4f06f57b7a25273aa561626a2b 🔍 |
| SHA256 | ed65f792943b4496d98ae4ffeb6cf2879f66659a5ccf4a97d757aa8ac01158ca 🔍 |
| SHA3 | a6093ef8743a6e5c998fb509d5fb10f93e8b7153fb8a44c7bb9099ad34a2fb2b 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x22 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.37086 |
| Detected Filetype | Icon file |
| MD5 | d59e0d372ea5fd8c1f4de744376a6af4 🔍 |
| SHA1 | 6883ce60e71a83424db0b41d0ab6bf61080e3de2 🔍 |
| SHA256 | b10e28a32eddb2ab20a46ceae59d9c0786911eb20f0c8dd2a28421f226ea2b8b 🔍 |
| SHA3 | 5e39df982879204dd9f129a37d1e1c2ff906e88de9ae01b4418db5e8455e7ae1 🔍 |
1 (#3)
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2d0 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.41869 |
| MD5 | 7f099b8cf11610ac84ef2eb9b4aafbd3 🔍 |
| SHA1 | ad228ef681c5b87e545512ff7186651fabc4b903 🔍 |
| SHA256 | 33319f919418039170697c95e8aa4ea8aec24fcf1ef88abc366b595a014b32ff 🔍 |
| SHA3 | 3a7fbbdb8e3a3046ba2d84b42c89f4c9f2a42e3861dce2b9d10761c33fd71cbc 🔍 |
1 (#4)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x5b2 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.38456 |
| MD5 | cb155a58b9738e2ce7f0202ecfa2558a 🔍 |
| SHA1 | e3300091ba9256654a3cbb470c7533830a34cab1 🔍 |
| SHA256 | 26a6223f5623e45cd64181ff93c6d178abd00d3f2ad41f1d1222381f90bbf0b5 🔍 |
| SHA3 | 823e467a392d62a5179d167fd51a877fce14316bb37203ba25e30d439cc024c2 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 26.6.0.0 |
| ProductVersion | 26.6.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Igor Pavlov |
| FileDescription | 7-Zip Installer |
| FileVersion (#2) | 26.06 |
| InternalName | 7zipInstall |
| LegalCopyright | Copyright (c) 1999-2026 Igor Pavlov |
| OriginalFilename | 7zipInstall.exe |
| ProductName | 7-Zip |
| ProductVersion (#2) | 26.06 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x76eaf7c3 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (40310) | 1 |
| Imports (40310) | 13 |
| Total imports | 81 |
| C objects (40310) | 24 |
| ASM objects (VS2019 Update 8 (16.8.4) compiler 29336) | 1 |
| Resource objects (40310) | 1 |
| Linker (40310) | 1 |
Errors
Leave a comment
No comments yet.