fd99e86f57d8f429ef5ed045bf98315af962e2309b0f1ba87a147a44c71647d0
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Oct-21 12:00:00 |
| Detected languages |
English - United States
|
| CompanyName | Igor Pavlov |
| FileDescription | 7-Zip Installer |
| FileVersion | 26.05 |
| InternalName | 7zipInstall |
| LegalCopyright | Copyright (c) 1999-2026 Igor Pavlov |
| OriginalFilename | 7zipInstall.exe |
| ProductName | 7-Zip |
| ProductVersion | 26.05 |
Plugin Output
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | The file contains overlay data. |
1617938 bytes of data starting at offset 0xb200.
The file contains a 7-Zip compressed file after the PE data. Overlay data amounts for 97.2607% of the executable. |
| Suspicious | VirusTotal score: 1/71 (Scanned on 2026-11-01 05:53:44) | APEX: Malicious |
Hashes
| MD5 | aaa9c585d2b81045725bd3186f027ac8 🔍 |
|---|---|
| SHA1 | 8f5d1e2d17f8cff50574b965dc709b24d3a438ae 🔍 |
| SHA256 | fd99e86f57d8f429ef5ed045bf98315af962e2309b0f1ba87a147a44c71647d0 🔍 |
| SHA3 | 85497fb90277f7d247444d909d7b031fdf1a7f28661acc4182077541d12c94ec 🔍 |
| SSDeep | 49152:8A/nagaZbJkbxURSqKMHFFQxycXCh2b8LEBK:8A/agahJkeRSqFOycyh2b8LEBK 🔍 |
| Imports Hash | d00af420812a39241f821fb057cc3154 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xe0 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 5 |
| TimeDateStamp | 2026-Oct-21 12:00:00 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x7c00 |
| SizeOfInitializedData | 0x6a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000008630 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x11000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x800000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | e77d3119e5fdac890245277b1ca785e0 🔍 |
|---|---|
| SHA1 | 894caa4225069472608b64d0d281a4dc37cf065e 🔍 |
| SHA256 | 37094f745bbad9a1df20611764418a2cfed6aef9c107ed9f58c015e2debae0e4 🔍 |
| SHA3 | 2d600b5d2443dac1dd92e0076d213bdf950b645911b82b3e1904b3a006707381 🔍 |
| VirtualSize | 0x7b24 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x7c00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.2623 |
.rdata
| MD5 | e3a5de5be4aad3ebc64e7ac976443328 🔍 |
|---|---|
| SHA1 | 1821f70131218cb19242b251fe25bce96f29a697 🔍 |
| SHA256 | 1d94ac619ec95866b15e2daae36705b4313b2a328f5f0b5403236fac1245ea71 🔍 |
| SHA3 | ddc84e5ac01551f870924446dc1eaa923956d8e8239d2e30febcebf813e82ab1 🔍 |
| VirtualSize | 0x1a98 |
| VirtualAddress | 0x9000 |
| SizeOfRawData | 0x1c00 |
| PointerToRawData | 0x8000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.4392 |
.data
| MD5 | 9475a59226943a3ad422e18169989f66 🔍 |
|---|---|
| SHA1 | 4174927c59854c80d33c69e7a43856b2b6c6af84 🔍 |
| SHA256 | d839a3521723b8a55d09d8eed9848940b284828e4d09218202c3ee11046bc16d 🔍 |
| SHA3 | 6a93cc87909571d767d237e39dc48f437ee4242cf646fe335698b2b191003d4e 🔍 |
| VirtualSize | 0x3960 |
| VirtualAddress | 0xb000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x9c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.0203931 |
.pdata
| MD5 | de400f075077a1733765a032f58f83c8 🔍 |
|---|---|
| SHA1 | 101940ebb4d28da254e715e40b5f181cc1db71a2 🔍 |
| SHA256 | 54e2bd958b6758517960ece9bf9dee30c41a3155e008ddc3c74efe5ad01e0c63 🔍 |
| SHA3 | 51c8785d16bfbdeb2116ce171071a08b62ca823c7924c4071f5f009f677c5826 🔍 |
| VirtualSize | 0x36c |
| VirtualAddress | 0xf000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x9e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.79967 |
.rsrc
| MD5 | 70bd22845351036355247c313a3caea6 🔍 |
|---|---|
| SHA1 | 2ce1c2fbbd94941afaf095769d4a7c710309133f 🔍 |
| SHA256 | 6fe050ccbe570bef7cee4e949991b6a71b00dceb46e107d6cc0a0914de5a848e 🔍 |
| SHA3 | 97be4773a851b6a3dea240eceb76c9c0c4522e2b594605dece65172e7e1b8ef2 🔍 |
| VirtualSize | 0xfe8 |
| VirtualAddress | 0x10000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0xa200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.37032 |
Imports
| ole32.dll |
CoInitialize
CoCreateInstance |
|---|---|
| USER32.dll |
MessageBoxW
DestroyWindow ShowWindow SetWindowTextW EnableWindow GetDlgItem SetDlgItemTextW GetDlgItemTextW ExitWindowsEx PeekMessageW DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW LoadIconW CreateDialogParamW SendMessageW |
| ADVAPI32.dll |
LookupPrivilegeValueW
AdjustTokenPrivileges RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW OpenProcessToken |
| SHELL32.dll |
SHGetFolderPathW
SHGetPathFromIDListW SHBrowseForFolderW |
| msvcrt.dll |
memcpy
_c_exit __C_specific_handler free malloc memmove memcmp exit __set_app_type _fmode _commode __setusermatherr _initterm __getmainargs _acmdln _cexit memset _exit _XcptFilter |
| KERNEL32.dll |
CloseHandle
CreateFileW GetCommandLineW GetModuleFileNameW ReadFile SetFileTime MoveFileExW GetCurrentProcess FormatMessageW LocalFree DeleteFileW WriteFile SetFilePointer GetModuleHandleW LoadLibraryExW GetStartupInfoA SetFileAttributesW GetFileAttributesW CreateDirectoryW GetLastError GetSystemDirectoryW lstrcpyW LoadLibraryW GetProcAddress lstrcatW lstrlenW GetVersion |
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2e8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.39918 |
| MD5 | 28683b6aa3bf8a170d1ceb9fa05bf362 🔍 |
| SHA1 | 40845066b357fff695ee2d3e41c19e28442671ac 🔍 |
| SHA256 | 728d514fdcaab8770f1a113f141428b4860027f6685356d74274c03e194d68a6 🔍 |
| SHA3 | 43d751bf866f5bd39b82678daca2d56a0ad157584ad31fdd9433508ff72fd4d8 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x128 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.68942 |
| MD5 | 794fe7995c967ebd479f68359353ebc4 🔍 |
| SHA1 | 7454c492fdd935a58fad5713290c48b8abb277ba 🔍 |
| SHA256 | d06002f9e317adc6377c0bc9af92fa7e9392fd74cd9928fd911729a1e8e3e6df 🔍 |
| SHA3 | 6262f83326cca2298109be4fca6a38bc56c2410be8c357b160a2992d551489b5 🔍 |
100
| Type |
RT_DIALOG
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x176 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.19524 |
| MD5 | 656a46a1469ab351cbbabb430222cfef 🔍 |
| SHA1 | c51ce11d8aa49e4f06f57b7a25273aa561626a2b 🔍 |
| SHA256 | ed65f792943b4496d98ae4ffeb6cf2879f66659a5ccf4a97d757aa8ac01158ca 🔍 |
| SHA3 | a6093ef8743a6e5c998fb509d5fb10f93e8b7153fb8a44c7bb9099ad34a2fb2b 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x22 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.37086 |
| Detected Filetype | Icon file |
| MD5 | d59e0d372ea5fd8c1f4de744376a6af4 🔍 |
| SHA1 | 6883ce60e71a83424db0b41d0ab6bf61080e3de2 🔍 |
| SHA256 | b10e28a32eddb2ab20a46ceae59d9c0786911eb20f0c8dd2a28421f226ea2b8b 🔍 |
| SHA3 | 5e39df982879204dd9f129a37d1e1c2ff906e88de9ae01b4418db5e8455e7ae1 🔍 |
1 (#3)
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2d0 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.43218 |
| MD5 | 5dc92de8543e89db3b1cd72ee142067d 🔍 |
| SHA1 | aefa083d7a6c1a7bba01054d2a607a46bb8a8362 🔍 |
| SHA256 | 84e690a7aab6813c9691917387fe9f0f96e8f61296c0476f488b735d2bcfe34d 🔍 |
| SHA3 | 5c2bc05022eea7d1979906786a87815aa6c971e9c6252e82b7373e5561b42af6 🔍 |
1 (#4)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x5b2 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.38456 |
| MD5 | cb155a58b9738e2ce7f0202ecfa2558a 🔍 |
| SHA1 | e3300091ba9256654a3cbb470c7533830a34cab1 🔍 |
| SHA256 | 26a6223f5623e45cd64181ff93c6d178abd00d3f2ad41f1d1222381f90bbf0b5 🔍 |
| SHA3 | 823e467a392d62a5179d167fd51a877fce14316bb37203ba25e30d439cc024c2 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 26.5.0.0 |
| ProductVersion | 26.5.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Igor Pavlov |
| FileDescription | 7-Zip Installer |
| FileVersion (#2) | 26.05 |
| InternalName | 7zipInstall |
| LegalCopyright | Copyright (c) 1999-2026 Igor Pavlov |
| OriginalFilename | 7zipInstall.exe |
| ProductName | 7-Zip |
| ProductVersion (#2) | 26.05 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x76eaf7c3 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (40310) | 1 |
| Imports (40310) | 13 |
| Total imports | 81 |
| C objects (40310) | 24 |
| ASM objects (VS2019 Update 8 (16.8.4) compiler 29336) | 1 |
| Resource objects (40310) | 1 |
| Linker (40310) | 1 |
Errors
Leave a comment
No comments yet.