8117e40ee7f824f63373a4f5625bb62749f69159d0c449b3ce2f35aad3b83549

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2019-Feb-21 16:00:00
Detected languages English - United States
CompanyName Igor Pavlov
FileDescription 7-Zip Standalone Console
FileVersion 19.00
InternalName 7za
LegalCopyright Copyright (c) 1999-2018 Igor Pavlov
OriginalFilename 7za.exe
ProductName 7-Zip
ProductVersion 19.00

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to AES
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • GetProcAddress
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
 Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
 Enumerates local disk drives:
  • GetLogicalDriveStringsW
 Changes object ACLs:
  • SetFileSecurityW
Safe VirusTotal score: 0/71 (Scanned on 2026-08-03 10:59:26) All the AVs think this file is safe.

Hashes

MD5 e86eff95691b1c0e7e4f3e9cb1ae2e49
SHA1 d0acbf9ae29ec74acc67b53b2063bbc9739bc9e8
SHA256 8117e40ee7f824f63373a4f5625bb62749f69159d0c449b3ce2f35aad3b83549
SHA3 75f2e89f98fd1ab842ae23d63a45d449c2b718e57c3518fdb4ef91d293cc923d
SSDeep 24576:IyotkuwTgCfs7Ck+PCZbS1IJdJ0FAH48fw2:ITtkVxkdyCZbS1oCFo/fw
Imports Hash 7232d06dc00920698f0cad2452012553

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2019-Feb-21 16:00:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 8.0
SizeOfCode 0xcea00
SizeOfInitializedData 0x51600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000CD730 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x123000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 145dec869fd1ffe449f161d363bf2bc1
SHA1 ae21c5888e38ec4aadbd3ea262cc1749ef51542a
SHA256 25d71817feaaf6f38c13962fbbe9cc966e03b78281a4223c051ddafa9c426c17
SHA3 9160ab21574402842f9c6e8c624571573d23caea1ed3dee83097cb67f67dc47b
VirtualSize 0xce9be
VirtualAddress 0x1000
SizeOfRawData 0xcea00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.35384

.rdata

MD5 de9ef9262e9af43ebe444e01ae7e423e
SHA1 8cb885616c3e1efea22dbd2ee97365ba98f622c0
SHA256 a732557a76dfa2d4092fef35087b8c50c4ad82806d6c2be8bb5693646a5f9bab
SHA3 f3e732df7f09c47b09fe3e2ad6afcd3057173772bb4ec598f6410d4d910e53f5
VirtualSize 0x38fbc
VirtualAddress 0xd0000
SizeOfRawData 0x39000
PointerToRawData 0xcee00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.95381

.data

MD5 999f0fc5b0eb74f7b8e974dabc29d583
SHA1 a6e8e4732047b3c9951b25c643477aeb5340f253
SHA256 abd315dd064c85b676d1d985c8f4e9fd7ae5be3bbd38a0e63b4c03b306ca5131
SHA3 a2360bfbc1eaf8bef861fe450b966268b22ed80d385ea20a79fb4bcb1c4054ea
VirtualSize 0x7850
VirtualAddress 0x109000
SizeOfRawData 0xa00
PointerToRawData 0x107e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.80193

.pdata

MD5 092b79b3bb187326ddcaf4cfed6eb9cd
SHA1 5c8d8b9432e68f13d0ae4630bb6902e0d0603cec
SHA256 f7af9103785b1874e7ecc9255fd1c9e5cc3df9dbed0cf37bf745e92de7691431
SHA3 99b7b70ad4a8f37bf4059895318e8dfdf35c4d94054e13d42bf3774b747139eb
VirtualSize 0xe34c
VirtualAddress 0x111000
SizeOfRawData 0xe400
PointerToRawData 0x108800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.09139

.rsrc

MD5 a30892748cd91310d5e3640995708714
SHA1 b7e43b6370103a9afd36f6a65412689d5b30972c
SHA256 5a21fe91ec958f1c5d8718a9f4d6ec9eba4fe30197d0e0e85010cc6cbcc75ab5
SHA3 4abfcc0ad44af1425213af0b0c544cf0c9239dd9bcf291d64d624c33c57be253
VirtualSize 0x6f8
VirtualAddress 0x120000
SizeOfRawData 0x800
PointerToRawData 0x116c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.45458

.reloc

MD5 07bbcdc7f2c837f954ceccd70c327746
SHA1 b3cffb7f80e71008efbae9963c185177a5a264af
SHA256 21edf586d8a673c0f561f6cf23c7c58868eb94842ec56b263254b0e5a70a80ca
SHA3 336b0e72f5609fa363b23f0972c233b4d5af85e13f3421fb5cf8f3fecddb685f
VirtualSize 0x1fac
VirtualAddress 0x121000
SizeOfRawData 0x2000
PointerToRawData 0x117400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 3.86872

Imports

OLEAUT32.dll SysStringLen
VariantClear
VariantCopy
SysAllocString
SysFreeString
SysAllocStringLen
USER32.dll CharUpperW
CharPrevExA
ADVAPI32.dll GetFileSecurityW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
SystemFunction036
msvcrt.dll _exit
_c_exit
_XcptFilter
_onexit
__dllonexit
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__C_specific_handler
_beginthreadex
_isatty
realloc
strlen
memset
wcsstr
strstr
wcscmp
_cexit
memmove
fflush
fputc
fputs
_iob
fgetc
fclose
free
_CxxThrowException
malloc
memcmp
_purecall
__CxxFrameHandler
memcpy
exit
__getmainargs
__initenv
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
strcmp
KERNEL32.dll ResetEvent
CreateSemaphoreW
CreateEventW
ReleaseSemaphore
InitializeCriticalSection
GetVersionExW
SetEvent
SetFileAttributesW
WaitForSingleObject
VirtualFree
VirtualAlloc
QueryPerformanceCounter
LocalFileTimeToFileTime
GetConsoleMode
SetConsoleMode
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
IsProcessorFeaturePresent
GetProcessTimes
DeleteCriticalSection
SetProcessAffinityMask
OpenEventW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatusEx
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
GetFileInformationByHandle
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
DeviceIoControl
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
SetLastError
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetLogicalDriveStringsW

Delayed Imports

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x2c4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37313
MD5 9367f48e4495213fbf99b99e198281c5
SHA1 23677f5d4e6f866dafc0d7dcd4e01cd5d620e332
SHA256 7d3442f73c622afb970432561170d579ec7e902e7de2d86d512157230a4aaa85
SHA3 c08b8ce3376387171afe78836ca027c1772abdc21cd678cf6b05e3044cac001a

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x38e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.36954
MD5 445ab0be1ebbb45eac34dd03f4204971
SHA1 cda51970a44a9b2ca92f1ce56607bffd3d39bf5f
SHA256 fd3f18e6ec417eb0f63a003d9808553b3194f6fab33a8bf618d18a476944a5e6
SHA3 b5552a2682a529c160d7341b7b2ed8173a8ed7082e2c10f7513dd6b3e206c045

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 19.0.0.0
ProductVersion 19.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Igor Pavlov
FileDescription 7-Zip Standalone Console
FileVersion (#2) 19.00
InternalName 7za
LegalCopyright Copyright (c) 1999-2018 Igor Pavlov
OriginalFilename 7za.exe
ProductName 7-Zip
ProductVersion (#2) 19.00
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xfb814440
Unmarked objects 0
ASM objects (40310) 1
Imports (40310) 11
Total imports 144
C++ objects (40310) 185
C objects (40310) 48
ASM objects (VS2010 SP1 build 40219) 4
Resource objects (40310) 1
Linker (40310) 1

Errors

Leave a comment

No comments yet.