7zr.exe

7-Zip

Sky Union

Publisher:
Igor Pavlov  (signed by Sky Union)

Product:
7-Zip

Description:
7-Zip Standalone Console

Version:
9.20

MD5:
92c2f4d0cac5cc5580636fa5e4f8b005

SHA-1:
497237dcb2209b27ea1dda61a8d13589790e47c1

SHA-256:
b87efd8fcb66511e4b6607f19f6b35517eeea2be36db15a025aa65067c859147

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/15/2024 3:04:07 AM UTC  (today)

File size:
381 KB (390,104 bytes)

Product version:
9.20

Copyright:
Copyright (c) 1999-2010 Igor Pavlov

Original file name:
7zr.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\7zr.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
11/13/2010 3:00:00 AM

Valid to:
10/23/2011 2:59:59 AM

Subject:
CN=Sky Union, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Sky Union, L=Santa Clara, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5B88D9605B6D17F0D7CAA155D01F96A6

File PE Metadata
Compilation timestamp:
1/19/2011 11:46:03 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

CTPH (ssdeep):
6144:/WrsW9voTKzNd3dvHALsZeuFPxiwTW3N+b7aQOse2p:+rsWtoTKtgjuFJbIN+JOW

Entry address:
0x39CD1

Entry point:
E8, 98, 53, 00, 00, E9, 40, FE, FF, FF, 56, 8B, 74, 24, 08, 56, E8, D3, F9, FF, FF, 50, E8, 6F, F9, FF, FF, 85, C0, 59, 59, 74, 7B, E8, 12, F2, FF, FF, 83, C0, 20, 3B, F0, 75, 04, 33, C0, EB, 0F, E8, 02, F2, FF, FF, 83, C0, 40, 3B, F0, 75, 5F, 33, C0, 40, FF, 05, E0, EB, 45, 00, 66, F7, 46, 0C, 0C, 01, 75, 4E, 53, 57, 8D, 3C, 85, F0, EB, 45, 00, 83, 3F, 00, BB, 00, 10, 00, 00, 75, 20, 53, E8, 3E, 2A, 00, 00, 85, C0, 59, 89, 07, 75, 13, 8D, 46, 14, 6A, 02, 89, 46, 08, 89, 06, 58, 89, 46, 18, 89, 46, 04, EB...
 
[+]

Entropy:
6.4299

Code size:
284.5 KB (291,328 bytes)

The file 7zr.exe has been seen being distributed by the following 14 URLs.

http://static-ttifus.igg.com/g2_en_us/0000079_1/.../7zr.exe

http://static-ttifph.igg.com/g2_en_ph/0000018_1/.../7zr.exe

http://static-moph.igg.com/twclient_ph/0000018/.../7zr.exe

Scan 7zr.exe - Powered by Reason Core Security