Suspicious
Suspect

22ba76287f69c319c10b0a4ca90a1c6e

7Zip SFX Archive
MD5: 22ba76287f69c319c10b0a4ca90a1c6e
Size: 1.86 MB
application/octet-stream

This sample is a 1.8 MB 7Zip SFX Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 29 embedded or derived files. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
2494c08e70571c1f749c83ea2028e11fb7b7560d11685b611c2e06bfd3f4f9f7
MD5
22ba76287f69c319c10b0a4ca90a1c6e
Verdict
Inconclusive
File type
7Zip SFX Archive · 1.8 MB

Cite this report: https://app.malva.re/sha256/2494c08e70571c1f749c83ea2028e11fb7b7560d11685b611c2e06bfd3f4f9f7

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
7Zip SFX archive
Size
1.86 MB · 1,855,488 B
First seen
2026-10-21 05:45 · 7 days ago
Last seen
2026-10-21 05:45 · 7 days ago
Last analysis
2026-10-21 05:45 · 7 days ago
Hashes
MD5 22ba76287f69c319c10b0a4ca90a1c6e Sha1 030a3a355aba560ee431a321cfa3ebf505961ce8 Sha256 2494c08e70571c1f749c83ea2028e11fb7b7560d11685b611c2e06bfd3f4f9f7 Sha384 371cda259732944c3f5877a5b38bcc3184598f32c9ffb1a8e52b4ddd5b946fcb444c8da91776c13df1ea16ec04c10cc8 Sha512 2b362d5d3f79677106a84c6b680f7e6b52b9a2aa06e6e9b5e833c055e845da62d8e555b805666411b0d7f8a03a4be07b1362ffc2942ba2956d724c0fc8739810 SSDeep 49152:DklQr9i9fMbeVTXCLiaXKtR1x5zvNkB2MiGB:I64GqxXCLiftR1e2MiG TLSH 3585AE61F78644B5D4B3227121ADAB224A7EFCB40770D6C393C4B64EEF756D28A33612

30 files
7Z22ba76287f69c319c10b0a4ca90a1c6e
7Z7z-stream @ 0x000F05F8.7z
EXEZoomInstaller.exe
Structure
7Z7z-stream @ 0x0008A5F8.7z
P7B[Authenticode]_75a76beb.p7b
BINResources
BINRT_BITMAP
BINID:00D2
BINID:1033
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
EXIFID:1033.exif
IMGID:1033-preview.png
BINRT_DIALOG
BINID:00CD
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:000E
BINID:1033
BINRT_GROUP_CURSOR4
BINID:00C9
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
DLLmsvcp140.dll
Structure
P7B[Authenticode]_df899baa.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLoleacc.dll
Structure
BINOverlay_975ddf13.bin
BIN(folder)
BIN4
DLLvcruntime140.dll
Structure
P7B[Authenticode]_971dcb6d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 2secondary ignored: 5
bin 4img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:7zsfx>pe:exe>arc:7z
Shape arc:7zsfx>pe:exe>arc:7z
3 nodes
Path arc:7zsfx>arc:7zsfx
Shape arc:7zsfx>arc:7zsfx
2 nodes

30 files
7Z22ba76287f69c319c10b0a4ca90a1c6e
7Z7z-stream @ 0x000F05F8.7z
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙