Suspicious
Suspect

548f02475a40c343c774aac9e52ceca7

7Zip SFX Archive
MD5: 548f02475a40c343c774aac9e52ceca7
Size: 10.91 MB
application/octet-stream

This sample is a 10.4 MB 7Zip SFX Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 53 embedded or derived files. It matches 9 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
90fafaaa3e6c3d11b906db5bab26f75087353bf2eb5699657f343c4f86fac74f
MD5
548f02475a40c343c774aac9e52ceca7
Verdict
Inconclusive
File type
7Zip SFX Archive · 10.4 MB
MITRE ATT&CK
T1059.007

Cite this report: https://app.malva.re/sha256/90fafaaa3e6c3d11b906db5bab26f75087353bf2eb5699657f343c4f86fac74f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
7Zip SFX archive
Size
10.91 MB · 10,911,052 B
First seen
2026-10-27 09:00 · 3 days ago
Last seen
2026-10-27 09:00 · 3 days ago
Last analysis
2026-10-27 09:01 · 3 days ago
Hashes
MD5 548f02475a40c343c774aac9e52ceca7 Sha1 8bc4cfdca1d24a5ad49307b5c745c3f2dc6ca97e Sha256 90fafaaa3e6c3d11b906db5bab26f75087353bf2eb5699657f343c4f86fac74f Sha384 ea98deea296d8b90cf34582d1ae04a9a9b38fd58495711a7371013e1a62b9a3df143afcc35ed2cbe8de178817101cbfb Sha512 c9eebfd8e1648189f51437bf2874c8b6bcc9137a7153dd84942028071872a50c2cfdcd79acc1e16282cf51b122f7bdc57a7ef61c1da4496813263c280bb66a4e SSDeep 196608:+pyqN1KEB9XFiYz7m5SH9zJdoRtleAe9/cj6Lt5QRQ9Wi9BVIBvBblMC7eBd:+p5NwEB9XIYHmCLdq7G/tt5QRQ9Wavkg TLSH DEB633A177C498F0CB65D933DE9DDB2369B3DAE8378A8517AA491C624DD3224430F0ED
Detection
PeID
Microsoft Visual C++Microsoft Visual C++ 5.0Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0Microsoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLL

54 files
7Z548f02475a40c343c774aac9e52ceca7
Structure
7Z7z-stream @ 0x0002DF47.7z
SObinding-master.so
EXEAgentCir.exe
Structure
P7B[Authenticode]_2340c1d4.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
DLLBLauncher.dll
Structure
P7B[Authenticode]_824414ee.p7b
BINResources
BINRT_MANIFEST
BINID:0002
BINID:1033
DLLmsvcp140.dll
Structure
P7B[Authenticode]_5a48a457.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLmsvcp140_1.dll
Structure
P7B[Authenticode]_42b18669.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLmsvcp_win.dll
Structure
P7B[Authenticode]_3cf0cb8d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLparser.dll
DLLQt5Core.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
HTMQt5Gui.dll
Structure
P7B[Authenticode]_4331a8a0.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLQt5Network.dll
Structure
P7B[Authenticode]_f7233e75.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
JSQt5Widgets.dll
Structure
P7B[Authenticode]_9aaad955.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLucrtbase.dll
Structure
P7B[Authenticode]_ae13dba4.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLvcruntime140.dll
Structure
P7B[Authenticode]_574312fe.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
7ZOverlay_d67aed0a.bin
BINResources
BINRT_ICON
BINID:0001
BINID:1049
BINID:0002
BINID:1049
BINID:0003
BINID:1049
BINID:0004
BINID:1049
BINID:0005
BINID:1049
BINRT_GROUP_CURSOR4
BINID:0065
BINID:1049
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 9 STICH kept: 3secondary ignored: 6
bin 6

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>arc:7z>pe:dll~T1059.007>pe:rsrc>bin
Shape pe:exe>arc:7z>pe:dll>pe:rsrc>bin
technique5 nodes
Path pe:exe>arc:7z>pe:dll~T1059.007>bin
Shape pe:exe>arc:7z>pe:dll>bin
technique4 nodes

Name Value
Info
Overlay extracted: Overlay_d67aed0a.bin (10723148 bytes)

54 files
7Z548f02475a40c343c774aac9e52ceca7
Structure
7ZOverlay_d67aed0a.bin
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙