File scan report

Verdict Safe

Analyzed May 12, 20265 months ago

Is 7zipInstall.exe safe? Yes, no threats found.

Legitimate unsigned 7-Zip installer (matches official 7z2301-x64.exe) with perfect clean scans, high prevalence, and behavior consistent with SFX unpacking to standard install…

Read the whole reasonShow less

Strong evidence · Widely seen for a long time, and nothing harmful found.

Run it as usual if it came from the official source

This file is safe and appears to be a legitimate 7-Zip installer. Download official signed versions from 7-zip.org to avoid unsigned copies.

Good practice2 tips

We found nothing harmful in this file.

Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

0 of 70 flagged

Flagged 0
No detection 70
No result 5

File7zipInstall.exe1.6 MBSHA-256 26cb6e9f5633…5598cd

Code signing Unsigned
Test run Completed
First seen 3y ago

None of the 70 antivirus engines that checked it flag it.

Chapter 02

Why we think so

4 points against it and 5 in its favour, checked against the scan evidence.

Analyst conclusion

The antivirus engines shows 0/71 detections, including all major antivirus engines clean. Behavior matches 7-Zip installation: drops language files and CHM to C:\Program Files\7-Zip\, contacts cert servers. Rules flag installer traits as suspicious but this is a common false positive for self-extracting archives. Safe to use.

Where this verdict could be wrong4 caveats

triggeredHeuristics['one of our behaviour rules'] cites access to the Windows password store — Mimikatz-like but common for installers querying system info; no actual dumping observed.
communityComments include 'stealer/spyware' tags from one researcher — but outweighed by Joe Sandbox 'CLEAN' verdict and 0 AV detections.
signing.signed=false (unsigned) — raises minor concern but CIRCL/prevalence confirm legitimacy.
The sandbox's contacted-IP list includes direct IPs (20.99.* Azure-like) — flagged by rule but tied to cert fetches.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

28sandbox rule tags
3spawned processes
1network contact
40filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

28

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1012
T1027· Obfuscated code
T1027.009· Obfuscated code
T1036
T1050
T1055· Process injection
T1059· Runs commands
T1060
T1071· Application protocol
T1080
T1082· System recon
T1083· Scans your files
T1095· Custom network
T1112
T1129· Loads modules
T1134
T1140· Deobfuscation
T1222
T1486· File encryption
T1497· Sandbox evasion
T1497.001· Sandbox evasion
T1518.001· Checks your AV
T1529
T1543.003· Service install
T1547.001· Auto-start
T1547.009· Auto-start
T1564.003· Hides artifacts
T1574.002· Execution hijack

Observed activity

Processes started

3

Programs the file ran, with their command lines.

program.exe"C:\Users\<USER>\Desktop\program.exe"
7z2301-x64.exe%SAMPLEPATH%\7z2301-x64.exe
7zipInstall.exe%SAMPLEPATH%\7zipInstall.exe

Network contacts

1

1 host, listed as 2 links. Links show the host and path only.

URLhttp://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt
URLhttp://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c

Files

30

Files the file created, changed or deleted.

WrittenC:\Program Files\7-Zip\7-zip.chm
WrittenC:\Program Files\7-Zip\descript.ion
WrittenC:\Program Files\7-Zip\History.txt
WrittenC:\Program Files\7-Zip\Lang\af.txt
WrittenC:\Program Files\7-Zip\Lang\an.txt
WrittenC:\Program Files\7-Zip\Lang\ar.txt

Show all 30 entries

WrittenC:\Program Files\7-Zip\Lang\ast.txt
WrittenC:\Program Files\7-Zip\Lang\az.txt
WrittenC:\Program Files\7-Zip\Lang\ba.txt
WrittenC:\Program Files\7-Zip\Lang\be.txt
WrittenC:\Program Files\7-Zip\Lang\bg.txt
WrittenC:\Program Files\7-Zip\Lang\bn.txt
WrittenC:\Program Files\7-Zip\Lang\br.txt
WrittenC:\Program Files\7-Zip\Lang\ca.txt
WrittenC:\Program Files\7-Zip\Lang\co.txt
DeletedC:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk
DeletedC:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk
DeletedC:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER28E0.tmp.WERInternalMetadata.xml
DeletedC:\Windows\System32\spp\store\2.0\cache\cache.dat
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER29AB.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER29EA.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER368D.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER368E.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER369E.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WERD97.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WERE62.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WERE92.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER31F8.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER31FA.tmp.csv

Mutexes

10

Named locks a program uses so only one copy runs; malware families often reuse them.

cversions.3.m
oleacc-msaa-loaded
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500

Show all 10 entries

CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.Shared.MUTEX.EBH
Local\MSCTF.Asm.MutexDefault1

Sandbox background — not the file

34

The analysis machine's own processes and connections, recorded in every run.

VM processExplorer.EXEC:\Windows\Explorer.EXE
VM processservices.exeC:\Windows\system32\services.exe
VM processsvchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p
VM processsvchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
VM processlsass.exeC:\Windows\system32\lsass.exe

Show all 34 entries

VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
VM processwuapihost.exeC:\Windows\System32\wuapihost.exe
VM processupdater.exeC:\Program Files (x86)\Google2416_1842878330\bin\updater.exe
VM processupdater.exeC:\Program Files (x86)\Google476_521065921\bin\updater.exe
VM processupdater.exeC:\Program Files (x86)\Google3944_276771979\bin\updater.exe
VM processupdater.exeC:\Program Files (x86)\Google356_781214837\bin\updater.exe
VM host20.99.185.48
VM host192.229.211.108
VM host20.99.184.37
VM host23.216.147.76
VM host20.99.186.246
VM host23.216.147.64
VM host20.69.140.28
VM hosta83f:8110:0:0:1400:1400:2800:3800
VM host20.99.133.109
VM host192.168.0.1
VM hosta83f:8110:0:0:f832:afd:ea01:0
VM hosta83f:8110:0:0:0:0:2002:0
VM hosta83f:8110:0:0:629b:2800:0:0
VM hosta83f:8110:71bb:d901:2d46:8e8f:71bb:d901
VM hosta83f:8110:3100:2e00:3800:3700:3800:3000
VM hosta83f:8110:0:0:4d8c:21:0:0
VM host104.86.182.43
VM hosta83f:8110:0:0:b89d:2800:0:0
VM hosta83f:8110:0:0:100:0:1800:0
VM hosta83f:8110:2155:84ff:2256:85ff:2556:86ff
VM URLhttp://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt
VM URLhttp://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

7f11663757a2bdc19354…bf08faNot checked
no saved verdict
1da513f5a4e8018b9ae1…dbbf4fNot checked
no saved verdict
4db8e6da476fadef909a…5d584fNot checked
no saved verdict
8413fb6f6f8c9f31a10d…6e5ae9Not checked
no saved verdict
e6a716c27f11bfadba85…7c3a6aNot checked
no saved verdict
c082aed224d70a3f77e6…1fa071Not checked
no saved verdict
288ba639155a8f208c74…e4c0fcNot checked
no saved verdict
c9a10ee60f89a139d363…fd133cNot checked
no saved verdict
88972f7e173cfed678fb…f0c2fdNot checked
no saved verdict
61d67f81971a8a209304…539992Not checked
no saved verdict

Chapter 04

Technical details

None of the 70 antivirus engines that checked it flag it; no publisher signature.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete0 of 70 engines flagged it · 5 gave no result DetailsMay 7, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsMay 12, 2026

Contacted hostsMalwareTips URL scannerPartial2 of 11 contacted hosts were cross-checked; coverage is incomplete DetailsMay 12, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsMay 12, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedMay 12, 2026

Known-software referenceCIRCL hashlookupCompleteKnown softwareMay 12, 2026

File fingerprint

Last analyzed: May 12, 2026, 8:29 AM UTC

SHA-256: 26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd
SHA-1: 7df28d340d7084647921cc25a8c2068bb192bdbb
MD5: e5788b13546156281bf0a4b38bdd0901

About this file

7zipInstall.exe is a Win32 EXE file of 1.6 MB.

Type and size: Win32 EXE · 1.6 MB
Signer: UnsignedNo code signature.
First seen: Jun 20, 2023On VirusTotal.
Submitted by: 3,702 distinct sources
Packer: None detected
Entropy: 8.00 of 8

First scanned May 12, 2026

Verdict history

May 12, 2026Not fully confirmed
May 12, 2026Safeafter a new scan

Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.

Antivirus consensus

0 of 70 engines flagged this file

0 malicious0 suspicious70 not flagged5 no result

5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-236 engines
0flagged
Low-trust16 engines
0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavNo result
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 8.00Unpacked

Section entropy4 sections

.text

6.59

.rdata

4.62

.data

0.02

.rsrc

4.37

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

3,702

Hundreds of people have uploaded this — common.

Total submissions

95,016

Includes repeat uploads by the same source.

First seen

3y ago

Jun 20, 2023

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is 7zipInstall.exe safe?

We found nothing harmful in 7zipInstall.exe. None of the 70 antivirus engines that checked it flag it. Run it only if it came from the developer's own website or an official app store.

What is 7zipInstall.exe?

7zipInstall.exe is a Windows program, about 1.6 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Jun 20, 2023.

How many antivirus engines detected 7zipInstall.exe?

None of the 70 antivirus engines that checked it flag 7zipInstall.exe. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

What is the SHA-256 hash of 7zipInstall.exe?

The SHA-256 fingerprint of 7zipInstall.exe is 26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd, and its MD5 is e5788b13546156281bf0a4b38bdd0901. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to run 7zipInstall.exe?

We found nothing harmful in 7zipInstall.exe. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of 7zipInstall.exe?

This report reflects the scan on May 12, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Is 7zipInstall.exe safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

False Positive Risks

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

File fingerprint

About this file

Verdict history

0 of 70 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is 7zipInstall.exe safe? Yes, no threats found.

What We Detected

Threat Behavior

False Positive Risks

What To Do Now

Test run summary

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Mutexes

Sandbox background — not the file

File fingerprint

About this file

Verdict history

Related file reports