File verdict·Evidence-based file assessment

Our call: Is 7zS.sfx.exe safe?Safe

Item: 7zS.sfx.exe
Rating: 4.5
Author: MalwareTips File Scanner

Run with normal care

82Safety ratingLow observed risk

Safety rating82/100Low observed risk

Evidence snapshot

1 of 75 antivirus engines flagged the file, including Trapmine.Observed · Antivirus analysis
The hash has been submitted 9 times from 4 sources.Derived · Saved report facts

7zS.sfx.exe

10.3 MB

5214af10a2c2db07df…3f8a283546

Antivirus

1 of 75 flagged

Sandbox

Runtime complete

Code signing

Unsigned

First seen

First seen 7y ago

01

Before running

Run it only when it came from the developer's official site or another source you independently trust.

02

If you already ran it

Keep normal device protection enabled and stop if the file behaves unexpectedly.

Scan transparency

Coverage & freshness

4 of 5 complete

Complete means the check returned a usable result. It does not mean the file is safe.

Antivirus
Complete
1 of 75 engines flagged the file.
Updated Jun 11, 2026, 7:32 AM UTC
Sandbox
Complete
1 isolated runtime environment contributed observations.
Updated Jun 11, 2026, 10:40 AM UTC
Network
Partial
5 of 7 contacted hosts were cross-checked; coverage is incomplete.
Updated Jun 11, 2026, 10:40 AM UTC
YARA
Complete
2 signature or behavior rules matched.
Updated Jun 11, 2026, 10:40 AM UTC
External intel
Complete
3 of 3 independent reference sources completed.
Updated Jun 11, 2026, 10:40 AM UTC

Recorded behavior

Attack story

Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.

ObservedDerived

Input file

The submitted object

1

FileObserved
7zS.sfx.exe
5214af10a2c2db07df9ce913e25feb3a82126802bce82efb044bc33f8a283546
01Uploaded file

Processes

Runtime execution

2

ProcessObserved
Observed process
.\H2OFFT-W.exe -sfx7z C:\Users\<USER>\Downloads execApp
02Isolated runtime analysis
ProcessObserved
Observed process
"C:\Users\user\Desktop\program.exe"
03Isolated runtime analysis
+1 more recorded observation in Analyst mode

Files

Created or changed

2

Written fileObserved
Ding.wav
C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\Ding.wav
04Isolated runtime analysis
Written fileObserved
Microsoft.VC90.CRT.manifest
C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\Microsoft.VC90.CRT.manifest
05Isolated runtime analysis
+1 more recorded observation in Analyst mode

Network

Hosts contacted

2

Contacted hostObserved
192.168.122.1
Contact observed during runtime.
06Isolated runtime analysis
Contacted hostObserved
162.159.36.2
Contact observed during runtime.
07Isolated runtime analysis
+1 more recorded observation in Analyst mode

7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.

Chapter 02

Intelligence

The saved assessment, checked against the scan evidence and recorded coverage.

No saved analyst narrative

This report keeps the verified scan facts available below without inventing an analysis that was not saved with the scan.

Chapter 03

Behavior

Plain-English impact first, then the observed runtime evidence.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK

9

Adversary techniques mapped to the MITRE ATT&CK framework.

T1027· Obfuscated codeT1027.005· Obfuscated codeT1059· Runs commandsT1082· System reconT1083· Scans your filesT1129· Loads modulesT1222T1497.001· Sandbox evasionT1564.003· Hides artifacts

Spawned processes

2

$(unnamed)

.\H2OFFT-W.exe -sfx7z C:\Users\<USER>\Downloads execApp

$(unnamed)

"C:\Users\user\Desktop\program.exe"

Network activity

7

IP addresses2

192.168.122.1
162.159.36.2

URLs5

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://s.symcb.com/pca3-g5.crl
http://sw.symcb.com/sw.crl
http://crl.verisign.com/pca3.crl
http://csc3-2010-crl.verisign.com/csc3-2010.crl

Persistence

1

Indicators1

iscFlash

Filesystem & mutexes

34

Files written15

C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\Ding.wav
C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\Microsoft.VC90.CRT.manifest
C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\Microsoft.VC90.MFC.manifest
C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\platform.ini
C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\FlsHook.exe

+10 more

Files deleted10

C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab3.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab5.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar6.tmp

+5 more

Mutexes created9

CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500

+4 more

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen

d4d8967f651e91a34258…89e4f8Never scanned
never seen before
9e0220511d4ebdb014cc…196582Never scanned
never seen before
f7205c5c0a629d0cc60e…23922bNever scanned
never seen before
9a043c66905e7f00a8c6…f3a595Never scanned
never seen before
c34b3dbb25816e280c10…92de90Never scanned
never seen before
2f98f753ffe3bc5718c0…c2f203Never scanned
never seen before
9483790ad151e0eaf341…ee2548Never scanned
never seen before
e9d696f8cd712bcefe6f…3d4448Never scanned
never seen before
e30aabb518361fbeaf80…31595aNever scanned
never seen before
4f7ed27b532888ce72b9…9b0b1aNever scanned
never seen before

Chapter 04

Detection & Forensics

Consensus, attribution, signatures, code structure, prevalence, and identity.

Evidence map

Detection sources at a glance

4 completed · 0 unavailable

Antivirus

Threat match

1/75 flagged

Malware samples

No match

no match

Researcher rules

No match

no match

Reference software

No match

no match

Threat attribution

No specific family attributed

The available sources did not agree on a named threat category.

External intelligence

No researcher-database hits

MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.

Rule-based evidence

Signatures and behavior heuristics

Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.

2 heuristics

MITRE ATT&CK profile

Persistence× 1C2× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

PersistenceScheduledTask
T1053.005 T1543.003
medium
Sandbox flagged persistence indicators (registry Run keys / services / scheduled tasks).
Evidence
iscFlash
DirectIpC2
T1071
medium
The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence
162.159.36.2

Antivirus consensus

1 of 75 engines flagged this file

1 malicious0 suspicious74 not flagged

Tier-117 engines

0flagged

Tier-241 engines

0flagged

Low-trust17 engines

1flagged

These detections were treated as likely false positives in the saved verdict.

Trapminemalicious

suspicious.low.ml.score

View all 75 engine results

TrapmineDET

AcronisOK

AhnLab-V3OK

AlibabaOK

alibabacloudOK

ALYacOK

Antiy-AVLOK

APEXOK

ArcabitOK

AvastOK

Avast-Mobiletyp

AVGOK

AviraOK

BitDefenderOK

BitDefenderFalxtyp

BkavOK

CAT-QuickHealOK

ClamAVtim

CMCOK

CrowdStrikeOK

CTXOK

CylanceOK

CynetOK

DeepInstinctOK

DrWebOK

ElasticOK

EmsisoftOK

ESET-NOD32OK

F-SecureOK

FortinetOK

GDataOK

GoogleOK

GridinsoftOK

huorongOK

Ikarusfai

JiangminOK

K7AntiVirusOK

K7GWOK

KasperskyOK

KingsoftOK

LionicOK

MalwarebytesOK

MaxSecureOK

McAfeeDOK

MicrosoftOK

MicroWorld-eScanOK

NANO-AntivirusOK

PaloaltoOK

PandaOK

RisingOK

SangforOK

SentinelOneOK

SkyhighOK

SophosOK

SUPERAntiSpywareOK

SymantecOK

SymantecMobileInsighttyp

TACHYONOK

tehtristyp

TencentOK

TrellixENSOK

TrendMicroOK

TrendMicro-HouseCallOK

Trustlooktyp

VaristOK

VBA32OK

VIPREOK

VirITOK

ViRobotOK

WebrootOK

XcitiumOK

YandexOK

ZillyaOK

ZoneAlarmOK

ZonerOK

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 6.42Unpacked

Section entropy4 sections

.text

6.56

.rdata

4.70

.data

4.28

.rsrc

5.08

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium

Unique uploaders

4

Moderate upload volume.

Total submissions

9

Includes repeat uploads by the same source.

First seen

7y ago

Mar 4, 2019

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

File identity

Fingerprint and provenance

File name: 7zS.sfx.exe
Format: Win32 EXE
Code signing: No verified publisher
Size: 10.3 MB
Last analyzed: Jun 11, 2026, 10:40 AM UTC

SHA-256

5214af10a2c2db07df9ce913e25feb3a82126802bce82efb044bc33f8a283546

Chapter 05

Safety & FAQ

Complete recovery guidance and answers for the next decision.

What to do now

This file appears low risk based on the evidence available now.

Run it only when it came from the developer's official site or another source you independently trust.
A clean result reduces known risk, but it cannot guarantee that every new or targeted threat has been detected.
Keep your antivirus and Windows updates switched on so you stay protected.

Frequently asked

Safety FAQ

Is 7zS.sfx.exe safe?

7zS.sfx.exe appears safe. 1 of 75 antivirus engines flagged it; the 1 detection were treated as non-decisive after the wider evidence was weighed. Run it only when it came from the developer's official site or another source you independently trust.

What is 7zS.sfx.exe?

7zS.sfx.exe is a Windows executable program, about 10.3 MB. Our analysis did not identify a verdict-driving threat signal. A file's name can be reused by different files, so we identify it by its cryptographic hash (below).

How many antivirus engines detected 7zS.sfx.exe?

1 of 75 antivirus engines flagged 7zS.sfx.exe, 1 of them as outright malicious. The raw count alone does not establish safety or danger; we also weigh which engines flagged it and corroborating behavior, identity, reputation, and rule evidence.

What is the SHA-256 hash of 7zS.sfx.exe?

The SHA-256 hash of 7zS.sfx.exe is 5214af10a2c2db07df9ce913e25feb3a82126802bce82efb044bc33f8a283546, and its MD5 is 63875274a2a0d1385451b5570097dee0. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

Is it safe to run 7zS.sfx.exe?

Based on the recorded evidence, 7zS.sfx.exe has a low observed risk. The important caveat is source: make sure you downloaded it from the official website or a trusted store, because attackers sometimes distribute malware-laced copies under a legitimate file's name. If your own antivirus flags it, verify the source and the exact hash before overriding the warning.

How up to date is this analysis of 7zS.sfx.exe?

This report reflects the scan run on June 11, 2026. Because a file's hash never changes, the identity of 7zS.sfx.exe is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

Our call: Is 7zS.sfx.exe safe?Safe

Recommended next actions

Before running

If you already ran it

Coverage & freshness

Antivirus

Sandbox

Network

YARA

External intel

Attack story

7zS.sfx.exe

Observed process

Observed process

Ding.wav

Microsoft.VC90.CRT.manifest

192.168.122.1

162.159.36.2

Why these facts are shown

No saved analyst narrative

Detection sources at a glance

Fingerprint and provenance

What to do now

Safety FAQ