File verdict·Decided by the MT AI Engine
Our call

Suspicious

Unsigned self-extracting installer showing process-injection and direct-IP behaviour with only low-trust detections and mixed sandbox signals.

Trust score45Caution
7zS.sfx.exe
1.3 MB
6472de894c5cb6050fcbb90e6ec6
Antivirus engines
2 of 74 flagged
Code signing
Unsigned
Age
First seen 10y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

55%Confidence
Moderate
Reasoning

The engine picture is low-trust only with zero tier-1 malicious detections, which normally leans safe, but the behavioural heuristics and sandbox traces show clear offensive techniques including process injection and credential-store access. The file is unsigned with no signer history, yet it is a very old, widely submitted 7-Zip SFX installer. Community sandbox reports are mostly clean or low-suspicion. These opposing signals place the sample in mixed territory rather than a clear safe or malicious call.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines: 2/70 malicious (APEX, Trapmine low_trust only); tier1Malicious=0; 17 tier-1 clean

  2. behaviour.offensiveTechniques: T1055, T1543.003, T1547.001, T1548; triggeredHeuristics: MalwareTips.Synth.ProcessInjection (high), CredentialDumper, DirectIpC2

  3. prevalence.classification=common_old; 3612 unique sources since 2016-03-03

  4. signing.signed=false; no signerStats history

  5. communityComments: multiple Joe Sandbox CLEAN verdicts (scores 13-16/100)

Points in its favour
  • Zero tier-1 malicious detections
  • Common-old prevalence (3612 sources)
  • Multiple clean Joe Sandbox reports
  • No malicious dropped children
  • No malicious contacted hosts
Points against
  • Unsigned binary
  • Process injection (T1055) observed
  • Direct-IP contacts without DNS
  • LSASS memory access in sandbox
  • Adversarial comment flag present
What to do

Treat as suspicious pending further analysis; isolate and re-verify before any execution.

Sources disagree

1 contradiction resolved by the scoring engine

Only low-trust / heuristic engines flagged this file
2 engines from the heuristic / generic-AI set flagged it. No tier-1 engine agreed.
Detection weight reduced in scoring.
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
30

Adversary techniques mapped to the MITRE ATT&CK framework.

T1012T1018T1027T1027.002T1036T1053T1055T1056T1057T1059T1070T1070.004T1071T1082T1083T1091T1095T1112T1120T1129T1222T1497T1518.001T1539+6 more
Spawned processes
15
$(unnamed)
"C:\Users\<USER>\Desktop\program.exe"
$(unnamed)
.\setup.exe
$(unnamed)
"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\<USER>\AppData\Local\Temp\7zSEE38.tmp\PatchCleaner.msi"
$(unnamed)
C:\Windows\system32\services.exe
$(unnamed)
C:\Windows\system32\msiexec.exe /V
$(unnamed)
C:\Windows\syswow64\MsiExec.exe -Embedding DB888541E94A02AA1DAA1E9EA1B6607E C
$(unnamed)
C:\Windows\System32\svchost.exe -k NetworkService -p
$(unnamed)
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
+7 more processes captured.
Network activity
20
IP addresses20
  • 192.168.0.167
  • 209.197.3.8
  • 131.253.33.203
  • 8.252.68.126
  • 192.168.0.32
  • 192.168.0.35
  • a83f:8110:1800:0:200:0:0:0
  • 23.216.147.76
  • 20.80.129.13
  • 23.216.147.64
+10 more
Filesystem & mutexes
40
Files written15
  • C:\Users\<USER>\AppData\Local\Temp\7zSEE38.tmp\PatchCleaner.msi
  • C:\Users\<USER>\AppData\Local\Temp\7zSEE38.tmp\setup.exe
  • C:\Users\<USER>\AppData\Local\Temp\VSDF1A3.tmp\install.log
  • C:\Users\<USER>\AppData\Local\Temp\CFG14EA.tmp
  • C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
+10 more
Files deleted15
  • C:\Windows\SysWOW64\MsiWerCrashmetadata-41
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER217D.tmp.WERInternalMetadata.xml
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER2238.tmp.csv
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER2268.tmp.txt
  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER2844.tmp.WERInternalMetadata.xml
+10 more
Mutexes created10
  • CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
  • CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
  • CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
  • CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
  • CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
+5 more
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • 4d6d882e86a8b94b63c48e8d5aNever scanned
    never seen before
  • adf737e044c8125286b7c723d4Never scanned
    never seen before
  • c43f57c1aff7a3571fb84df164Never scanned
    never seen before
  • f5ba88b4a9928b710c9de65b6cNever scanned
    never seen before
  • e1c84c55cd245d0b487c053c62Never scanned
    never seen before
  • bb5a1d709ddba97bb438d77afaNever scanned
    never seen before
  • 2099f0854585b2115e090d7b95Never scanned
    never seen before
  • 3096d8e82917a9b73f323cdd5bNever scanned
    never seen before
  • 30e621d2720a1f8b727f44e8bcNever scanned
    never seen before
  • f2f69d75c8e2d790026cf926e9Never scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

3 synthesis
MITRE ATT&CK profile
Defense evasion× 1Cred access× 1C2× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • ProcessInjectionhigh

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    C:\Windows\System32\svchost.exe -k NetworkService -p
  • CredentialDumpermedium

    Sandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.

    Evidence
    C:\Windows\system32\lsass.exe
  • DirectIpC2medium

    Sample contacted 16 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    209.197.3.8 · 131.253.33.203 · 8.252.68.126
Antivirus engine breakdown

2 detections across 74 engines

2 malicious0 suspicious72 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-240 engines
0flag
Mainstream engines with mixed FP rates
Low-trust17 engines
2flag
Heuristic / generic-AI engines (high FP rate)
APEX
malicious
Malicious
Trapmine
malicious
malicious.moderate.ml.score
Hash 6472de894c5c… cross-referenced against 74 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked
Section entropy5 sections
.text
6.61
.rdata
4.37
.data
1.37
.sxdata
0.02
.rsrc
3.30
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old
Unique uploaders
3,612
Hundreds of people have uploaded this — common.
Total submissions
8,261
Includes repeat uploads by the same source.
First seen by VT
10y ago
Mar 3, 2016
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
here
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
3/3/2016, 9:15:06 AM
First seen (MalwareBazaar)
Last analysis (VT)
7/10/2026, 10:43:34 AM
Scanned here
7/10/2026, 7:25:34 PM
File name
7zS.sfx.exe
Size
1.26 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
6472de894c5cb6050fd80cdd893b8772aef71f8bdb5c65a0175cf7cbb90e6ec6
MD5
70d0bd7633d10c492839272c97b2544e
SHA-1
4da0e8c2fe1f06b13985d700fe15686a1015c3bb
PE imphash
3786a4cf8bfee8b4821db03449141df4
First seen (VT)
3/3/2016, 9:15:06 AM
Last analysis (VT)
7/10/2026, 10:43:34 AM
First scan (MalwareTips)
7/10/2026, 7:25:34 PM
Last scan (MalwareTips)
7/10/2026, 7:25:34 PM
Community reputation
+113trusted
Behavior tags
peexeoverlayruntime-moduleslong-sleepsvia-tordirect-cpu-clock-accessdetect-debug-environmentchecks-user-inputchecks-usb-bus
Frequently asked

Safety FAQ

Common questions about 7zS.sfx.exe, answered from the scan data above.

  • 7zS.sfx.exe is suspicious — treat it as unsafe until you're sure. 2 of 74 antivirus engines flag it, which isn't a strong consensus but is enough to be cautious. Don't run it unless you fully trust where it came from, and prefer downloading the software fresh from its official site.
  • 7zS.sfx.exe is a Windows executable program, about 1.3 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.
  • 2 of 74 antivirus engines flagged 7zS.sfx.exe, 2 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.
  • Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.
  • To remove 7zS.sfx.exe: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original 7zS.sfx.exe file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.
  • The SHA-256 hash of 7zS.sfx.exe is 6472de894c5cb6050fd80cdd893b8772aef71f8bdb5c65a0175cf7cbb90e6ec6, and its MD5 is 70d0bd7633d10c492839272c97b2544e. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
  • This report reflects the scan run on July 10, 2026. Because a file's hash never changes, the identity of 7zS.sfx.exe is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.