home

7z938.exe

The executable 7z938.exe has been detected as malware by 1 anti-virus scanner. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. Additionally, the file is typically installed by a number of programs including Stranded Deep by Beam Team Games and The Forest by Endnight Games Ltd. The file has been seen being downloaded from www.universesoftwaretours.com and multiple other hosts.
MD5:
fe5bf952bdf6577ec34ae6f26be28667

SHA-1:
9ac9e5e6a19bf3b18cd7bcbe34a5141996bb3028

SHA-256:
bbee630f212527b6ac1b5b07ae405eb1d83e3e4e02c99824dd865ca78288fe2e

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
12/17/2025 2:53:22 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
(M)
16.6.21.18

File size:
1.1 MB (1,182,190 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\7z938.exe

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:cV8Au3X0b9NL7ewxmjoRNmrylQduJM59vZFBqoJeqjR6o1fyN:qFuHVKm+lQd93vfBqoJ9jRSN

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.9877

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file 7z938.exe has been discovered within the following programs.

DRAGON BALL XENOVERSE  by DIMPS
www.dragonballxenoverse.com
About 9% of users remove it
Stranded Deep  by Beam Team Games
www.beamteamgames.com/stranded-deep
About 8% of users remove it
The Forest  by Endnight Games Ltd
The Forest is a first-person survival horror video game.
survivetheforest.com
About 6% of users remove it
 
Powered by Should I Remove It?

The file 7z938.exe has been seen being distributed by the following 50 URLs.

http://www.universesoftwaretours.com/WVl6OTRQU1V5UW5CelkwY2xNa0k1TjIxaFdFOVpOVTV0WTFOemFYcEZWRU1sTWtZMVQwMXdTelIxYW5ONFEyOXRUMEZYUXpBbE0wUW1ZejFMTW1kYVVtbHZlbXA2ZFhVMkpUSkdURzAwUzJWTlFtNTFRMDluVmxWeVoxTnpVVVV4VkhaWGVFVnViME5RVTNrM1oyaG5RV2RFZVVWWVRtaHJPR2R5UjNNNVMwSm5Oa1pMSlRKQ1MweDFlRXBWV2xOamFIUTBlSFoyTUhoSk4wSkNSRFp0VDJacFF6QWxNa0p5VUZWWmFVNHlVMHd5WkVabWNVbEdjbEJpWVNVeVJuaGhZV1phUm05SU9YbFNVRkJ6SlRKR1owZEJWMGhIWmxBNFIxZEJKVE5FSlRORUptUnZkMjVzYjJGa1FYTTlhVzV6ZEdGc2JDNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1ptYVd4bGN5NXpkSGxzWlcxNWMyVnNaaTV1WlhRbE1rWTNlamt6T0M1bGVHVT0=

http://filehippo.com/download/file/.../

http://www.signtodayclean.com/kg5k0BYMXkfXJ_hQrpK_h0UQbT7tEa9aYqNujr_6FemSkArL6XsDiQyBNvf9_ A1a _fif1K7t9qzmR9kWEHzs5LGEl910De8E3bq8YZ3kqLfhIu5H1b0TCo6OPj2jfzPhaTGPbEUUaXvYR_1pWhcmiZmv FOpb83bdwi2ArpVCGmMGF wy8jWRPr36D1kMKj2p77K7 -Ow==

http://123.briian.com/forum.php?mod=attachment&aid=NzExMXw4YTY1MDIxZnwxNDIxMjgzMzA3fDB8MTQz

http://fs40.filehippo.com/4724/.../7z938.exe

http://www.vaultsbinariesvaults.com/Nq8tFK1pxGxxVpwV6jkRPldzKK0uR_0 kypPMJAIlur0_ogdWFzR1AwYbbTg_8J4LplsUBlgIKJ0 ilYK0TNddZUav9WO_6Ewn3tPlUf lUw6aC_UAOyNnomvMbSCtnU77CrVhK1nNxW3q211km1kw2lIpxZuFhVGIZlHK_L46 jWktsLpvrPTKYfyxCXPIrd1PraL2Ht ak49aAZVM19RrlfKcPrw==-Ow==

http://dc776.4shared.com/download/.../7-ZIP_32.exe

http://www.signtodayclean.com/7j1vnU8J_rVyeZhOe4izRGcx1hl1N72e_cCisNUqElSskJbdtGnnlv4hmJ0NChMGmkkru0kT7UDKHRUQzTNvArsH3 u CjJysQIXLwyVyq2Uy6AFgZJVRLWrGuSeK0AJbCUkvXkinn6kw8sNQ3YU5X9UDlU8kPUEq9RfWRFk1zQXI4mPlqrVQCH x2eQiRiav5Dl2l19-Ow==

http://www.vaultsbinariesvaults.com/_boEVqVGRQLeyOlJQ6GJcmVaoKQqmG6YpL7Q1yqz6VpemAtkOlWLkdx0SVSHfvqacfjRBl1rYOScXf6TkAyKXDQFAyhmB934HJ8Zhf61ylkSUzvNSlmBXNsEQkn8Erl5WePpOfs7J 19rbXdpeWBYn_0P75Ic lsJhhgn74ivexu0Oq2tmg6SZHpte9qhxY v8CAzDh2-Ow==

http://dc271.4shared.com/download/.../7-ZIP_32.exe

http://www.filehippo.com/fr/download/file/.../

http://www.vaultsbinariesvaults.com/JLH5RkWiI1wX9_vOUDHIvipCFLpeC87gIRgiJiiH1IePpLKaDGVdaq7p4hDxCWJbM2M1M 5Xb74dfGzXFNE5y 5CaftVJlMd6CnKRK659Sw2Z5MLKpvt7GWXLoHu TsvYLqnr157ubwz5T5f34ZQk471DqLNlG3pn_ghvr7nWkFjccEeG1z_ODFYjtOZEjiX9NMDRlif-Ow==

&onid=2250&oid=3001-2250_4-10045185&rsid=cbsidownloadcomsite&sl=en&sc=us&topicguid=utilities/file-compression&topicbrcrm=&pid=14013354&mfgid=64084&merid=64084&ctype=dm&cval=NONE&devicetype=desktop&pguid=c157e020362e0fbc57412d7e&viewguid=Tjq4J4t1V6IguD@aOQqRdiLY3wHhFH1LPw1c&destUrl=http://software-files-a.cnet.com/s/software/14/01/33/.../7z938.exe

ftp://ftp.unza.zm/software/Software Tools/.../7z938.exe

http://filehippo.com/download/file/.../

http://downloadme.co/.../7zip.exe

http://filehippo.com/download/file/.../

http://heanet.dl.sourceforge.net/project/sevenzip/7-Zip/.../7z938.exe

http://fs36.filehippo.com/4957/.../7z938.exe

http://garr.dl.sourceforge.net/project/sevenzip/7-Zip/.../7z938.exe

http://www.worldbodybyte.com/c?x=swKIsOT7J9uqGvmg1c9Zqlz2O2QC3zTpMg/lm8Qw2x4=&e=0&c=1dSegH7eZhTByaMg0lgrhWDMSUWU5J w R3mF6GtdQRWzx3 YPt9VTjakOmSU5o8fgu1RWv3n1crJvdXzWO9BC8Wr3wp1kcEY1whqKrSS8ABXMxI OFTOS8vM9elWV pdBh9Or WR4d6GsmtZO7aVl5R9D hMFDvr5qXboQjgUk=&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z938.exe

http://filehippo.com/download/file/.../

http://filehippo.com/fr/download/file/.../

http://172.27.0.2/main.php/.../3786

http://www.toursheadfiles.com/WVl6OTRQVUZ3ZUZsUUpUSkNSbWhIU1dKeFZtcEJkbVpZVkV0NFJFSkVTbVI0TjJVbE1rSXhkamRGVkU1UlRFSTNha3BWSlRORUptTTlZamRZUTBsclRVbE5WbGQwTjFOR1ZrOTNTek5uSlRKQ2VUTjFjaVV5UmpSUGFuazVlREV4WjBONmFGTTBVRkZLT0hWUlF6Uk5WREpSVHpKbGRDVXlRbFpUUVVGT1NqSmxNWGhTTW1kU1JUVTJkMmROYUZONmR6aHZkRzFtUWpReFltVlNkMHRYT0cwMWMzQlVaM0JFUVhJeFIwaFpOMFJzTTI5Q1ZrVldiV1I0VlZJeGRGWW1aRzkzYm14dllXUkJjejFwYm5OMFlXeHNMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um1acGJHVnpMbk4wZVd4bGJYbHpaV3htTG01bGRDVXlSamQ2T1RNNExtVjRaUT09

temp:7z938.exe

http://www.bestcurrentstock.com/WVl6OTRQWFZ0WjNZbE1rWkVWa2RvZEU4eFpXcHRaVmRoYWxsdGNYSm9jM1IwT1ZKMFlWSlFWMlo1ZGtSb2IzRldaeVV6UkNaalBVcGtjMDQ0TUZWMFJXaHNTR2RYYXpKWlZIcGFkWGxHYm5WamRGa3hUbTh6UlZWbGJFRnJWeVV5UmpGSFoydHhXa0UwYzB4bVltZHlUR0ZDZUc5SmQyODBVMmgzV25GaU1tZGtaRGR6Y0dkd2JFWldjMncyYlZGTlJHNWxlbEo0Y1ZCak4zVlBkbTB4Wkd0TVRFSnBSVTBsTWtKWVJuWjNVbVpvVFNVeVFrTXdKVEpDVVZGUFZFSXdPSHBFYWpGMmVtbEZWVTluUkZaNWMzSklORUpuSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBUZGFhWEJmVTJWMGRYQXVaWGhs

http://www.filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://www.grabworldgift.com/WVl6OTRQVEpTUTNGb1pFOUxNekZXT1dSSWFrVjNSRTAwUm5Cbk0yY3lORmN5UzNZMVoxSldNRUpXVDI1VldtTWxNMFFtWXoxSFVsUnhObGxCVWtGSlkwbHBObGxqTVRBMFZHSkhkbVZwVXpOQlFrUWxNa1paV2xsbVVrRWxNa1pXZWlVeVJsaG1Oek5hVmpOU1pFcFZVREl5VTNwS05EazJWbUZaVm5wbE5rSjFjazFaVUdRbE1rWlhlRGxYY1U1S1RuSnlNM0VsTWtKdFMwZFFTMjFGTlVKQ1JYbG5ZbmxuUmtWSU1tUkVkV3BNZEV4VGRVVkpiM2t4YTFnd2NHUW1aRzkzYm14dllXUkJjejFwYm5OMFlXeHNMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um1acGJHVnpMbk4wZVd4bGJYbHpaV3htTG01bGRDVXlSamQ2T1RNNExtVjRaUT09

Latest 30 of 83 download URLs

Remove 7z938.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.