» 7zip.exe
Overview
Analysis
File Details
Downloads (3)

7zip.exe

SafeInstaller

InstallX, LLC

This is the InstallX/InstallIQ download manager and installer that will bundle offers during setup for additional PUPs and other unwanted software. The application 7zip.exe by InstallX has been detected as adware by 31 anti-malware scanners. The program is a setup application that uses the InstallIQ Installation Manager installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from 1-vinstaller.com and multiple other hosts.

File name:

7zip.exe

Publisher:

SafeInstall, LLC (signed by InstallX, LLC)

Product:

SafeInstaller

Description:

Safe Installer

Version:

1.0.64.0

MD5:

38a2c71c9a94b449aa26c64557a91bcf

SHA-1:

da1e08600267957104fd5b5a8a3010b1f54781f7

SHA-256:

f67865ffdbe1b335f3e7869fcd4af129a98f255b0c1944542977d13a3ab0355f

Scanner detections:

31 / 68

Status:

Adware

Explanation:

Uses the InstallIQ (by InstallX) software bundler that may include toolbars and other browser extensions offers.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

5/16/2025 10:44:02 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Application.Bundler.Graftor.155902

772

AhnLab V3 Security

PUP/Win32.Bundler

2014.12.25

Avira AntiVirus

APPL/InstallIQ.Gen4

7.11.197.174

avast!

Win32:PUP-gen [PUP]

2014.9-141224

AVG

InstallIQ

2015.0.3250

Baidu Antivirus

Adware.Win32.InstallIQ

4.0.3.141224

Bitdefender

Gen:Variant.Application.Bundler.Graftor.155902

1.0.20.1790

Comodo Security

Application.Win32.InstallIQ.B

20461

Dr.Web

Adware.Downware.9371

9.0.1.0358

ESET NOD32

Win32/InstallIQ (variant)

8.10924

Fortinet FortiGate

Riskware/Agent

12/24/2014

F-Secure

Gen:Variant.Application.Bundler

11.2014-24-12_4

G Data

Gen:Variant.Application.Bundler.Graftor.155902

14.12.24

IKARUS anti.virus

Win32.Heur

t3scan.1.8.5.0

K7 AntiVirus

Unwanted-Program

13.188.14440

Kaspersky

not-a-virus:Downloader.NSIS.Agent

14.0.0.2747

Malwarebytes

PUP.Optional.SafeInstall.A

v2014.12.24.02

McAfee

Artemis!38A2C71C9A94

5600.6906

MicroWorld eScan

Gen:Variant.Application.Bundler.Graftor.155902

15.0.0.1074

NANO AntiVirus

Riskware.Win32.Searcher.csnymk

0.30.0.64448

Panda Antivirus

Trj/CI.A

14.12.24.02

Qihoo 360 Security

HEUR/QVM41.1.Malware.Gen

1.0.0.1015

Quick Heal

Downloader.NSIS.g1c (Not a Virus)

12.14.14.00

Reason Heuristics

PUP.Installer.InstallX.E

14.12.24.14

Rising Antivirus

PE:Trojan.Win32.Generic.17A19AEC!396466924

23.00.65.141222

Sophos

InstallQ

4.98

Trend Micro House Call

Suspicious_GEN.F47V1224

7.2.358

Trend Micro

TROJ_GEN.R0C2C0OK314

10.465.24

Vba32 AntiVirus

suspected of Trojan.Downloader.gen.h

3.12.26.3

VIPRE Antivirus

InstallIQ Installer

36040

Zillya! Antivirus

Downloader.Agent.Win32.229676

2.0.0.2015

File size:

1.9 MB (1,967,640 bytes)

Product version:

1.0.64.0

Original file name:

safeinstall.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

InstallIQ Installation Manager

Language:

English (United States)

Common path:

C:\users\{user}\downloads\programs\7zip.exe

Digital Signature

Signed by:

InstallX, LLC

Authority:

DigiCert Inc

Valid from:

3/20/2014 6:00:00 PM

Valid to:

4/8/2015 6:00:00 AM

Subject:

CN="InstallX, LLC", O="InstallX, LLC", L=Sartell, S=Minnesota, C=US

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0F4D188192318D28510FC886CBB855E6

File PE Metadata

Compilation timestamp:

11/17/2014 3:51:56 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

24576:CC2juLUBmo35wuemtMlokRlUmfL9O9HxW39tQ47etIsWeODPv3GGehbTJdmTiY++:TrmrDQwO9p7YvWeUzehOTvhyOwqM6

Entry address:

0x5A90A

Entry point:

E8, E3, 3B, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 40, 87, 54, 00, E8, 20, 2C, 00, 00, E8, B0, 3D, 00, 00, 0F, B7, F0, 6A, 02, E8, 76, 3B, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 57, 35, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8... 
[+]

Entropy:

7.0378

Code size:

1.1 MB (1,110,016 bytes)

The file 7zip.exe has been seen being distributed by the following 3 URLs.

http://1-vinstaller.com/.../download?accountid=15076&shortname=7Zip&campaignname=7b

http://dl2.vik9installer.com/download/Base/431961/.../7Zip.exe

Remove 7zip.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.