iobit-driver-booster: a7a9205e — 7-Zip SFX installer for Driver Booster v3.4, benign false positive

Executive Summary

A 15.7 MB PE32 self-extracting archive built with the legitimate 7ZSfxMod module. The payload is IObit Driver Booster v3.4 (a system driver-update utility) compiled with Delphi RAD Studio XE2, bundled with its runtime packages, a madExcept crash reporter, and a 14.7 MB encrypted driver database. No malicious behavior, persistence, or C2 observed. MalwareBazaar ingestion is a false positive.

What It Is

The binary is a standard 7-Zip self-extracting archive. The 7z stream starts at offset 0x2DF49 (188,233 bytes into the file) ^[binwalk.txt:6] and contains 11 extracted files totalling ~22.4 MB uncompressed. The SFX configuration block embedded in .rsrc specifies RunProgram="%%T\DeltaGen32.exe" ^[strings.txt:381], which launches the inner executable after extraction to %TEMP%.

How It Works

SFX wrapper (benign carrier)

The outer PE is an unmodified 7ZSfxMod_x86.exe v1.4.0.1795 ^[pefile.txt:242]. Its import table is minimal and typical for a GUI SFX: KERNEL32 (file I/O, memory, threads), USER32 (dialogs, windowing), GDI32, SHELL32 (folder browsing, ShellExecute), OLE32, OLEAUT32, and MSVCRT ^[pefile.txt:263-500]. No networking, no crypto, no registry manipulation. The linker version is 8.0 (Visual Studio 2005-era) ^[pefile.txt:45].

Inner payload — DeltaGen32.exe

Extracted DeltaGen32.exe is a ~851 KB PE32 Delphi application compiled with Embarcadero RAD Studio XE2 (packages rtl120.bpl and vcl120.bpl). It imports:

• winhttp.dll — Windows HTTP services
• wsock32.dll / Winsock APIs — network I/O
• shell32.dll — ShellExecuteW
• advapi32.dll — registry access (for driver scanning)
• madExcept_.bpl, madBasic_.bpl, madDisAsm_.bpl — madExcept crash-reporting framework ^[terminal:pefile imports]

String analysis of the inner executable reveals clear IObit branding:

• [Bug Report] - Driver Booster v3.4 - %appname% ^[terminal:inner strings]
• support10@iobit.com ^[terminal:inner strings]
• bugreport.txt, screenshot.png, send bug report, save bug report ^[terminal:inner strings]
• Contact Information, attach a screenshot to the bug report ^[terminal:inner strings]

These are all legitimate elements of the IObit Driver Booster crash-reporting UI. The OpenSSL imports (SSL_CTX, SSL_connect, BIO_new_socket, etc.) ^[terminal:inner strings] serve HTTPS update checks to IObit's driver-definition servers.

Bundled data files

The .dump and .so files contain scrambled natural-language-like text fragments consistent with an encrypted vendor driver database, not shellcode or C2 configuration.

Decompiled Behavior

No Ghidra decompilation performed. The SFX is a well-known legitimate open-source module (7ZSfxMod) and the inner executable is a commercial Delphi application with clear branding. Static string analysis is sufficient for family attribution. CAPE dynamic analysis was unavailable (no Windows guest) ^[dynamic-analysis.md].

C2 Infrastructure

None observed. No hardcoded IPs, domains, URLs, mutex names, named pipes, or registry persistence keys found in either the SFX wrapper or the inner executable. The only URLs recovered are Sectigo/DigiCert CRL and OCSP endpoints inside the PE signature area of DeltaGen32.exe ^[terminal:inner strings], which are standard Authenticode certificate infrastructure references (the binary itself is unsigned, but the certificate store strings are present from the linker).

Interesting Tidbits

• The SFX module is from 2010 but the inner payload is from ~2024. This is common for repackaged installers: vendors reuse old SFX builders.
• DeltaGen32.exe references Driver Booster v3.4, but the actual version of the bundled database is unknown. The v3.4 string may be a legacy UI template.
• The parserlib.dump entropy of 7.89 suggests strong encryption or compression — consistent with a commercial driver database that vendors protect from competitors.
• No YARA matches beyond generic PE_File_Generic ^[yara.txt].
• Capa analysis failed due to missing signatures ^[capa.txt].

How To Mess With It (Homelab Replication)

Not applicable. This is legitimate software. Replicating the build is possible with Embarcadero RAD Studio XE2 + madExcept + Indy + OpenSSL, but serves no defensive purpose.

Deployable Signatures

Recommendation: Do not hunt this hash or the IObit Driver Booster installer family as malicious. If your pipeline auto-quarantines large SFX binaries, whitelist by:

• VS_VERSIONINFO CompanyName: Oleg N. Scherbakov + InternalName: 7ZSfxMod (legitimate SFX builder)
• Inner executable strings containing IObit, Driver Booster, support10@iobit.com
• Presence of parserlib.dump alongside DeltaGen32.exe in 7z contents

IOC list (for exclusion, not blocking):

sha256: a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504
file: DeltaGen32.exe
company: IObit
product: Driver Booster
support: support10@iobit.com
sfx_module: 7ZSfxMod_x86.exe v1.4.0.1795

Behavioral fingerprint: A 7-Zip SFX PE with RunProgram="%%T\DeltaGen32.exe" extracts to %TEMP% and launches a Delphi GUI application that checks for driver updates via HTTPS. The application bundles parserlib.dump (encrypted driver database), driver-reg.so (registry data), and Delphi runtime BPLs. No persistence, no injection, no C2 beaconing.

Detection Signatures

• MITRE ATT&CK: None applicable (benign software).
• Capa: Failed — signatures missing ^[capa.txt].
• YARA: PE_File_Generic only ^[yara.txt].

References

• IObit Driver Booster product page: https://www.iobit.com/en/driver-booster.php
• 7ZSfxMod project: https://sourceforge.net/projects/sfx-maker/
• Related wiki page: iobit-driver-booster

Provenance

Static analysis of original SFX (file.txt, pefile.txt, strings.txt, exiftool.json, binwalk.txt, rabin2-info.txt, yara.txt, capa.txt). Inner payload extracted with 7z x and analyzed with strings, file, and Python entropy calculation. No dynamic execution. CAPE skipped (no Windows guest) ^[dynamic-analysis.md].