WinRAR[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WinRAR.exe
Size

1.3MB
MD5

ea27b07053baaaf34a5da77a5e3d4a22
SHA1

2d93c4017b48170bdc0944932b899b4fb6713ad9
SHA256

4e213fbc2053bf90ce3b129535afabe4bfef59cc3fc04636d15893d9e301ab43
SHA512

8cd2fa581fbb21e7f56b0b3abfb78b518d056635599b9741e60c2569773e059de97f7124762cd0cd03923b9b575a37f4c4825fadd80c51832b6852244fe78524
SSDEEP

24576:W5fDP3NXIyMpuVSlrpuLQRSSJQDuEnpX9+OxX5G+cKFnMMMMMM90rXaLUF:W5fb381FYJpt1xXAiMMMMMM2eLUF

Score

1^/10

Malware Config

Signatures

Files

WinRAR.exe
.exe windows x86

e06f09245d38c33633522c81b98b8b4e

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:95:3f:a5:4d:d1:2d:d9:ca:6b:94:8c:17:bf:d6:7c
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2013, 00:00

Not After

13/06/2015, 23:59

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Schumannstr. 17,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7d:2c:cd:fc:77:b9:d2:97:41:b8:b0:90:68:0e:be:d6:86:af:a5:7a
Signer

Actual PE Digest

7d:2c:cd:fc:77:b9:d2:97:41:b8:b0:90:68:0e:be:d6:86:af:a5:7a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Schumannstr. 17,L=Berlin,ST=Berlin,C=DE

16/12/2014, 10:56
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon
ord8
CreateStatusWindowW
ImageList_Destroy
ImageList_Create
ImageList_Remove
ImageList_AddMasked
ImageList_Add
PropertySheetW

shlwapi

StrCmpLogicalW
SHAutoComplete

uxtheme

IsAppThemed
IsThemeActive

kernel32

GetCurrentThread
SetPriorityClass
SetCurrentDirectoryW
GetFullPathNameA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateThread
WaitForSingleObject
GetProcessAffinityMask
CreateEventW
CreateSemaphoreW
ReleaseSemaphore
ResetEvent
SetEvent
SystemTimeToFileTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
IsDBCSLeadByte
GetCPInfo
GetDateFormatW
GetTimeFormatW
GetTempPathW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetVersionExA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
ReleaseMutex
CreateMutexW
GetDiskFreeSpaceW
FindCloseChangeNotification
FindFirstChangeNotificationW
GetTickCount
GetModuleHandleExW
CopyFileW
GetCompressedFileSizeW
UpdateResourceW
EnumResourceLanguagesW
EndUpdateResourceW
EnumResourceNamesW
BeginUpdateResourceW
SetThreadPriority
GetNumberFormatW
GetLogicalDrives
ResumeThread
SuspendThread
GetCurrentThreadId
GetLocalTime
GetThreadPriority
GetPriorityClass
SetErrorMode
MulDiv
CompareFileTime
FindNextChangeNotification
WaitForMultipleObjects
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
LoadLibraryA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleHandleA
LCMapStringW
LCMapStringA
HeapSize
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
IsDebuggerPresent
TerminateProcess
VirtualAlloc
VirtualFree
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetConsoleMode
GetConsoleCP
RaiseException
ExitThread
RtlUnwind
HeapReAlloc
CompareStringA
GetCurrentProcessId
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
GetFullPathNameW
GetCurrentDirectoryW
GetVersionExW
FindNextFileW
ExpandEnvironmentStringsW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetDriveTypeW
FlushFileBuffers
GetFileType
GetFileTime
GetStdHandle
GetLongPathNameW
GetShortPathNameW
MoveFileW
FindFirstFileW
FindClose
DeviceIoControl
BackupSeek
BackupRead
FormatMessageW
LocalFree
GetCommandLineW
GetFileInformationByHandle
CreateHardLinkW
GetModuleHandleW
GetCurrentProcess
SetLastError
GetModuleFileNameW
HeapCreate
HeapDestroy
DosDateTimeToFileTime
LocalFileTimeToFileTime
HeapFree
HeapAlloc
Sleep
GetSystemTimeAsFileTime
RemoveDirectoryW
CreateDirectoryW
SetFileAttributesW
DeleteFileW
SetEndOfFile
WriteFile
ReadFile
GetProcAddress
SetFileTime
GetFileAttributesW
CloseHandle
SetFilePointer
GetFileSize
GetLastError
CreateFileW
LoadLibraryW
FreeLibrary
GetProcessHeap
SetEnvironmentVariableA
GetLocaleInfoW

user32

GetClipboardData
PostQuitMessage
SetMenu
InsertMenuW
LoadMenuW
RegisterClassW
LoadAcceleratorsW
GetMenuState
RegisterClassExW
TranslateMessage
DispatchMessageW
GetMessageW
CopyRect
ValidateRect
GetSysColor
CopyImage
FillRect
DrawIconEx
GetSystemMenu
SetTimer
KillTimer
SystemParametersInfoW
MessageBoxIndirectW
RedrawWindow
GetComboBoxInfo
IsCharUpperW
IsCharAlphaW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
MessageBeep
PeekMessageW
GetFocus
EnableMenuItem
MoveWindow
GetMenuItemID
LoadBitmapW
InsertMenuItemW
LoadImageW
RegisterWindowMessageW
BeginPaint
GetWindowTextLengthW
AppendMenuW
DrawMenuBar
GetMenu
GetSubMenu
DeleteMenu
GetMenuItemCount
ScreenToClient
ClientToScreen
CreatePopupMenu
TrackPopupMenu
DestroyMenu
CallWindowProcW
WaitForInputIdle
IsWindow
RegisterClipboardFormatW
GetKeyState
LoadCursorW
SetCursor
WindowFromPoint
GetWindowThreadProcessId
GetDC
ReleaseDC
GetDesktopWindow
GetCursorPos
EnableWindow
IntersectRect
SystemParametersInfoA
IsIconic
IsWindowEnabled
SetDlgItemInt
GetDlgItemInt
GetLastActivePopup
IsChild
PostThreadMessageW
CreateDialogParamW
SetScrollPos
ScrollWindowEx
PtInRect
SetScrollRange
LoadIconW
CreateDialogIndirectParamW
GetPropW
RemovePropW
BringWindowToTop
GetIconInfo
CreateIconIndirect
TranslateAcceleratorW
IsDialogMessageW
SetPropW
FindWindowW
CheckMenuItem
GetForegroundWindow
wsprintfW
OemToCharW
OemToCharA
CharToOemBuffA
OemToCharBuffA
CharToOemA
MessageBoxW
CharToOemBuffW
FindWindowExW
EnumWindows
CreateIcon
SetForegroundWindow
UpdateWindow
FlashWindow
IsDlgButtonChecked
ShowWindow
EnumChildWindows
PostMessageW
InvalidateRect
CheckDlgButton
DialogBoxParamW
DestroyIcon
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
GetParent
MapWindowPoints
GetDlgItem
SendDlgItemMessageW
EndDialog
GetDlgItemTextW
SetDlgItemTextW
DestroyWindow
CreateWindowExW
DefWindowProcW
SetFocus
CharUpperW
CharLowerW
ExitWindowsEx
CharLowerA
LoadStringW
GetWindowRect
GetClientRect
SetWindowPos
GetWindowTextW
SetWindowTextW
GetSystemMetrics
GetWindow
GetClassNameW
SendMessageW
GetMenuItemInfoW
SetMenuItemInfoW
GetWindowLongW
SetWindowLongW
EndPaint

gdi32

Rectangle
TextOutA
MoveToEx
LineTo
GetDeviceCaps
CreatePatternBrush
SetPixel
CreateDIBSection
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
CreateCompatibleBitmap
StretchBlt
SetBkColor
ExtTextOutW
BitBlt
GetObjectW
CreateCompatibleDC
GetPixel
DeleteDC
CreatePen
CreateSolidBrush
SetTextColor
TextOutW
Polygon
Polyline
SelectObject
GetTextFaceW
GetTextMetricsW
CreateFontW
GetTextExtentPoint32W
DeleteObject

comdlg32

GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError
ChooseFontW

advapi32

RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
GetSecurityDescriptorLength
GetFileSecurityW
IsTextUnicode
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
DuplicateToken
MapGenericMask
AccessCheck
SetFileSecurityW
RegCloseKey

shell32

SHAddToRecentDocs
SHGetPathFromIDListW
FindExecutableW
DragFinish
DragQueryFileW
DragAcceptFiles
Shell_NotifyIconW
ShellExecuteW
ord100
SHFileOperationW
ShellExecuteExW
SHBrowseForFolderW
SHChangeNotify
SHGetDesktopFolder
SHGetFileInfoW
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CreateStreamOnHGlobal
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
CoTaskMemAlloc
CLSIDFromString
OleSetClipboard
DoDragDrop
CoInitializeEx

oleaut32

SysAllocString
VariantClear
VariantInit

Sections

.text
Size: 1005KB - Virtual size: 1005KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 676KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e06f09245d38c33633522c81b98b8b4e

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

75:95:3f:a5:4d:d1:2d:d9:ca:6b:94:8c:17:bf:d6:7cCertificate

Extended Key Usages

Key Usages

7d:2c:cd:fc:77:b9:d2:97:41:b8:b0:90:68:0e:be:d6:86:af:a5:7aSigner

Signature Validations

Verification

16/12/2014, 10:56 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

shlwapi

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 1005KB - Virtual size: 1005KB

.rdata Size: 80KB - Virtual size: 80KB

.data Size: 16KB - Virtual size: 676KB

.rsrc Size: 208KB - Virtual size: 208KB

.reloc Size: 55KB - Virtual size: 55KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

75:95:3f:a5:4d:d1:2d:d9:ca:6b:94:8c:17:bf:d6:7c
Certificate

7d:2c:cd:fc:77:b9:d2:97:41:b8:b0:90:68:0e:be:d6:86:af:a5:7a
Signer

16/12/2014, 10:56
Valid: false

.text
Size: 1005KB - Virtual size: 1005KB

.rdata
Size: 80KB - Virtual size: 80KB

.data
Size: 16KB - Virtual size: 676KB

.rsrc
Size: 208KB - Virtual size: 208KB

.reloc
Size: 55KB - Virtual size: 55KB