WinRAR[.]rar | Triage

Sharing

General

Target

WinRAR.rar
Size

205KB
MD5

b895c05bb717646a60eabb2fda021238
SHA1

6cdbabadbfb1002e38b43f974b14b16e5daec280
SHA256

2b827310ca3d44b22ea74543dd3a3378bb1061f634cae8071bc8fe4ae2cb026b
SHA512

1cfcb316527458015bed4e55f331197385def278903c1ae2107759287b5680025b260ed6e8387c9e74f1a7fd7d02ced6a2c0979a2e812019dfe93bba7eab96b3
SSDEEP

3072:Q9Gvrq32UGTU1bIBzm3vSh5SSw9277mrHaTDFvPcgEI9E6pNgkLKs/tFabQCyU09:Ebgmah5S477EUDFNHrgkLHusZ9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Client.exe

Files

WinRAR.rar
.rar

Password: 123
Client.exe
.exe windows:4 windows x86 arch:x86

Password: 123

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 451KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ