UnRAR[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

UnRAR.exe
Size

373KB
MD5

e8de27baa072ca76cca38cd16430d4a4
SHA1

06e4e9f2d6e5daaece82ca500ca42cd2e836dced
SHA256

ba219fc3d292850334b5fa0098812ccad6015c8b60f7463936ef55b860953beb
SHA512

9ec882ac9ecf6cf0142fa48ad5d8e2c38e9c090adabb06a5341a3398f0e5d544f1e73f62ab72afc9fae2bac4570a4234ba01fe1b6462ab2cf29ced40ba0cbfb7
SSDEEP

6144:YjZQgFBHyV7jdaq7s01/p0Y1MjohbUbyxE5uqPj4K:HsBO7BB9/G6MjoY5uqPj1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UnRAR.exe

Files

UnRAR.exe
.exe windows:6 windows x64 arch:x64

21b8662c3d54bb7af3fb1c001a37030b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetTempFileNameW
GetTempPathW
GetLastError
ResumeThread
GetModuleHandleA
GetProcAddress
ExpandEnvironmentStringsW
CreateFileW
GetFileSize
CloseHandle
VirtualAlloc
VirtualFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetThreadContext
SetThreadContext
WriteProcessMemory
Wow64GetThreadContext
Wow64SetThreadContext
WriteFile
CreateFileTransactedW
WriteConsoleW
HeapSize
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
RtlUnwind

ktmw32

RollbackTransaction
CreateTransaction

ntdll

RtlVirtualUnwind
NtCreateSection
RtlCaptureContext
NtMapViewOfSection
RtlLookupFunctionEntry

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

21b8662c3d54bb7af3fb1c001a37030b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ktmw32

ntdll

Sections

.text Size: 166KB - Virtual size: 165KB

.rdata Size: 92KB - Virtual size: 91KB

.data Size: 4KB - Virtual size: 11KB

.pdata Size: 9KB - Virtual size: 8KB

.rsrc Size: 97KB - Virtual size: 96KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 166KB - Virtual size: 165KB

.rdata
Size: 92KB - Virtual size: 91KB

.data
Size: 4KB - Virtual size: 11KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 97KB - Virtual size: 96KB

.reloc
Size: 3KB - Virtual size: 3KB