WinRAR-723[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/Banner.dll
unpack001/$PLUGINSDIR/InstallOptionsEx.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsArray.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsProcessW.dll
unpack001/$PLUGINSDIR/nsisXML.dll

WinRAR-723.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 0501b47b11467d4ca1d2a3e1325fc1cf24614c89228ea884fbb7d0227323a244
MD5 b726f5637cb32735b3a4bd5b78658a73
SHA1 dad28d856b951d364ddc59b0556f368c9ff234ac
SHA512 39e251daabbe71741e841758f0ed554f1c64f51f9871d6c1e7f0280612c3e6e60ea978f2261080019412860270bb9616db5d8062434ab65fdbef697472e8ee66
SSDEEP 6144:WTA8oPwUhcX7elbKTusBknJgjRasYyvy+YNrhvbJZZQs6pQwrHxxmvY0Pa:WTAy3X3usBzlasYeYthvzZQs0Q4w6
TLSH
T10C6412529B90C562D5F74A305DB1DB3B9B76FD124A908243234026AA7B337837F1FAB4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

1f:0b:c6:a9:49:0d:a4:30:03:a7:5b:90:68:61:58:38:60:04:c4:08:1f:5b:eb:39:65:9b:60:9c:3a:ab:c6:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 109885 B,CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstr. 12,L=Berlin,ST=Berlin,C=DE,1.3.6.1.4.1.311.60.2.1.1=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.2=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 23, 2026

SERIALNUMBER=HRB 109885 B,CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstr. 12,L=Berlin,ST=Berlin,C=DE,1.3.6.1.4.1.311.60.2.1.1=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.2=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

SERIALNUMBER=HRB 109885 B,CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstr. 12,L=Berlin,ST=Berlin,C=DE,1.3.6.1.4.1.311.60.2.1.1=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.2=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Digest

1f:0b:c6:a9:49:0d:a4:30:03:a7:5b:90:68:61:58:38:60:04:c4:08:1f:5b:eb:39:65:9b:60:9c:3a:ab:c6:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 109885,CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e436861726c6f7474656e62757267,1.3.6.1.4.1.311.60.2.1.2=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Jul 23, 2026

SERIALNUMBER=HRB 109885,CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e436861726c6f7474656e62757267,1.3.6.1.4.1.311.60.2.1.2=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=HRB 109885,CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e436861726c6f7474656e62757267,1.3.6.1.4.1.311.60.2.1.2=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 109885,CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e436861726c6f7474656e62757267,1.3.6.1.4.1.311.60.2.1.2=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

04:8b:08:39:9e:c7:03:62:3c:72:cd:20:77:ad:65:d9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2023 - Aug 7, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

SERIALNUMBER=HRB 109885 B,CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstr. 12,L=Berlin,ST=Berlin,C=DE,1.3.6.1.4.1.311.60.2.1.1=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.2=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0f:d2:3c:c8:5a:11:67:07:8d:e1:45:be:6f:35:1c:26

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 17, 2026 - Oct 19, 2027

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

0

Major OS version

4

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/Banner.dll

IMPHASH beba03bbad1f8d79d5b3c1359e913e0d
SHA256 42c9387cb1749bf8338d5a6e6e8f598a22997e4cb9472da8dccc75c44b48f59c
MD5 2dffef22d117e60be69ad89cdd01dc19
SHA1 d39efb73bdc7a5c8f89c1427f0d9d284c501bf13
SHA512 9705ce9b0c2cd1eeeebcb9a951b029ca7b990cf4c4bddac2dbe1c57a6f5dca3f8b47d96a29d3cfa070c317837f9c219646489ef6435ef5014f1b143041770ac2
TLSH
T1F281633BB2F04EF7E563023300830BD3259BA9546728471A4D6791ED7A4A9D7D53DB02
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/BtmImg.bmp

SHA256 c4105bfa8e029496df562b8d33e77a15c605daa8c77a447714a45e1ed810a0b1
MD5 fa9eecad533dd938c324b2d45177701e
SHA1 686d1c93cd934e6078205fc0fbe48d766661044c
SHA512 a89480f0084808e8ad07e44c502ca7a687cc4b0f4154a03c9b6afbabb084bc165ee9de9f3df4810381a5d7c81037b0ff37502660b5980137def2643e5b447466
SSDEEP 192:XYooooo8B4oooooRBroooooehAoooooo6GIoooooo85goooooo8/Qoooooo8OXov:0tG1nN/nbnNExl0qNd0
TLSH
T156C3F3C239E722F3CA3E6E6B9571D6529B49FEACA4D011FE98954F4720AC91CF1C81D0
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/Custom.bmp

SHA256 628542088ccd123d6ced9629dce2d0518e4a7edcee872b9f407393291fa8034c
MD5 568284ba74006ed332c0338afb500e7e
SHA1 7627cc8864a2896521ceb61a08d1218f27a9b05e
SHA512 b8846cd0f98d81f54c0fb60c9af1b7255afe6f6fcc902d823dbb4355d7780f76a51d0fca6ca1054e6db7506aa5b2344c5d0e4a4469b79af027fa20d432f2ec49
TLSH
T120510C973A8546E8F55A78E4088F3D5E325E3FBF118433056183CF1A7CF024974676AA
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/Header.bmp

SHA256 30b2605b256df27baa509ee27209cec3f28ee1fcfe721484bc63dbe644b961bd
MD5 6107dcfb93cad5b9ea18a60c37e3c837
SHA1 a4d8207b7ecd28e4d04ba2ec3735e174ede9f307
SHA512 54154f5da1fd737c341579607a7a278e26abab5531ef93486d518a8bad24d1d4bbaee8b4fc431ade1af7d55964715d75bb7ff0a96c32be24a41a3f8655996d82
SSDEEP 1536:RTL1VM9PTqDF7ZB29FdtXqFZOHJa/Oz8pazH3:NLkTcn0R0Ia/OgqX
TLSH
T181041848F153C90729D2CF3536AEC97A49E278504B9A64F817EA007DB0FE9F046EE572
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/InstallOptionsEx.dll

IMPHASH 284d139f489ef5d980b7efc06948888b
SHA256 b03cedb899c8737fabb3efb1d02bb8330ee73ce667aa406a5e52a10aff180db7
MD5 b8c7fda6ec3c8a8ead7d7eccae0b17f7
SHA1 bb1444aa3300e9ab4a7a10c7913ae5e4320b953d
SHA512 52d3ce369418c9fbc7645e8ab272199dd836ebf13fe5019694f01f1686e0708853188b5a2ba8241739620dce98765bdb4fee488189d40c37222a0230b79e6e91
SSDEEP 1536:yU+yEIWirTd+OY4M8D1fb8Li7c3bSC2RVNCSivZYrgr+9MmHZ+WIwvtu1/5bCl:b+y5TlhR8DL2d14MMmHZvtq/5bw
TLSH
T19BC38D403AD1D073D1EA647C9559F37187BF7971AC6688477FA02B7B5F202809E2A336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

41281

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy

shlwapi

PathFindExtensionW PathFileExistsW

kernel32

GlobalUnlock GetCurrentDirectoryW GlobalFree SetCurrentDirectoryW lstrcmpiW lstrcatW CloseHandle GetSystemTime lstrcpyW WideCharToMultiByte HeapSize CreateFileA GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetProcessHeap LoadLibraryA HeapReAlloc VirtualAlloc HeapAlloc WriteConsoleW GetConsoleOutputCP WriteConsoleA IsValidCodePage GetOEMCP GetACP GetCPInfo FlushFileBuffers SetStdHandle InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter VirtualFree HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA ExitProcess Sleep InterlockedDecrement WritePrivateProfileStringW lstrlenW MultiByteToWideChar lstrcmpW CreateFileW ReadFile MulDiv GetTimeFormatW lstrcpynW LoadLibraryW GlobalAlloc WriteFile GetPrivateProfileStringW GetTickCount GetModuleHandleW GlobalLock SetErrorMode SetEndOfFile SetFilePointer FindFirstFileW GetFileSize GetDateFormatW SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetProcAddress HeapFree GetConsoleMode GetConsoleCP DeleteCriticalSection GetStartupInfoA GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind GetLastError SetHandleCount GetStdHandle GetFileType

user32

GetDC DestroyWindow SetCursor GetWindowTextLengthW SetWindowRgn GetSystemMenu SetTimer ScreenToClient GetWindowRect MapDialogRect GetMessageW CharNextW LoadImageW PostMessageW DrawTextW KillTimer GetKeyState CopyImage LoadCursorW DispatchMessageW GetClientRect wsprintfW GetIconInfo IsWindowEnabled DrawFocusRect TranslateMessage IsDialogMessageW GetWindowLongW GetWindowTextW ReleaseDC EnableMenuItem GetDlgItem SetWindowLongW DestroyCursor GetSysColor SetWindowPos GetCursorPos ShowWindow CreateDialogParamW CreateWindowExW MessageBoxW SendMessageW MapWindowPoints UpdateWindow EnableWindow GetDlgCtrlID SetWindowTextW DestroyIcon CallWindowProcW

gdi32

PatBlt SetTextColor GetBkMode CreateFontIndirectW GetDeviceCaps GetDIBits SetBkColor SetBkMode DeleteObject SelectObject CreateCompatibleDC CombineRgn CreateBrushIndirect GetBkColor GetObjectW CreateRectRgn GetTextColor CreateSolidBrush

comdlg32

CommDlgExtendedError ChooseColorW GetSaveFileNameW GetOpenFileNameW ChooseFontW

shell32

SHGetDesktopFolder SHBrowseForFolderW ExtractIconExW SHGetPathFromIDListW ShellExecuteW

ole32

CreateStreamOnHGlobal

oleaut32

OleLoadPicture

$PLUGINSDIR/MINIMAL.bmp

SHA256 65754b587a6bc8e2b415f93f03997311577394558020798fe63fed2d505a953d
MD5 6444555530eefc9ddcf6ead1b8e2029e
SHA1 c33053aa24823d7e8ce98dc6c2cdbabef30b32ad
SHA512 410c1446f6f4aa179f9e29b0090b4d98f58792ffee5ac1859657a2dd7c58b688174ca9a2d31ac6b579057d4bdf6b9babd02780a0e6cc0b1fd21df2f24a36daef
TLSH
T171510C973A8546E8F55A78E4088F2D5E325E3FBF118433056183CF1A7CF024974676A9
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/SetupType.ini

SHA256 52e145c097512960c4ded3213bc4673066d2e0b6f50afd3c6136ea03bc1b40e4
MD5 ca15d99093b7bb8562cffc4d15d888dd
SHA1 1e49704aa28b02daf0d5819b6c39f071e52bbefe
SHA512 757d2ba9c5a701bcf7ba452fff77fe2836e515d5db846206f5a6ab6a27e3b28fc050ad9ef384947aa1de0ef4813d2eed0965c35583bf4582f09f9a5e6bf24ce2
TLSH
T1D421928CD401536988B0D59628BB3DA633E02E209B0529D8F6A45883DBDDCE28DFCA85
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 6003514d0104bf7f406a451fc7872c9adff0045073318c2aee60d66ec064b97b
MD5 c98eb8ff445544fd614c7c276f819be7
SHA1 5997fc36ce64bef7abe7a9dd8e554fc473f93bed
SHA512 3930769574afbe26faa7738438b89626033c6c23e883c3186909e3cf94c575eafc34f8876a1166089c466450d9bc684e6c8425c84cb3ff0f838d9947c087ab98
TLSH
T138C04C8850169269843084A618AA7B9173F03B201B1739E5F6B61897A36CDD648DC6CB
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/nsArray.dll

IMPHASH af03e0dafc67ec37f6adde926d93d334
SHA256 216d68d3f0b37bb2203b3a438a84a089e8c388608f46377ad7e7d6a2709cf9b0
MD5 da4bc09439ed21faf7620a53433aac92
SHA1 94e3347aebe16cb88b9f29f00134d9e0fb67e508
SHA512 920294456e8fee0c4137e4b4ba1389f09ade297d6ed49d78a9593d129dbb5eb048da2cbff7ac29687999991d5f38657cb31af73e2ccf6b8b9ce29480d4d81ec6
SSDEEP 192:LULA8tZt1pehCUVFpZ/XXz5F8qioPYtS/Z8i4NVhWp1h2ph30R:gLAe1peEUD/X1F8qiAFLhOh
TLSH
T14142F8429F9142F2F9F74276B9BD1930292DAD01AB2ABDDB032750582D20DE33E35753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcessW.dll

IMPHASH 439074d1c01f7b16781bdf060930814a
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisXML.dll

IMPHASH 1156b4dd8fa8f1d42696b7a2d5b3e139
SHA256 35e54b12771f671bd8d9677369eb8216b54de0608a07a92ef17a4c29a841935f
MD5 c5285d861243f3b41648af5c0ffd5678
SHA1 50012e20b898e2f1abad27a4bdca12033e618add
SHA512 92c687319e989199e392a81bbd16c00a551c1df9fc3535e98b2da0604424b148a4c379578837aacfa4e204d494c0f0b0ed4f7638cbf7462bc937b4e198631350
SSDEEP 192:3/ufSdX+LHASTxwSODR2bzdA74gB0jpYEfb:3mfSEL9lwpRv50FXj
TLSH
T1D542B5033FB6D9F7C84A1275BF8AA796D6F4630524800C06D3560E1E6F318AAFD7DA19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10865

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/wrtmp/certificate.txt

SHA256 4c36de43aede9c106d04c24d8f2bcbe7e74cb92b42fd88177c6ed932812bf9d9
MD5 e360e7700227921533270fa0ba500cdd
SHA1 ca21c2d3940d5543d4403e8b03a9563c2f375933
SHA512 456c20e23b4fa7a72ee32044d86f581a46fcd5b55c562085fb94dd6a00d823338bda9e313e936f6e5d0898905e3e97b3581532bb601e667cd9054d9913da1d46
TLSH
T150F097787314D9AAEA3D3CE5CC040BA1C709155A83D4E8A0A23D88173997023EF2B3D5
MD5 SHA1 SHA512 TLSH

$TEMP/wrtmp/script.ps1

SHA256 1a569fbaca7103ba08baa6c817826fbb907772bb46c6c836999ca956819269e4
MD5 17444f73a11cd36991f6a7416a0ccc21
SHA1 d9e162bc3df5220403078756b41d49eebf56af57
SHA512 355091a8bf0b77d904944a2d59913941114fe2bc57b64ab97a75224668771b86d879cb580248474edb37102f6132a5bb513c31b2eccb931ea81d5bc20fba533e
TLSH
T13BF04E18DC457D13A95297B8DB1378ED8D4D81FF41825841B0F29A897299531DBFC2CB
MD5 SHA1 SHA512 TLSH

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

WinRAR-723.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/Banner.dll

kernel32

user32

generic

$PLUGINSDIR/BtmImg.bmp

$PLUGINSDIR/Custom.bmp

$PLUGINSDIR/Header.bmp

$PLUGINSDIR/InstallOptionsEx.dll

comctl32

shlwapi

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/MINIMAL.bmp

$PLUGINSDIR/SetupType.ini

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/nsArray.dll

kernel32

user32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

$PLUGINSDIR/nsProcessW.dll

kernel32

user32

generic

$PLUGINSDIR/nsisXML.dll

kernel32

user32

ole32

oleaut32

msvcrt

generic

$TEMP/wrtmp/certificate.txt

$TEMP/wrtmp/script.ps1