winrar[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
winrar.exe
Size 4.1MB
Sample260822-ake9aazcka
SHA256 f657c8e27f06315243e20e1edacfa8458f6653624aa11b2b6af46f3ac385eed6
MD5 a49d9937a039b9562b047e387e7e274c
SHA1 b61786d29f9cb5043b30b31f7ba3658f7d9ab37f
SHA512 d3ca920aacc39846b208bb03828e48599914436ef7f782d592472f21d6d40d92b73b6ce6f125ecb117bccdf8733a4a2b24f8c135f4ca301dc2dcac89bb4c1bee
SSDEEP 98304:YDnImwkiNSHh5YvlEJmtLDgVYJDhzLzlWlpHa/31gb1a9mPGB:4n4kWSP6lvt4VYnLzlGpHggb89m
TLSH
T1BE16334BD96668F2DA23C5366A854E06C632E8DA87119AEF07904BC71E771D0CF3E731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
winrar.exe

File Explorer

winrar.exe

.exe 4.1MB

winrar.exe

IMPHASH 657b3ed86f9d31b44e782579f863fd38
SHA256 f657c8e27f06315243e20e1edacfa8458f6653624aa11b2b6af46f3ac385eed6
MD5 a49d9937a039b9562b047e387e7e274c
SHA1 b61786d29f9cb5043b30b31f7ba3658f7d9ab37f
SHA512 d3ca920aacc39846b208bb03828e48599914436ef7f782d592472f21d6d40d92b73b6ce6f125ecb117bccdf8733a4a2b24f8c135f4ca301dc2dcac89bb4c1bee
SSDEEP 98304:YDnImwkiNSHh5YvlEJmtLDgVYJDhzLzlWlpHa/31gb1a9mPGB:4n4kWSP6lvt4VYnLzlGpHggb89m
TLSH
T1BE16334BD96668F2DA23C5366A854E06C632E8DA87119AEF07904BC71E771D0CF3E731
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d0:e1:84:9c:97:51:ed:6b:53:b1:ce:94:e7:1d:ae:3a:b9:bd:05:0e:1c:ae:d5:b3:24:01:c8:1f:c0:87:c9:ef

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=HRB 109885,CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e436861726c6f7474656e62757267,1.3.6.1.4.1.311.60.2.1.2=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

May 1, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:8b:08:39:9e:c7:03:62:3c:72:cd:20:77:ad:65:d9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2023 - Aug 7, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

16912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptSetProperty BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

kernel32

HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap CreateFileW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW FindClose WriteConsoleW SetStdHandle RtlUnwindEx Sleep VirtualFree LoadLibraryA SetConsoleCtrlHandler VirtualAlloc GetProcAddress CloseHandle GetLastError GetCurrentThreadId WideCharToMultiByte QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType IsValidCodePage GetACP GetOEMCP SetFilePointerEx HeapReAlloc

Name

.text

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

winrar.exe

PE Signature issue

bcrypt

kernel32

generic