wrar401cz[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wrar401cz.exe
Size 1.5MB
Sample261012-rwce7sbv5x
SHA256 f5cca54daf39c0d56e57482c0dd48fa5d3bdb21c597e7a0bb079a06cca16dadf
MD5 74bdff99ec629cf477f047edc5d0f43d
SHA1 1de412919afdc0870992c5f5d8a65d1ca9c81d59
SHA512 dc03011653fc3ac5407da65e4b827639d3a6ab91d9891138e903ee927cde6f1ffb0d8bfe48c15dd8ae177aa7fd4970c0ff4e89ffb652224681d941af73f3432b
SSDEEP 24576:DgFamlrlBZsVYKX43wziaYLVCq1H1We9vqM4IawB/qq18A3f/lzd8ob:cHsaI43/Qq1H3xqM43FqLt2M
TLSH
T1017533637A99C4BEE7612330EAD73B13997CEA372AF95042E3601D05783546BA31E713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wrar401cz.exe

File Explorer

wrar401cz.exe

.exe 1.5MB

wrar401cz.exe

IMPHASH aacb28104b01ef056b22124f74917db1
SHA256 f5cca54daf39c0d56e57482c0dd48fa5d3bdb21c597e7a0bb079a06cca16dadf
MD5 74bdff99ec629cf477f047edc5d0f43d
SHA1 1de412919afdc0870992c5f5d8a65d1ca9c81d59
SHA512 dc03011653fc3ac5407da65e4b827639d3a6ab91d9891138e903ee927cde6f1ffb0d8bfe48c15dd8ae177aa7fd4970c0ff4e89ffb652224681d941af73f3432b
SSDEEP 24576:DgFamlrlBZsVYKX43wziaYLVCq1H1We9vqM4IawB/qq18A3f/lzd8ob:cHsaI43/Qq1H3xqM43FqLt2M
TLSH
T1017533637A99C4BEE7612330EAD73B13997CEA372AF95042E3601D05783546BA31E713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39227

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Projects\WinRAR\SFX\setup\build\sfxrar32\Release\sfxrar.pdb

comctl32

InitCommonControlsEx ord17

shlwapi

SHAutoComplete

kernel32

DeleteFileW DeleteFileA CreateDirectoryA CreateDirectoryW FindClose FindNextFileA FindFirstFileA FindNextFileW FindFirstFileW GetTickCount WideCharToMultiByte GlobalAlloc GetVersionExW GetFullPathNameA GetFullPathNameW GetModuleFileNameW FindResourceW GetModuleHandleW HeapAlloc GetProcessHeap HeapFree HeapReAlloc CompareStringA ExitProcess GetLocaleInfoW GetNumberFormatW SetFileAttributesW GetDateFormatW GetTimeFormatW FileTimeToSystemTime FileTimeToLocalFileTime ExpandEnvironmentStringsW WaitForSingleObject Sleep GetTempPathW MoveFileExW UnmapViewOfFile GetCommandLineW MapViewOfFile CreateFileMappingW OpenFileMappingW SetEnvironmentVariableW GetProcAddress LocalFileTimeToFileTime SystemTimeToFileTime GetSystemTime MultiByteToWideChar CompareStringW IsDBCSLeadByte GetCPInfo SetCurrentDirectoryW LoadLibraryW FreeLibrary SetFileAttributesA GetFileAttributesW GetFileAttributesA WriteFile GetStdHandle ReadFile GetCurrentDirectoryW CreateFileW CreateFileA GetFileType SetEndOfFile SetFilePointer MoveFileW SetFileTime CloseHandle SetLastError GetLastError DosDateTimeToFileTime

user32

wvsprintfW ReleaseDC GetDC SendMessageW SetDlgItemTextW SetFocus EndDialog DestroyIcon SendDlgItemMessageW GetDlgItemTextW GetClassNameW DialogBoxParamW IsWindowVisible WaitForInputIdle SetForegroundWindow GetSysColor PostMessageW LoadBitmapW LoadIconW CharToOemA OemToCharA FindWindowExW wvsprintfA GetParent MapWindowPoints CreateWindowExW UpdateWindow SetWindowTextW LoadCursorW RegisterClassExW SetWindowLongW GetWindowLongW DefWindowProcW PeekMessageW GetMessageW TranslateMessage DispatchMessageW DestroyWindow GetClientRect IsWindow CharToOemBuffW MessageBoxW ShowWindow GetDlgItem EnableWindow OemToCharBuffA CharUpperA CharToOemBuffA LoadStringW SetWindowPos GetWindowTextW GetSystemMetrics GetWindow CharUpperW GetWindowRect CopyRect

gdi32

GetDeviceCaps GetObjectW CreateCompatibleBitmap SelectObject StretchBlt CreateCompatibleDC DeleteObject DeleteDC

advapi32

RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegSetValueExW RegCloseKey

shell32

SHChangeNotify ShellExecuteExW SHFileOperationW SHGetFileInfoW SHGetSpecialFolderLocation SHGetMalloc SHBrowseForFolderW SHGetPathFromIDListW

ole32

CreateStreamOnHGlobal OleInitialize CoCreateInstance OleUninitialize CLSIDFromString

oleaut32

VariantInit