» winrar-x64-531br.exe
Overview
Analysis
File Details
Downloads (13)

winrar-x64-531br.exe

win.rar GmbH

This is a setup program which is used to install the application. The file has been seen being downloaded from dc743.4shared.com and multiple other hosts.

File name:

Publisher:

win.rar GmbH (signed and verified)

MD5:

407b9087b995a16ec1d6282310b5a272

SHA-1:

6c4d24fc4a89abc151c3de82d9afc42aa496aae5

SHA-256:

a14ac213805fa3b2e81d4aa13a0d4b1127ffbe13bd511a83e202bcdec6fa50ee

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

12/24/2024 12:36:57 PM UTC (today)

File size:

3.4 MB (3,524,856 bytes)

File type:

Executable application (Win64 EXE)

Common path:

C:\users\{user}\downloads\winrar-x64-531br.exe

Digital Signature

Signed by:

win.rar GmbH

Authority:

COMODO CA Limited

Valid from:

5/31/2015 9:00:00 PM

Valid to:

5/31/2017 8:59:59 PM

Subject:

CN=win.rar GmbH, O=win.rar GmbH, STREET=Marienstrasse 12, L=Berlin, S=Berlin, PostalCode=10117, C=DE

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00FE46A10AD94269C3DD225C13645352E4

File PE Metadata

Compilation timestamp:

11/18/2015 7:15:34 AM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

98304:V6xMNIavJJrIJHMUHWUVmIgAuIncQP584i:QxMNI8JJkZPHZJ9uIQ4i

Entry address:

0x2218C

Entry point:

48, 83, EC, 28, E8, 2F, 65, 00, 00, 48, 83, C4, 28, E9, 12, FE, FF, FF, CC, CC, 48, 89, 5C, 24, 08, 48, 89, 6C, 24, 10, 48, 89, 74, 24, 18, 57, 48, 83, EC, 20, 49, 8B, E8, 48, 8B, F2, 48, 8B, D9, 48, 85, C9, 75, 05, E8, 81, 1A, 00, 00, 48, 63, 43, 18, 8B, 7B, 14, 48, 03, 46, 08, 75, 05, E8, 6F, 1A, 00, 00, 33, C9, 85, FF, 74, 33, 4C, 8B, 4E, 08, 4C, 63, 43, 18, 4B, 8D, 14, 01, 48, 63, 02, 49, 03, C1, 48, 3B, E8, 7C, 0A, FF, C1, 48, 83, C2, 08, 3B, CF, 72, EB, 85, C9, 74, 0E, 8D, 41, FF, 49, 8D, 14, C0, 42... 
[+]

Code size:

186.5 KB (190,976 bytes)

The file winrar-x64-531br.exe has been seen being distributed by the following 13 URLs.

http://dc743.4shared.com/download/.../winrar-x64-531br.exe

http://www.rarlabs.com/.../winrar-x64-531br.exe

http://r.srvtrck.com/v1/redirect?url=http://www.rarlab.com/rar/winrar-x64-531br.exe&type=url&abtag=abp:true&ykuid=wlbubltifocg7moahucanviase&api_key=16e165d0af692eca1d60e39e611cc204&site_id=81921f7724354b2e994711588ced4abf&tid=87b7aab2-b155-4b40-a95b-55d99da02061&dch=gaia&tna=gaia&tv=0.97&title=WinRAR download - Baixaki&refr=http://www.baixaki.com.br/download/winrar.htm&page=http://www.baixaki.com.br/.../dwnld2657.htm&afsrc=1&cache=HVMUG9F9AGHS1JERR9JGI05N9QAVJ52E&vid=2&ad_k=Baixar a versão 64 Bits&ad_t=advertiser&ad_zi=YieldLink&ad_dt=link

http://l.facebook.com/l.php?u=http://www.rarlab.com/.../winrar-x64-531br.exe&h=ZAQGESH3b

http://www.ranchsendgift.com/Pg3DqVt5Je HOb9HWrPLSjlpqggFWHhIIsJnnl BlAovXqnm3lKEv8 KUBzM2UAS4Xuo5hWDBTIMkIMDV7SVgo_OgX3SoAH3JbfbuyFKc1dyyAD a7CM8NbuB6ufEM3ObdafWIpd1y8d32ykeJo_VV5lAVgy3v GTMJA0MI28MPhItFEdFSilW3GI5BK BEHJQDFspssOyxmJJZ FKk48_AE4pFD0w==-GyYAAATqZLExMzG8TZOuABM5YK4tpIPYO9g4UDc2_iBWbQPHD1EZjc0P

https://mega.nz/temporary/.../kooiyIaR

http://winrar-64bits.softonic.com.br/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxANvBD2FYrkBUc1ARGAqgf1AeUYzNtjRLX8B/.../ n0m0rE2OPDCdKamJVRXSbxPgq zzMw7G1KxG2LlArOAQ7l028DA==

http://rarlab.com/.../winrar-x64-531br.exe

http://www.win-rar.com/fileadmin/winrar-versions/.../winrar-x64-531br.exe

http://rarlabs.com/.../winrar-x64-531br.exe

temp:winrar-x64-531br.exe

http://www.win-rar.com/fileadmin/.../winrar-x64-531br.exe

http://www.rarlab.com/.../winrar-x64-531br.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.