home

winrar-x64-531es.exe

win.rar GmbH

This is a setup program which is used to install the application. The file has been seen being downloaded from www.winrar.es and multiple other hosts.
Publisher:
win.rar GmbH  (signed and verified)

MD5:
c13f9df51b3c437450e50031586631ca

SHA-1:
70977a01b0a3a914a558dda7d14b0c06b3cd62c1

SHA-256:
d1f1be15620534f7829fee51d76c95229e1d2227b4152dfcf9ca4f72afe1d1ca

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
12/25/2024 1:20:46 PM UTC  (today)

Scan engine
Detection
Engine version

F-Prot
W32/Heye.A (exact, not disinfectable)
4.6.5.141

File size:
2 MB (2,090,888 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\winrar-x64-531es.exe

Digital Signature
Signed by:
win.rar GmbH

Authority:
COMODO CA Limited

Valid from:
5/31/2015 7:00:00 PM

Valid to:
5/31/2017 6:59:59 PM

Subject:
CN=win.rar GmbH, O=win.rar GmbH, STREET=Marienstrasse 12, L=Berlin, S=Berlin, PostalCode=10117, C=DE

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00FE46A10AD94269C3DD225C13645352E4

File PE Metadata
Compilation timestamp:
2/3/2016 1:38:39 PM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
49152:gFtyaO4LCCVWAyYsyTxBjEf/q9rtrDcBQW03WLOf5GY0CXg2vhSE:mtysVTz24D9BRGY0CXg25SE

Entry address:
0x23398

Entry point:
48, 83, EC, 28, E8, E7, 67, 00, 00, 48, 83, C4, 28, E9, 12, FE, FF, FF, CC, CC, 48, 89, 5C, 24, 08, 48, 89, 6C, 24, 10, 48, 89, 74, 24, 18, 57, 48, 83, EC, 20, 49, 8B, E8, 48, 8B, F2, 48, 8B, D9, 48, 85, C9, 75, 05, E8, 81, 1A, 00, 00, 48, 63, 43, 18, 8B, 7B, 14, 48, 03, 46, 08, 75, 05, E8, 6F, 1A, 00, 00, 33, C9, 85, FF, 74, 33, 4C, 8B, 4E, 08, 4C, 63, 43, 18, 4B, 8D, 14, 01, 48, 63, 02, 49, 03, C1, 48, 3B, E8, 7C, 0A, FF, C1, 48, 83, C2, 08, 3B, CF, 72, EB, 85, C9, 74, 0E, 8D, 41, FF, 49, 8D, 14, C0, 42...
 
[+]

Entropy:
7.9291  (probably packed)

Code size:
191 KB (195,584 bytes)

The file winrar-x64-531es.exe has been seen being distributed by the following 50 URLs.

https://www.winrar.es/.../103?PHPSESSID=46f54e78f470fc87f2186fa165fc79c4

https://www.winrar.es/.../103?PHPSESSID=9dc943ae85f2f092a2694e45381cba6a

https://www.winrar.es/.../103?PHPSESSID=3bedc94c34df75a107d7d946b129d60e

https://www.winrar.es/.../103?PHPSESSID=b0bcce5ec27d8dfd8aeb0dd6a7356730

https://www.winrar.es/.../103?PHPSESSID=a788c2df5dd415d77a90643a1f584c40

http://d.winrar.es/d/103z1467757260/.../winrar-x64-531es.exe

https://www.winrar.es/.../103?PHPSESSID=84775586a3d3264b93d7db74c502a585

http://www.winrar.es/.../103?PHPSESSID=b50a67a08c45e82f8669a70001b370c3

http://d.winrar.es/d/103z1467322142/.../winrar-x64-531es.exe

https://www.winrar.es/.../103?PHPSESSID=315b4b342ecd45a66bf6f593f8cdc767

http://d.winrar.es/d/103z1458417732/.../winrar-x64-531es.exe

http://www.winrar.es/.../103?PHPSESSID=669f33931a8af82997e67ca83132ef8a

https://www.winrar.es/.../103?PHPSESSID=1913f4cdd8e9f2b0bc62b48ef35be455

https://www.winrar.es/.../103?PHPSESSID=a9c5acdb1b18bb9d349f5cc284279bf0

https://www.winrar.es/.../103?PHPSESSID=95adb7a01e567d78ba29edf45a85fb92

https://www.winrar.es/.../103?PHPSESSID=b0a181c552e89deb712fee9f59649123

https://www.winrar.es/.../103?PHPSESSID=60b6fc60d86fefe3c7c975d2e0d0c2bb

http://download1856.mediafire.com/3rngod09hsyg/.../Winrar 5.31 x64.exe

https://www.winrar.es/.../103?PHPSESSID=8b3130f54fffbad357e511335df10ce2

https://www.winrar.es/.../103?PHPSESSID=f24636a5e1399c1f853a1f2308e8fcdc

https://docs.google.com/a/.../uc?authuser=0&id=0B0gOHaCLghMWMHVqbkI1Zno4WVE&export=download

https://www.winrar.es/.../103?PHPSESSID=21b2878d46e79e5314065fb02e43d469

https://www.winrar.es/.../103?PHPSESSID=01a7da6c1faf40ed4d29ddef42dce9e7

https://www.winrar.es/.../103?PHPSESSID=c3c9b69d6af1c3079887cac8a808f2c5

http://winrar.es/.../103?PHPSESSID=6a756f8702290cf942fbf2022d682040

https://www.winrar.es/.../103?PHPSESSID=c67e432b820c46d0e4e9189d94451945

http://d.winrar.es/d/103z1463839117/.../winrar-x64-531es.exe

http://d.winrar.es/d/103z1459569454/.../winrar-x64-531es.exe

https://www.winrar.es/.../103?PHPSESSID=9ca4e401b77d38a2bbf347b2b256a0b4

http://d.winrar.es/d/103z1458948321/.../winrar-x64-531es.exe

Latest 30 of 2,328 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.