home

WinRAR.exe

WinRAR

Alexander Roshal

WinRAR provides the full RAR and ZIP file support, can decompress CAB, GZIP, ACE and other archive formats. This is a setup program which is used to install the application. The file has been seen being downloaded from s10755.chomikuj.pl.
Publisher:
Alexander Roshal

Product:
WinRAR

Description:
Archiwizer WinRAR

Version:
4.20.0

MD5:
0686f152cad912514a849f46ea665f1c

SHA-1:
eb8a9af78357886f945691986a2d5017cd3dba5d

SHA-256:
17e3ed06644bf4ea2093ab700a516f29e81bef7129145100282832bb735adf0a

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/15/2024 3:43:37 PM UTC  (today)

File size:
1.2 MB (1,238,016 bytes)

Product version:
4.20.0

Copyright:
Copyright © Alexander Roshal 1993-2012

Original file name:
WinRAR.exe

File type:
Executable application (Win64 EXE)

Language:
Polish (Poland)

Common path:
C:\Program Files\winrar\winrar.exe

File PE Metadata
Compilation timestamp:
6/9/2012 3:19:20 PM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:FT6ac3rEfDNpy2mtxlJAB9h0nuLS4wkF7mQlbnMMMMMMF:J6ac3rwyZxaauLlEkMMMMMM

Entry address:
0xBA674

Entry point:
48, 83, EC, 28, E8, 93, 99, 00, 00, 48, 83, C4, 28, E9, 12, FE, FF, FF, CC, CC, 48, 8B, C4, 48, 89, 58, 10, 48, 89, 68, 18, 48, 89, 70, 20, 89, 48, 08, 57, 48, 83, EC, 20, 48, 8B, CA, 48, 8B, DA, E8, 62, 6B, 00, 00, 8B, 4B, 18, 48, 63, F0, F6, C1, 82, 75, 17, E8, 5E, 03, 00, 00, C7, 00, 09, 00, 00, 00, 83, 4B, 18, 20, 83, C8, FF, E9, 34, 01, 00, 00, F6, C1, 40, 74, 0D, E8, 42, 03, 00, 00, C7, 00, 22, 00, 00, 00, EB, E2, 33, FF, F6, C1, 01, 74, 19, 89, 7B, 08, F6, C1, 10, 0F, 84, 89, 00, 00, 00, 48, 8B, 43...
 
[+]

Code size:
822 KB (841,728 bytes)

Shell Open Command
Open type:
WinRAR

Command:
"C:\Program Files\winrar\winrar.exe" "%1"


The file WinRAR.exe has been seen being distributed by the following URL.

http://s10755.chomikuj.pl/File.aspx?e=9ZdY0wQ5s-dEfiiTbQwUE0GJwlRfku8fsS2NitWVbCXVSbsJ7m494GoCmTfQ1lGZhZapdzS64tpnS99pNVZsin5s7re5DIGqbbaGiwxgCqXxoFR8x6la8TFuKf13oMNtkrd44A7ridYhvHBzhoWnVQ&pv=2

Scan WinRAR.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.