home

wrar510es.exe

win.rar GmbH

This is a setup program which is used to install the application. The file has been seen being downloaded from mega.nz and multiple other hosts.
Publisher:
win.rar GmbH  (signed and verified)

MD5:
cbb140061d729870e7d79394eaf409a2

SHA-1:
16e2ae028bd415e7969139e5f27401923d13ffe9

SHA-256:
e289059b7b86988e1d339e93593a6050f10a945d7a44bbd306f82445712b0b53

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/29/2024 12:54:09 AM UTC  (today)

File size:
1.7 MB (1,833,952 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\wrar510es.exe

Digital Signature
Signed by:
win.rar GmbH

Authority:
COMODO CA Limited

Valid from:
6/12/2013 7:00:00 PM

Valid to:
6/13/2015 6:59:59 PM

Subject:
CN=win.rar GmbH, O=win.rar GmbH, STREET=Schumannstr. 17, L=Berlin, S=Berlin, PostalCode=10117, C=DE

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
75953FA54DD12DD9CA6B948C17BFD67C

File PE Metadata
Compilation timestamp:
6/6/2014 6:29:25 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:w2YzdNOq/ibk6aoTk3Br5EOjqtA5MppD+ao7v0nnfzXl1v8nz9RtCNgIiR1jM3Mg:2ObNaSkRr5TdIUyYnzkNfz3Mg

Entry address:
0x1CE7B

Entry point:
E8, 5C, 64, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 56, 8D, 45, 08, 50, 8B, F1, E8, 7A, FC, FF, FF, C7, 06, C8, A1, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, C8, A1, 42, 00, E9, 2F, FD, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, C8, A1, 42, 00, E8, 1C, FD, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, 7A, C9, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08...
 
[+]

Entropy:
7.9511  (probably packed)

Code size:
160 KB (163,840 bytes)

The file wrar510es.exe has been seen being distributed by the following 50 URLs.

https://mega.nz/persistent/.../lMMxFBQR

http://www.winrar.es/.../52?PHPSESSID=92905294081398a0828bf8770b4ba50c

http://www.winrar.es/.../52?PHPSESSID=35a0e9cece61a342f942b73e3b741dbd

http://d.winrar.es/d/52z1407601967/.../wrar510es.exe

http://d.winrar.es/d/52z1409179933/.../wrar510es.exe

http://www.winrar.es/.../52?PHPSESSID=a71d731892815a37342d81da927f7030

http://www.winrar.es/.../52?PHPSESSID=0b8c79fbd5b5040831c01033cb327cfa

http://www.winrar.es/.../52?PHPSESSID=4ea657e29918d808930b38152d9ee4aa

http://d.winrar.es/d/52z1405915369/.../wrar510es.exe

http://www.winrar.es/.../52?PHPSESSID=ef168249ef0edd78ebee82b550d3aad5

http://www.winrar.es/.../52?PHPSESSID=57c35bd8a02eea6e553b37762be1f798

http://www.winrar.es/.../52?PHPSESSID=dab4f5328decfc9dc9aa96f4915c2616

http://d.winrar.es/d/52z1404589907/.../wrar510es.exe

http://www.winrar.es/.../52?PHPSESSID=d0d1e98a10743723244262671c30e195

http://www.winrar.es/.../52?PHPSESSID=df956170d4d898e998a97555e1a7ac66

http://www.winrar.es/.../52?PHPSESSID=3b3608f0043ce465ba613ad3ecd92fc8

http://d.winrar.es/d/52z1404752417/.../wrar510es.exe

http://www.winrar.es/.../52?PHPSESSID=140daad52b191459784e7318a09bcaec

http://d.winrar.es/d/52z1409449300/.../wrar510es.exe

http://d.winrar.es/d/52z1404663147/.../wrar510es.exe

http://d.winrar.es/d/52z1408893996/.../wrar510es.exe

http://www.winrar.es/.../52?PHPSESSID=2629711a2039435adbfa3ce94528a544

http://d.winrar.es/d/52z1407084377/.../wrar510es.exe

http://www.winrar.es/.../52?PHPSESSID=b68fab6dfaebc2eef05221143a4c4cc9

http://www.winrar.es/.../52?PHPSESSID=d9ea75cf9f0cc829a1c2099ec8e17bc3

http://d.winrar.es/d/52z1403725172/.../wrar510es.exe

http://www.winrar.es/.../52?PHPSESSID=da8e36d969f006d8662f1a1fbd05bbf3

http://www.winrar.es/.../52?PHPSESSID=8910c55d61217c258d9eb0ba2a38c914

http://www.winrar.es/.../52?PHPSESSID=8ce75262f09d5566b72ab25bd2cbdbe7

http://www.winrar.es/.../52?PHPSESSID=459c70ae32e348782e13fe3394dd8391

Latest 30 of 128 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.