home

wrar52b1.exe

win.rar GmbH

This is a setup program which is used to install the application. The file has been seen being downloaded from d.baixakifiles2.com and multiple other hosts.
Publisher:
win.rar GmbH  (signed and verified)

MD5:
4531c4a22926314fff24244a5d350356

SHA-1:
12250de463dbc5ef0588a3febbbd369044e0506a

SHA-256:
ab1d3b7980e4606ffa6cba175a2562bd058da8dfe397c4397aa3450ae1dfdd39

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/23/2024 9:39:10 PM UTC  (today)

File size:
1.7 MB (1,766,216 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\wrar52b1.exe

Digital Signature
Signed by:
win.rar GmbH

Authority:
COMODO CA Limited

Valid from:
6/13/2013 5:30:00 AM

Valid to:
6/14/2015 5:29:59 AM

Subject:
CN=win.rar GmbH, O=win.rar GmbH, STREET=Schumannstr. 17, L=Berlin, S=Berlin, PostalCode=10117, C=DE

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
75953FA54DD12DD9CA6B948C17BFD67C

File PE Metadata
Compilation timestamp:
10/6/2014 10:51:25 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
49152:HtsKaYEVgZQ0K4jg6D9x1HU3oUz7UZU9BoAvmvdNw/kip5l:Ns9YE+nK4jg6H1vUz79bvmvd2/fTl

Entry address:
0x1D08B

Entry point:
E8, 66, 64, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 56, 8D, 45, 08, 50, 8B, F1, E8, 7A, FC, FF, FF, C7, 06, 08, B2, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, 08, B2, 42, 00, E9, 2F, FD, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, 08, B2, 42, 00, E8, 1C, FD, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, 86, C9, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08...
 
[+]

Entropy:
7.9526  (probably packed)

Code size:
160.5 KB (164,352 bytes)

The file wrar52b1.exe has been seen being distributed by the following 13 URLs.

http://d.baixakifiles2.com/?ic_user_id=9289&data= rXZAZ7dpk74DG99R02AWvOznMu ty2LYjTA4O2/FNEribNfXFdtgzpYd sD9dmRSlmqJ9QIiOZW/2Bjp6XTwSJE68n8WWEsJaf4JGzqqUWoSNtAKULi9oImXipVBQMl4zCcYF95iPKeLhy5c3iM98XVjwEhqybcXXOtqSvj7ovfhyV1Ti1VHH83iyhT9xlNmvXjx5hyVwQpgYy6TxH3ebUfYAXPVGlew9P7Fgr3 mQx43e0rpftTzmTXi0pidFJJW5BghM1vU0B4COva6GvxegEH6Ij1ooAULCxsTN8eenSN5wrqPIhhHtVZ8WCcVV0MY0P1KlTpth3DYS28Ly Ea057ooSxlEzxwP8XxZdMeR/HxBMSaVHiyMyFd8wrO4zooV3SMuavUrJb/WSjT4MElSj97Bc4bnvPcOd0qhzrpQ3VfgplsfMjUYt YlD4Yw9ccYN9tNRTrUzy0E//5vNHPK0CIfOhF5bDi8PXm9cVZn5/Ae6fbVCTU3oZG4F85cGXkMEC8m emGjcjXEfh7PjSBIpKSTOI3aXxz/eKWjc00VMwDm0U6oq3pH159ZSPFQwO556R/xebFtoWy5rjs5IC4c3IdPA/zKOmMb/iZedr8b6lM/27VdTIk4SvIc6FAcu10PSH6v8v7fuhKWtsYuLuusK9UPkrnWzJplkwWVoowlkoKDW9/QmF7Ae00OjJSFLg0svwN0N5awmFbNPJPPolIXlkgTGRW/ptF2SgZ4fhETnCQ=&key=KbhpyK6xo8NcAi7mJgvFtbLx5/Q0ajWx2ov/udtFIuaMcm1jKEr/3yH7r3mU5MfMNh39qHxaYb8U d84nvaZaWIyiyuMGSg4xy5yv/A0wU/.../l6hCiDH8cc1KQToYVPQL

http://filehippo.com/download/file/.../

http://cdn.holyfiles.com/c?x=LFmO7mlwE//DKArRrqWLzjpPaZHSL3tSV5XVO344QAI=&c=LLEfxElmr6VmJoWGX6GTmi ONY3HkXDpUmbFPFliXxPChc7wT/VckJpj PPNpaFitVlFxyFiBQHVM1SMuAO12w==&fallback_url=http://www.rarlabs.com/.../winrar-x64-52b4.exe

https://mega.nz/temporary/.../JxhmlJ7T

http://cdn.vipbinarylake.com/c?x=AhDTk4c5ZHpaNHwhs9Rd8R6qZytX84ASQjaytam5UKU=&c=28Oj6s9mkQQeTl9VnXwSnFdkhKSS/wxe4KvsFUBaSLUTLYFyDNyp4zHMbgbQmmBf4kladJxcRaYhNmpRo 5AcQ==&fallback_url=http://www.rarlabs.com/.../winrar-x64-52b4.exe&downloadAs=winrar-beta-32-bits.exe

http://filehippo.com/download/file/.../

http://cdn.awesomelettercosmos.com/c?x=zZTWyt4FMl6XMGqDm3hAMWMozv8uS8Ckr nPF9KMRfQ=&c=XbdAsFRYTb/pnEOJbOtmEEZsrw/Qmtc6 8zRB4i6EEQdWpasIgwY 7xc8ZZk6m/p1/P1kXKuGUZVCohLsEecSw==&fallback_url=http://www.rarlabs.com/.../winrar-x64-52b4.exe

http://d.awesomefilestodayandnow.com/c?x=xMmZ2i1K3 OL0Nd3wSayOSUe aGvYZN8EXkdqzr/1QU=&c=YHWToQO1fTBH3rSS65vgLlcmhV5BSTB9 OCFbppZg4lcX0GIyMcpj4XEzL1LDSj6aSQQrN4j69j/n7N6Brm4SQ==&fallback_url=http://www.rarlabs.com/.../winrar-x64-52b4.exe

http://cdn.wellletternexus.com/c?x=Fmk0oXoKoXc8wDa0uFezY9xVLV6Ql8m4VwiMo6XRiZ4=&c=ffcYRJJY3gmskyRyNrj/Nj3OT8edLG CRERuIVUwctaTJwK2KvHQjrsYE/N4dnS6iwmWdk0SAxO2u2fktNeoDg==&fallback_url=http://www.rarlabs.com/.../winrar-x64-52b4.exe

http://cdn.surelauncheruniverse.com/c?x=g t10Q8YbrZN2A 5YlyN5gYKuoYW5gk1/qwRyVds2nE=&c=rhTOnwPRy0nH1uxtF/4DrnLoehELnO417yeG3YRxE4uEoLw5PNrritN4TSU4vu8Fl08leWa1xPZ2VZQ9MW9x2A==&fallback_url=http://www.rarlabs.com/.../winrar-x64-52b4.exe

http://cdn.directpackagesqueue.com/c?x=gwTykiPA1HDpBJv3EB5L0SvCrl1Q5FCfRG4bZZRAwdk=&c=EocSm3y81nP/PxzQtdHT0wZ4l4NNHMkIVq58 rczYUGYkhjChafitFtkvizR1Fv9Oa3AKnWetyV2DtOX6SLQ8S51 /Hm2 OmmgvTamz/Uw7pOC1YKzpDxtpJfiaEn8vT&fallback_url=http://www.rarlabs.com/.../winrar-x64-52b4.exe&downloadAs=winrar-beta-32-bits.exe

http://filehippo.com/download/file/.../

http://www.rarlab.com/.../wrar52b1.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.