Edit tour
Windows
Analysis Report
winrar-x64-620b2.exe
Overview
General Information
| Sample name: | winrar-x64-620b2.exe |
| Analysis ID: | 1417804 |
| MD5: | efa2c65ab75028a909740e99763d1acb |
| SHA1: | 688970c4b44da217a4312404303c312d33602b21 |
| SHA256: | 5c07ed55846b6418cdcb02ae6ef96c0448cc2fd457179d6072a051ecb0e15909 |
| Tags: | exe |
| Infos: | |
 | |
Detection
| Score: | 40 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Contains functionality to register a low level keyboard hook
Found direct / indirect Syscall (likely to bypass EDR)
Installs a global event hook (focus changed)
PE file has a writeable .text section
Adds / modifies Windows certificates
Binary contains a suspicious time stamp
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores large binary data to the registry
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Classification
- System is w10x64
winrar-x64-620b2.exe (PID: 6692 cmdline: "C:\Users\ user\Deskt op\winrar- x64-620b2. exe" MD5: EFA2C65AB75028A909740E99763D1ACB) - winrar-x64-620b2.tmp (PID: 4144 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-LCQ TO.tmp\win rar-x64-62 0b2.tmp" / SL5="$2045 6,7896458, 780800,C:\ Users\user \Desktop\w inrar-x64- 620b2.exe" MD5: FD9446F7F5062FF6D90110D83B5814C2) 
setup.exe (PID: 5456 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\is-R6S MS.tmp\set up.exe" MD5: 3287172FF65AD8CDEEC8FDEC30F8D393) 
set_0.exe (PID: 6968 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\nswE17 E.tmp\set_ 0.exe" --s ilent --al lusers=0 MD5: 63BF5E3553D023DA35C365109C3AEDCF) - set_0.exe (PID: 5396 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\nswE17E .tmp\set_0 .exe --typ e=crashpad -handler / prefetch:7 --monitor -self-anno tation=pty pe=crashpa d-handler "--databas e=C:\Users \user\AppD ata\Roamin g\Opera So ftware\Ope ra GX Stab le\Crash R eports" "- -crash-cou nt-file=C: \Users\use r\AppData\ Roaming\Op era Softwa re\Opera G X Stable\c rash_count .txt" --ur l=https:// crashstats -collector .opera.com /collector /submit -- annotation =channel=S table --an notation=p lat=Win32 --annotati on=prod=Op eraDesktop GX --annot ation=ver= 107.0.5045 .79 --init ial-client -data=0x39 8,0x39c,0x 3a0,0x374, 0x3a4,0x6c 3a623c,0x6 c3a6248,0x 6c3a6254 MD5: 63BF5E3553D023DA35C365109C3AEDCF) - set_0.exe (PID: 6504 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\.opera \Opera GX Installer Temp\set_0 .exe" --ve rsion MD5: 63BF5E3553D023DA35C365109C3AEDCF) - set_0.exe (PID: 3568 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\nswE17 E.tmp\set_ 0.exe" --b ackend --i nstall --i mport-brow ser-data=0 --enable- stats=1 -- enable-ins taller-sta ts=1 --con sent-given =0 --gener al-interes ts=0 --gen eral-locat ion=0 --pe rsonalized -content=0 --persona lized-ads= 0 --launch opera=1 -- installfol der="C:\Us ers\user\A ppData\Loc al\Program s\Opera GX " --profil e-folder - -language= en-GB --si ngleprofil e=0 --copy only=0 --a llusers=0 --setdefau ltbrowser= 1 --pintot askbar=1 - -pintostar tmenu=1 -- run-at-sta rtup=1 --s erver-trac king-data= server_tra cking_data --initial -pid=6968 --package- dir-prefix ="C:\Users \user\AppD ata\Local\ Temp\.oper a\Opera GX Installer Temp\oper a_package_ 2024033017 3821" --se ssion-guid =a10f841a- b084-4b1c- a270-94715 96263d2 -- server-tra cking-blob =MzQwYjFlY 2Q3YzUwMzl jOWRhMzc4Z WY2NDVlZTk xNGE5MzY0O DhiMmM5YmF iMDE5ZTk1N 2JhOTU2NTJ hM2RiNzp7I mNvdW50cnk iOiJVUyIsI mVkaXRpb24 iOiJzdGQtM SIsImluc3R hbGxlcl9uY W1lIjoiT3B lcmFHWFNld HVwLmV4ZSI sInByb2R1Y 3QiOnsibmF tZSI6Im9wZ XJhX2d4In0 sInF1ZXJ5I joiL29wZXJ hX2d4L3N0Y WJsZS9lZGl 0aW9uL3N0Z C0xP3V0bV9 zb3VyY2U9U FdOZ2FtZXM mdXRtX21lZ Gl1bT1wYSZ 1dG1fY2Ftc GFpZ249UFd OX1VTX1BCM 19ERF8zNjY xJnV0bV9pZ D1hOTUzMmN lZWRiYTc0N zJhODlhNzN hZGI3MDI3Z GI4NSZ1dG1 fY29udGVud D0zNjYxXzI zNTMiLCJze XN0ZW0iOns icGxhdGZvc m0iOnsiYXJ jaCI6Ing4N l82NCIsIm9 wc3lzIjoiV 2luZG93cyI sIm9wc3lzL XZlcnNpb24 iOiIxMCIsI nBhY2thZ2U iOiJFWEUif X0sInRpbWV zdGFtcCI6I jE3MTE4MTY 2OTkuOTMyN iIsInVzZXJ hZ2VudCI6I klubm9Eb3d ubG9hZFBsd Wdpbi8xLjU iLCJ1dG0iO nsiY2FtcGF pZ24iOiJQV 05fVVNfUEI zX0REXzM2N jEiLCJjb25 0ZW50IjoiM zY2MV8yMzU zIiwiaWQiO iJhOTUzMmN lZWRiYTc0N zJhODlhNzN hZGI3MDI3Z GI4NSIsIm1 lZGl1bSI6I nBhIiwic29 1cmNlIjoiU FdOZ2FtZXM ifSwidXVpZ CI6IjFiNjA 5MDQ5LTIxN 2QtNDVkMy0 4ODZiLTM3N 2E2MTY5YWJ iZCJ9 --si lent --des ktopshortc ut=1 --wai t-for-pack age --init ial-proc-h andle=0406 0000000000 00 MD5: 63BF5E3553D023DA35C365109C3AEDCF) - set_0.exe (PID: 5280 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\nswE17E .tmp\set_0 .exe --typ e=crashpad -handler / prefetch:7 --monitor -self-anno tation=pty pe=crashpa d-handler "--databas e=C:\Users \user\AppD ata\Roamin g\Opera So ftware\Ope ra GX Stab le\Crash R eports" "- -crash-cou nt-file=C: \Users\use r\AppData\ Roaming\Op era Softwa re\Opera G X Stable\c rash_count .txt" --ur l=https:// crashstats -collector .opera.com /collector /submit -- annotation =channel=S table --an notation=p lat=Win32 --annotati on=prod=Op eraDesktop GX --annot ation=ver= 107.0.5045 .79 --init ial-client -data=0x38 8,0x38c,0x 390,0x364, 0x394,0x6b 74623c,0x6 b746248,0x 6b746254 MD5: 63BF5E3553D023DA35C365109C3AEDCF) - installer.exe (PID: 5676 cmdline:
"C:\Users\ user\AppDa ta\Local\P rograms\Op era GX\107 .0.5045.79 \installer .exe" --ba ckend --in itial-pid= 6968 --ins tall --imp ort-browse r-data=0 - -enable-st ats=1 --en able-insta ller-stats =1 --conse nt-given=0 --general -interests =0 --gener al-locatio n=0 --pers onalized-c ontent=0 - -personali zed-ads=0 --launchop era=1 --in stallfolde r="C:\User s\user\App Data\Local \Programs\ Opera GX" --profile- folder --l anguage=en -GB --sing leprofile= 0 --copyon ly=0 --all users=0 -- setdefault browser=1 --pintotas kbar=1 --p intostartm enu=1 --ru n-at-start up=1 --ser ver-tracki ng-data=se rver_track ing_data - -package-d ir="C:\Use rs\user\Ap pData\Loca l\Temp\.op era\Opera GX Install er Temp\op era_packag e_20240330 1738211" - -session-g uid=a10f84 1a-b084-4b 1c-a270-94 71596263d2 --server- tracking-b lob=MzQwYj FlY2Q3YzUw MzljOWRhMz c4ZWY2NDVl ZTkxNGE5Mz Y0ODhiMmM5 YmFiMDE5ZT k1N2JhOTU2 NTJhM2RiNz p7ImNvdW50 cnkiOiJVUy IsImVkaXRp b24iOiJzdG QtMSIsImlu c3RhbGxlcl 9uYW1lIjoi T3BlcmFHWF NldHVwLmV4 ZSIsInByb2 R1Y3QiOnsi bmFtZSI6Im 9wZXJhX2d4 In0sInF1ZX J5IjoiL29w ZXJhX2d4L3 N0YWJsZS9l ZGl0aW9uL3 N0ZC0xP3V0 bV9zb3VyY2 U9UFdOZ2Ft ZXMmdXRtX2 1lZGl1bT1w YSZ1dG1fY2 FtcGFpZ249 UFdOX1VTX1 BCM19ERF8z NjYxJnV0bV 9pZD1hOTUz MmNlZWRiYT c0NzJhODlh NzNhZGI3MD I3ZGI4NSZ1 dG1fY29udG VudD0zNjYx XzIzNTMiLC JzeXN0ZW0i OnsicGxhdG Zvcm0iOnsi YXJjaCI6In g4Nl82NCIs Im9wc3lzIj oiV2luZG93 cyIsIm9wc3 lzLXZlcnNp b24iOiIxMC IsInBhY2th Z2UiOiJFWE UifX0sInRp bWVzdGFtcC I6IjE3MTE4 MTY2OTkuOT MyNiIsInVz ZXJhZ2VudC I6Iklubm9E b3dubG9hZF BsdWdpbi8x LjUiLCJ1dG 0iOnsiY2Ft cGFpZ24iOi JQV05fVVNf UEIzX0REXz M2NjEiLCJj b250ZW50Ij oiMzY2MV8y MzUzIiwiaW QiOiJhOTUz MmNlZWRiYT c0NzJhODlh NzNhZGI3MD I3ZGI4NSIs Im1lZGl1bS I6InBhIiwi c291cmNlIj oiUFdOZ2Ft ZXMifSwidX VpZCI6IjFi NjA5MDQ5LT IxN2QtNDVk My04ODZiLT M3N2E2MTY5 YWJiZCJ9 - -silent -- desktopsho rtcut=1 -- install-su bfolder=10 7.0.5045.7 9 MD5: 21AD4599ABD2E158DB5128F32D3CC4EE) - installer.exe (PID: 2764 cmdline:
"C:\Users\ user\AppDa ta\Local\P rograms\Op era GX\107 .0.5045.79 \installer .exe" --ty pe=crashpa d-handler /prefetch: 7 --monito r-self-ann otation=pt ype=crashp ad-handler "--databa se=C:\User s\user\App Data\Roami ng\Opera S oftware\Op era GX Sta ble\Crash Reports" " --crash-co unt-file=C :\Users\us er\AppData \Roaming\O pera Softw are\Opera GX Stable\ crash_coun t.txt" --u rl=https:/ /crashstat s-collecto r.opera.co m/collecto r/submit - -annotatio n=channel= Stable --a nnotation= plat=Win64 --annotat ion=prod=O peraDeskto pGX --anno tation=ver =107.0.504 5.79 --ini tial-clien t-data=0x2 c4,0x2c8,0 x2cc,0x29c ,0x2d0,0x7 ff8a8dad18 0,0x7ff8a8 dad18c,0x7 ff8a8dad19 8 MD5: 21AD4599ABD2E158DB5128F32D3CC4EE) 
explorer.exe (PID: 1028 cmdline: C:\Windows \Explorer. EXE MD5: 662F4F92FDE3557E86D110526BB578D5) 
zRLeaVuwHZUsAJ.exe (PID: 5880 cmdline: "C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 5840 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 3496 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 5628 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 6428 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 7140 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 6128 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 984 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 5988 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 1352 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 3176 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 6648 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 5428 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 6512 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 5488 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 1472 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 384 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 5440 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 4068 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 6688 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - zRLeaVuwHZUsAJ.exe (PID: 3136 cmdline:
"C:\Progra m Files (x 86)\nZAKxS qmPHiPhLDT QLuRLezesj zXVhvCmWJd KwnqhWK\zR LeaVuwHZUs AJ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) 
Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 3144 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\.opera \Opera GX Installer Temp\opera _package_2 0240330173 8211\assis tant\Opera _GX_assist ant_73.0.3 856.382_Se tup.exe_sf x.exe" MD5: E9A2209B61F4BE34F25069A6E54AFFEA) - assistant_installer.exe (PID: 6612 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\.opera \Opera GX Installer Temp\opera _package_2 0240330173 8211\assis tant\assis tant_insta ller.exe" --version MD5: 4C8FBED0044DA34AD25F781C3D117A66) - assistant_installer.exe (PID: 6304 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\.opera \Opera GX Installer Temp\opera _package_2 0240330173 8211\assis tant\assis tant_insta ller.exe" --type=cra shpad-hand ler /prefe tch:7 --mo nitor-self -annotatio n=ptype=cr ashpad-han dler "--da tabase=C:\ Users\user \AppData\R oaming\Ope ra Softwar e\Opera GX Stable\Cr ash Report s" "--cras h-count-fi le=C:\User s\user\App Data\Roami ng\Opera S oftware\Op era GX Sta ble\crash_ count.txt" --url=htt ps://crash stats-coll ector.oper a.com/coll ector/subm it --annot ation=chan nel=Stable --annotat ion=plat=W in32 --ann otation=pr od=OperaDe sktopGX -- annotation =ver=73.0. 3856.382 - -initial-c lient-data =0x334,0x3 38,0x33c,0 x310,0x340 ,0x9f4f48, 0x9f4f58,0 x9f4f64 MD5: 4C8FBED0044DA34AD25F781C3D117A66)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Avira URL Cloud: | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Binary or memory string: | memstr_cf79b236-6 | |
| Source: | Static PE information: | ||
| Source: | Window detected: | ||