| www.rarlab.com/rar/winrar-x32-701ru.exe |  51.195.68.162 | 200 OK | 3.7 MB |
URL User Request GET www.rarlab.com/rar/winrar-x32-701ru.exe IP51.195.68.162:443
CertificateIssuerLet's Encrypt Subjectrarlab.com Fingerprint33:1D:98:1E:20:5B:C4:39:3B:C2:C3:DD:8B:C0:52:44:6D:D0:5D:13 ValidityFri, 16 May 2025 21:04:41 GMT - Thu, 14 Aug 2025 21:04:40 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows, 6 sections Size3.7 MB (3742240 bytes) Hashcfc0f8772025dce9a5a35eceb79718e3 29dc59950b2ce3d6f645c5252508426109041a39 d3e3df5181b91a3871609458b4581482b3f8f8640860fe9994afde0b7f92d3c3
| Analyzer | Verdict | Alert |
|---|
| YARAhub by abuse.ch | malware | Detects an SFX archive with automatic script execution |
GET /rar/winrar-x32-701ru.exe HTTP/1.1
Host: www.rarlab.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Jun 2025 07:34:11 GMT
server: Apache
last-modified: Thu, 16 May 2024 17:00:15 GMT
etag: "391a20-618952b3ee5c0"
accept-ranges: bytes
content-length: 3742240
content-type: application/octet-stream
x-frame-options: DENY
x-xss-protection: 1;mode=block
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none';
X-Firefox-Spdy: h2
|
| winrar-fansite.com/go/?https://rarlab.com/rar/winrar-x32-701ru.exe |  185.26.122.73 | 302 Found | 3.7 MB |
URL User Request GET winrar-fansite.com/go/?https://rarlab.com/rar/winrar-x32-701ru.exe IP185.26.122.73:443
CertificateIssuerLet's Encrypt Subject*.winrar-fansite.com FingerprintA4:0F:D5:10:D5:4B:3D:4E:3D:58:48:E1:12:95:3A:43:84:CD:D0:63 ValidityTue, 13 May 2025 01:23:39 GMT - Mon, 11 Aug 2025 01:23:38 GMT
Size3.7 MB (3742240 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /go/?https://rarlab.com/rar/winrar-x32-701ru.exe HTTP/1.1
Host: winrar-fansite.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Sat, 07 Jun 2025 07:34:11 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: https://rarlab.com/rar/winrar-x32-701ru.exe
x-powered-by: PHP/7.4.33
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
|
| rarlab.com/rar/winrar-x32-701ru.exe | 51.195.68.162 | 301 Moved Permanently | 3.7 MB |
URL User Request GET rarlab.com/rar/winrar-x32-701ru.exe IP51.195.68.162:443
CertificateIssuerLet's Encrypt Subjectrarlab.com Fingerprint33:1D:98:1E:20:5B:C4:39:3B:C2:C3:DD:8B:C0:52:44:6D:D0:5D:13 ValidityFri, 16 May 2025 21:04:41 GMT - Thu, 14 Aug 2025 21:04:40 GMT
Size3.7 MB (3742240 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /rar/winrar-x32-701ru.exe HTTP/1.1
Host: rarlab.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
content-length: 0
location: https://www.rarlab.com/rar/winrar-x32-701ru.exe
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none';
X-Firefox-Spdy: h2
|