| winrar-full.com/go/?https://rarlab.com/rar/winrar-x32-701ru.exe |  188.114.96.1 | 302 Found | 3.7 MB |
URL User Request GET winrar-full.com/go/?https://rarlab.com/rar/winrar-x32-701ru.exe IP188.114.96.1:443
CertificateIssuerGoogle Trust Services Subjectwinrar-full.com FingerprintF6:CE:21:04:18:F3:11:58:C5:83:88:D3:DF:E8:07:7D:E5:15:87:8F ValidityThu, 03 Apr 2025 08:48:10 GMT - Wed, 02 Jul 2025 09:46:23 GMT
Size3.7 MB (3742240 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /go/?https://rarlab.com/rar/winrar-x32-701ru.exe HTTP/1.1
Host: winrar-full.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Sun, 13 Apr 2025 14:44:23 GMT
content-type: text/html; charset=UTF-8
location: https://rarlab.com/rar/winrar-x32-701ru.exe
x-powered-by: PHP/7.4.33
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EjH1KnJeZVv8VevmfVm%2Fp8qZ0Upi6bInPPOBzkXiLnfhHJDzERz68hsZnLUDK3HQy7nc67g%2BJ7WUCz6GxBx5T68jySIV%2BNZ%2Bv3cd2jzYqLlV55sDF%2BIb7M78W%2FXvi3iTWKU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 92fbbdbcfec756bd-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6257&min_rtt=476&rtt_var=11292&sent=10&recv=12&lost=0&retrans=1&sent_bytes=3303&recv_bytes=1209&delivery_rate=7180165&cwnd=252&unsent_bytes=0&cid=f06105bfde62c9b1&ts=127&x=0"
X-Firefox-Spdy: h2
|
| rarlab.com/rar/winrar-x32-701ru.exe |  51.195.68.162 | 301 Moved Permanently | 3.7 MB |
URL User Request GET rarlab.com/rar/winrar-x32-701ru.exe IP51.195.68.162:443
CertificateIssuerLet's Encrypt Subjectrarlab.com Fingerprint71:DA:B0:1E:0E:3C:92:34:FE:67:B2:D6:61:01:52:FB:36:B4:41:2D ValidityMon, 17 Mar 2025 22:04:40 GMT - Sun, 15 Jun 2025 22:04:39 GMT
Size3.7 MB (3742240 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /rar/winrar-x32-701ru.exe HTTP/1.1
Host: rarlab.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
content-length: 0
location: https://www.rarlab.com/rar/winrar-x32-701ru.exe
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none';
X-Firefox-Spdy: h2
|
| www.rarlab.com/rar/winrar-x32-701ru.exe | 51.195.68.162 | 200 OK | 3.7 MB |
URL User Request GET www.rarlab.com/rar/winrar-x32-701ru.exe IP51.195.68.162:443
CertificateIssuerLet's Encrypt Subjectrarlab.com Fingerprint71:DA:B0:1E:0E:3C:92:34:FE:67:B2:D6:61:01:52:FB:36:B4:41:2D ValidityMon, 17 Mar 2025 22:04:40 GMT - Sun, 15 Jun 2025 22:04:39 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows, 6 sections Size3.7 MB (3742240 bytes) Hashcfc0f8772025dce9a5a35eceb79718e3 29dc59950b2ce3d6f645c5252508426109041a39 d3e3df5181b91a3871609458b4581482b3f8f8640860fe9994afde0b7f92d3c3
| Analyzer | Verdict | Alert |
|---|
| YARAhub by abuse.ch | malware | Detects an SFX archive with automatic script execution |
GET /rar/winrar-x32-701ru.exe HTTP/1.1
Host: www.rarlab.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 13 Apr 2025 14:44:23 GMT
server: Apache
last-modified: Thu, 16 May 2024 17:00:15 GMT
etag: "391a20-618952b3ee5c0"
accept-ranges: bytes
content-length: 3742240
content-type: application/octet-stream
x-frame-options: DENY
x-xss-protection: 1;mode=block
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none';
X-Firefox-Spdy: h2
|