File name:

Advanced Rar Repair.exe

Full analysis: https://app.any.run/tasks/45c1f27b-31cb-4ccb-9f1f-88d541a052a7
Verdict: Malicious activity
Analysis date: June 04, 2018, 22:57:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

DB9D4FD30E586AA00833CFB393E06A74

SHA1:

2704641E92C00AFA5E8AE06D57361B5BC317BA95

SHA256:

31B08D1F10D48863A2809D3BF5825618FFE30FF56800EA2318101818CED9170F

SSDEEP:

12288:xtoJaSfasxYdaI6PnRtouwuLDdrD9IEnT+ZQa6OUnf7ZrvZuR1s5gTztmGA:xuapsAUf7FdrD9ZnqZNuf7NI1s5YBA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • Advanced Rar Repair.exe (PID: 4028)

    • Application was dropped or rewritten from another process

      • GLJB9E9.tmp (PID: 2408)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Advanced Rar Repair.exe (PID: 4028)

    • Removes files from Windows directory

      • Advanced Rar Repair.exe (PID: 4028)

    • Creates files in the Windows directory

      • Advanced Rar Repair.exe (PID: 4028)

    • Starts application with an unusual extension

      • Advanced Rar Repair.exe (PID: 4028)

    • Creates COM task schedule object

      • GLJB9E9.tmp (PID: 2408)

    • Creates files in the program directory

      • Advanced Rar Repair.exe (PID: 4028)

    • Creates a software uninstall entry

      • Advanced Rar Repair.exe (PID: 4028)

  • INFO

    • Dropped object may contain URL's

      • Advanced Rar Repair.exe (PID: 4028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Wise Installer executable (96.9)
.dll | Win32 Dynamic Link Library (generic) (1.3)
.exe | Win32 Executable (generic) (0.9)
.exe | Generic Win/DOS Executable (0.4)
.exe | DOS Executable Generic (0.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2000:04:25 16:37:12+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 8704
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x21af
OSVersion: 4
ImageVersion: 4
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows 16-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: noname
FileDescription: Advanced RAR Repair v1.2 Installation
FileVersion: -
LegalCopyright: noname
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start advanced rar repair.exe gljb9e9.tmp no specs advanced rar repair.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2408"C:\Users\admin\AppData\Local\Temp\GLJB9E9.tmp" C:\Program Files\ARAR\ARARSHL.dllC:\Users\admin\AppData\Local\Temp\GLJB9E9.tmp—Advanced Rar Repair.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\gljb9e9.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2988"C:\Users\admin\AppData\Local\Temp\Advanced Rar Repair.exe" C:\Users\admin\AppData\Local\Temp\Advanced Rar Repair.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\advanced rar repair.exe
c:\systemroot\system32\ntdll.dll
4028"C:\Users\admin\AppData\Local\Temp\Advanced Rar Repair.exe" C:\Users\admin\AppData\Local\Temp\Advanced Rar Repair.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\advanced rar repair.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
186
Read events
162
Write events
24
Delete events
0

Modification events

(PID) Process:(4028) Advanced Rar Repair.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced RAR Repair v1.2
Operation:writeName:DisplayName
Value:
Advanced RAR Repair v1.2
(PID) Process:(4028) Advanced Rar Repair.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced RAR Repair v1.2
Operation:writeName:UninstallString
Value:
C:\PROGRA~1\ARAR\UNWISE.EXE C:\PROGRA~1\ARAR\INSTALL.LOG
(PID) Process:(2408) GLJB9E9.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\7-Zip.rar\shellex\ContextMenuHandlers\ARAR
Operation:writeName:
Value:
{51A64D28-F937-4045-A420-065CEFBD8A76}
(PID) Process:(2408) GLJB9E9.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Operation:writeName:{51A64D28-F937-4045-A420-065CEFBD8A76}
Value:
ARAR Context Menu Shell Extension
(PID) Process:(2408) GLJB9E9.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShellExt.ARARCtxMenu.1
Operation:writeName:
Value:
ARARCtxMenu Class
(PID) Process:(2408) GLJB9E9.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShellExt.ARARCtxMenu.1\CLSID
Operation:writeName:
Value:
{51A64D28-F937-4045-A420-065CEFBD8A76}
(PID) Process:(2408) GLJB9E9.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShellExt.ARARCtxMenu
Operation:writeName:
Value:
ARARCtxMenu Class
(PID) Process:(2408) GLJB9E9.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShellExt.ARARCtxMenu\CLSID
Operation:writeName:
Value:
{51A64D28-F937-4045-A420-065CEFBD8A76}
(PID) Process:(2408) GLJB9E9.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShellExt.ARARCtxMenu\CurVer
Operation:writeName:
Value:
ShellExt.ARARCtxMenu.1
(PID) Process:(2408) GLJB9E9.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51A64D28-F937-4045-A420-065CEFBD8A76}
Operation:writeName:
Value:
ARARCtxMenu Class
Executable files
8
Suspicious files
0
Text files
5
Unknown types
6

Dropped files

PID
Process
Filename
Type
4028Advanced Rar Repair.exeC:\Users\admin\AppData\Local\Temp\~GLH0000.TMP —
MD5:—
SHA256:—
4028Advanced Rar Repair.exeC:\Program Files\ARAR\~GLH0001.TMP —
MD5:—
SHA256:—
4028Advanced Rar Repair.exeC:\Program Files\ARAR\~GLH0002.TMP —
MD5:—
SHA256:—
4028Advanced Rar Repair.exeC:\Program Files\ARAR\~GLH0003.TMP —
MD5:—
SHA256:—
4028Advanced Rar Repair.exeC:\Program Files\ARAR\temp.000 —
MD5:—
SHA256:—
4028Advanced Rar Repair.exeC:\PROGRA~1\ARAR\~GLH0004.TMP —
MD5:—
SHA256:—
4028Advanced Rar Repair.exeC:\Program Files\ARAR\~GLH0005.TMP —
MD5:—
SHA256:—
4028Advanced Rar Repair.exeC:\PROGRA~1\ARAR\~GLH0006.TMP —
MD5:—
SHA256:—
4028Advanced Rar Repair.exeC:\Program Files\ARAR\~GLH0007.TMP —
MD5:—
SHA256:—
4028Advanced Rar Repair.exeC:\Program Files\ARAR\~GLH0008.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Advanced Rar Repair.exe