81062132368fdcab62f726a233d4b3a6406f4a46b879ffc4d2c843bd4f32d761

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Apr-19 20:38:47
Detected languages English - United States
Comments For additional details, visit PortableApps.com
CompanyName PortableApps.com
FileDescription WinRAR Portable
FileVersion 7.22.99.1
InternalName WinRAR Portable
LegalCopyright 2007-2026 PortableApps.com, PortableApps.com Installer 3.9.18.0
LegalTrademarks PortableApps.com is a registered trademark of Rare Ideas, LLC.
OriginalFilename WinRARPortable_7.23_Dev_Test_2_English_online.paf.exe
PortableApps.comAppID WinRARPortable
PortableApps.comDownloadFileName winrar.exe
PortableApps.comDownloadKnockURL ${DownloadKnockURL}
PortableApps.comDownloadName WinRAR
PortableApps.comDownloadSHA256 f435b24d4c2c5342c4f7c0143ef358f0f425b7b8a0972dd34d9dcf94789e9c4d
PortableApps.comDownloadURL https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-723.exe
PortableApps.comFormatVersion 3.9
PortableApps.comInstallerVersion 3.9.18.0
ProductName WinRAR Portable
ProductVersion 7.22.99.1

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • PortableApps.com
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • https://www.win-rar.com
  • https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-723.exe
  • nsis.sf.net
  • win-rar.com
  • www.win-rar.com
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Can access the registry:
  • RegEnumValueW
  • RegEnumKeyW
  • RegQueryValueExW
  • RegSetValueExW
  • RegCloseKey
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegOpenKeyExW
  • RegCreateKeyExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The file contains overlay data. 1071257 bytes of data starting at offset 0x22400.
The overlay data has an entropy of 7.99983 and is possibly compressed or encrypted.
Overlay data amounts for 88.4207% of the executable.
Suspicious VirusTotal score: 1/70 (Scanned on 2026-07-25 04:40:35) Cylance: Unsafe

Hashes

MD5 56ba0803c9306816f49d5cbda7f9bb69
SHA1 d8d5fcbf58791fe6b8ea7e11fa213419bb5fab6f
SHA256 81062132368fdcab62f726a233d4b3a6406f4a46b879ffc4d2c843bd4f32d761
SHA3 d5ae3cb7debb09906a5e40dbfbbac9840a7421f43025c0a15c857024ffe8630d
SSDeep 24576:s/u9DSQuM0FA/+XHHgC7877u1gkFMrT6yZnAMlWMYi:+u9WLXHDy7u1gmoT6yZA+T7
Imports Hash 46ce5c12b293febbeb513b196aa7f843

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2026-Apr-19 20:38:47
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x6800
SizeOfInitializedData 0x64a00
SizeOfUninitializedData 0x4000
AddressOfEntryPoint 0x0000369F (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x21b000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 858debd82e225a534f8feb00e7256478
SHA1 bc68913d5e0d68fda9c2e5c77516e0dcb5856d85
SHA256 e02103ce4bfc604912f0ddac88d90b14e01ef2856c1642df03c11daead45f5cb
SHA3 b8b5411111e198b1406191a8b144e417feb34879ec187f69e4be1009dd455907
VirtualSize 0x671e
VirtualAddress 0x1000
SizeOfRawData 0x6800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.45352

.rdata

MD5 e913094d8cceaca6b405bbbb52936387
SHA1 20df51227f19cb63323b43e74e506b2d2a09dce8
SHA256 512cb9ab76c260c6f4f8bb183a3e121f54906dcb42a74cded744aa6f6a330a19
SHA3 7f1ef0d8b4b6df73acc9b3d021673ec2f165f8688099c2a999d75994bfd54654
VirtualSize 0x1358
VirtualAddress 0x8000
SizeOfRawData 0x1400
PointerToRawData 0x6c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.0997

.data

MD5 dadf64b11058478b44d099e8a6971167
SHA1 0056a61c89a4b2cec8c3d9e6b2cc96287011f89b
SHA256 da88b74280226f00a1cba6f94f4209be3e4c800dfdf750ee9a48fbc7dad4968d
SHA3 179511ede7136fa3e4177d93a000abfa229f463573eb2c8ecc42e4a745f1fcc7
VirtualSize 0x62378
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x8000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.12196

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x194000
VirtualAddress 0x6d000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 bb6758ac5859f8b2d8d964d5069fbefe
SHA1 e6409c11d0d29c264712f06f8f1f9ffd9699d333
SHA256 76e6ffe498bc2f07e06fe3a0649e35c76fef322c92b940df6e9fb3edc35b79ee
SHA3 0dced98545c0495ec1239e4eb558f6cc6fc62c4d1a3be3e82541fc609dd0ce32
VirtualSize 0x19d30
VirtualAddress 0x201000
SizeOfRawData 0x19e00
PointerToRawData 0x8600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.51004

Imports

ADVAPI32.dll RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
SHELL32.dll SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32.dll CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
COMCTL32.dll ImageList_Destroy
#17
ImageList_AddMasked
ImageList_Create
USER32.dll MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
GDI32.dll GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
KERNEL32.dll RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
WriteFile
GetCurrentProcess
GetModuleFileNameW
GetLastError
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
ExitProcess

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x12524
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98277
Detected Filetype PNG graphic file
MD5 4101e7fe2d262454062666e4e181349a
SHA1 2d11959022789fb890225a7ba4b4eef5b489542d
SHA256 f696534ecddf1e182739c35ef50016755acd89c6ca949aeacac4856ffcdbd54e
SHA3 62f9736f325bef9a57ecd343ed7ca73a4fa9143e3e90e3730e738b9d34256f74

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.1717
MD5 63737315ca446fd473b355e1970e8009
SHA1 bd2f7db66bbc397c4d7ee69c9a610fa49b107b8c
SHA256 1fc1a3b45127ff0484ac08249c3eceabbf884d0ce0ef8cd80d05705ac0756666
SHA3 b429b2a9124b1565ccfba91308b075fa98ef0e1fe42b3660bfe1c6577ba6abbe

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.50995
MD5 685faa93596feb5c0b799bfa837be039
SHA1 7e877915e4754ef2a0318336c6b701b0db8a9a2a
SHA256 212a1a7d4b5ec6033bdcccce850adec537380656dbe8af65189a01d527361446
SHA3 04569d4b6fbd34f8f40d710cd5123bf947945870bef4918fcb9010a3bcceb15c

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.70014
MD5 107ae50f721fca3a6e62b8371d61980c
SHA1 9dfaac4e2869cef0abe24a36edbcc855d6dad0b0
SHA256 b1aa4c4fd6e7892adf1452406f43dfddd90fa5525b7261addde6248663beab63
SHA3 239fd405207f4d9d2e869f74d1c151b17272e8845f18d4ffd7d833935dfc2611

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.6488
MD5 815675708dbbe0433a1376ac2dabe918
SHA1 48ed7e61ea400d5ef9da89609bd8a97bdc7ca797
SHA256 956b11a203a9191e11fb7472a4ffade4f853c80fbc8d7e0f34f6d6df85b724c4
SHA3 c51d40b1d82ceed0a29f03e2ad71cd9b696baaf1e88287d91ca9a4505b1aa190

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.01856
MD5 fdbd3aabee67dde60ca2b8fdfc03a7c6
SHA1 b893a80633e819ae28735dd39f025e726883c778
SHA256 523c147c0e633457f59ae45b8c3e85a674cbcf3cf0da669f6222b3cfec610b92
SHA3 3eeb0cb927f0efec1d0e3136484af6b7f6cbaa9e0d73b6baf79fe354dad4d7d0

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.66656
MD5 8aadc46c7cc360971241f917e1796326
SHA1 ea1db188814d5ff48e15908cef869107ed418222
SHA256 985d40950544c9018c46ab08afcb6464c5611ecdebee670a031cc4f9dfdeb993
SHA3 0919a4105b4ddbe7e01096ec8c94ec2c9a6e25ae1e85e9847cae2e730d4d7d3a

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.83657
MD5 20320b265fc9f3ab1751959cdb6db838
SHA1 a7083db2709454eef63fad58cab5d1896b8b37bb
SHA256 4d72060b6d82cb1e2c79117d972cb383cd87b3083b2baadb0c9abb65a03ae0d3
SHA3 4c5bf064691afdc3128dd4d4d0ad6c25375bc8970d06a8980d49633ae317abc0

102

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71813
MD5 a69caf66f3f899403f8b25b02dc61908
SHA1 3e5db9186cf0f75be24676462d88170e5950d9c8
SHA256 7854e8d67a11148566ad37c5d23e1534e0990fe31a160e0e7da3ca751830bb50
SHA3 1eea945e3712b317143e07560f54b0b9a13b1fd6c2b57cab9176181a9aaf4f79

103

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.56193
MD5 db6dd0434da4d7cac564518725167e09
SHA1 a65a1367d7cd96450f089a8f8108239bbcea9f5b
SHA256 c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016
SHA3 4e3be5455c51e1cb04836e318cb69ecdffd2deadd0f338d4bc985d8f5ca653ff

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x200
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.68372
MD5 583fb02149a19ffff54516cfd5edebd4
SHA1 9de29568e142e36811e4fc5130e60fdb78f3db06
SHA256 9dfacbe444e14cd17c5956afa713f043c2b1150d37868af1661b5bb848fee3f5
SHA3 6c2967d2415996675fe0ca406c7a3ab94fe6cfd18bf7b98cf11f20c314b3fc81

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91148
MD5 fa83652660409e90e0db9731ad2adb17
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc
SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4
SHA3 5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92767
MD5 1db3e4c32b9560257ddf3506fef9dd3f
SHA1 6666e0c8336456cfacec71d84415c6516e9e2673
SHA256 587a03198c39f990e77691056bb5705e21374281862ce06de94c68172f50f763
SHA3 30ca0affc3f1d2ef8b37f2103db7581caaf88548823fb3ae1d308fae9738dab4

103 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x76
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.80233
Detected Filetype Icon file
MD5 077bed48717c2f4c117c2938bfbabb0d
SHA1 57ac464d3ce37990dbc0562716ef30cbe94ca561
SHA256 e7f6ce7b7396ec12bb35f1bf818a988d4613ba8dc15a2f658e0861af8c84b4f8
SHA3 a5aa4a8308c01dd559a8dd792cf4b684f3d1a82aa420e13c4a5119341b3894fa

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x868
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.55166
MD5 fdb835880ee84b3f6b21375806d5b162
SHA1 5bfb4a59b57fed3b9e64b26fac130ff3a1ac1a3c
SHA256 9fb3f300c04dac35a7a63ff64fd3bda6a557365bfead4e8ed085834a8b63a569
SHA3 1df29583ccae3f9cf72b0ad38a74b70182f74d191a175df90aeeaf491ae18771

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x4e1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28689
MD5 b9238b2edbbc79559759d5041b66fbf4
SHA1 0738e9630e4a96f4f8f084249d34bda57627310d
SHA256 0c4fbacc4e988c404c7c8d925676b0bf1a0abdf5786c12f70437beb25e3da9be
SHA3 566a9e8a170ed7568c1868627875b558e7b19d5d72926219190d073777a21b59

Version Info

Signature 0xfeef04bd
StructVersion 0
FileVersion 7.22.99.1
ProductVersion 7.22.99.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
Comments For additional details, visit PortableApps.com
CompanyName PortableApps.com
FileDescription WinRAR Portable
FileVersion (#2) 7.22.99.1
InternalName WinRAR Portable
LegalCopyright 2007-2026 PortableApps.com, PortableApps.com Installer 3.9.18.0
LegalTrademarks PortableApps.com is a registered trademark of Rare Ideas, LLC.
OriginalFilename WinRARPortable_7.23_Dev_Test_2_English_online.paf.exe
PortableApps.comAppID WinRARPortable
PortableApps.comDownloadFileName winrar.exe
PortableApps.comDownloadKnockURL ${DownloadKnockURL}
PortableApps.comDownloadName WinRAR
PortableApps.comDownloadSHA256 f435b24d4c2c5342c4f7c0143ef358f0f425b7b8a0972dd34d9dcf94789e9c4d
PortableApps.comDownloadURL https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-723.exe
PortableApps.comFormatVersion 3.9
PortableApps.comInstallerVersion 3.9.18.0
ProductName WinRAR Portable
ProductVersion (#2) 7.22.99.1
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd24e50e9
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 163
Imports (VS2003 (.NET) build 4035) 15
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!
Leave a comment

No comments yet.