File scan report
Verdict Safe
Is Win
The verified win.rar GmbH signature, zero detections across 75 engines, clean sandbox result, and matching prior WinRAR samples strongly support legitimate software.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing win.rar GmbH
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged this executable, and its signature verifies to win.rar GmbH, the trusted WinRAR publisher. One sandbox run returned clean, while two signer-matched files sharing its import-table fingerprint previously received clean assessments.
The executable carries a valid win.rar GmbH signature that matches the expected WinRAR publisher. None of the 71 antivirus engines that checked it flagged it, including the represented major antivirus engines. The completed sandbox run returned clean and recorded no process injection, dropped files, persistence indicators, or sample-attributed network contacts. Although was mapped, that isolated technique lacks corroborating malicious activity and can occur during legitimate installer operations. Two prior files with the same import-table fingerprint and matching signer also received clean assessments, reinforcing the publisher and identity evidence. No complete contacted-host reputation result is available, but the sandbox observed no sample contacts requiring such a check.
What We Detected
None of the 71 antivirus engines that checked it flagged the executable. Its digital signature verifies to win.rar GmbH, and the signer matches the trusted WinRAR publisher. Two previously assessed files sharing the same import-table fingerprint and signer also received clean results.
Threat Behavior
One completed sandbox run returned clean. It recorded no injected processes, dropped files, persistence indicators, or sample-attributed network contacts. T1134 was the only offensive technique mapped, but there was no accompanying evidence of token abuse or process compromise. The antivirus analysis found no likely packing or high-entropy executable code.
What To Do Now
The evidence is consistent with legitimate WinRAR software. Confirm that the file came from the official distribution channel and retain normal security software when installing or running it.
Where this verdict could be wrong2 caveats
- The sandbox mapped T1134, which can represent token manipulation, but no target process, injection, malicious sandbox judgment, or antivirus detection corroborated abuse.
- The publisher history contains only two prior samples, so it is supportive but not yet broad.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The executable has a verified win.rar GmbH signature matching the trusted WinRAR publisher.
- None of the 71 antivirus engines that checked it flagged the file.
- The completed sandbox run returned clean and recorded no process injection or persistence.
- Two matching, signer-correlated files previously received clean assessments.
- The antivirus analysis found neither likely packing nor high-entropy executable code.
- The sandbox mapped T1134, a technique associated with access-token manipulation, though no related malicious action was observed.
- Historical signer statistics currently cover only two other samples.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 18sandbox rule tags
- 1spawned processes
- 0network contacts
- 3filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
18MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1114
- T1129· Loads modules
- T1134
- T1222
- T1497· Sandbox evasion
- T1497.001· Sandbox evasion
- T1547.009· Auto-start
- T1564.003· Hides artifacts
- T1614
Observed activity
Processes started
1Programs the file ran, with their command lines.
winrar-x64-723tc.exe"C:\Users\user\Desktop\winrar-x64-723tc.exe"
Files
3Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Microsoft\Windows\History - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies
Registry and auto-start
2Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix - Set
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by win.rar GmbH.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 15, 2026, 9:17 AM UTC
- SHA-256
c3d2bb68848646d68fe30f7aa345bd21bfe26abed5ba597c7a575f034ccd3f0d- SHA-1
7adec5797d50f48a02fdd1013541592c7dbaa221- MD5
8a696e7d5ff7479b96151321a86e695a
About this file
WinRAR.exe is a Win32 EXE file of 3.9 MB.
- Type and size
- Win32 EXE · 3.9 MB
- Signer
- win.rar GmbHValid code signature.
- First seen
- Jun 30, 2026On VirusTotal.
- Submitted by
- 162 distinct sources
- Packer
- None detected
- Entropy
- 6.53 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is WinRAR.exe safe?
What is WinRAR.exe?
How many antivirus engines detected WinRAR.exe?
Is WinRAR.exe digitally signed?
What is the SHA-256 hash of WinRAR.exe?
Is it safe to run WinRAR.exe?
How up to date is this analysis of WinRAR.exe?
Community
Member reviews and reports for this exact file hash.