The rack exe File Malware Analysis

Technical Analysis

File Name	rack.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.219.174
Database Version	2025-06-25 05:00:19 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	5c88bcef792d940e0ef15611971b5fdb
SHA1	455d8a908fa664f9dab6664102c12d26ce10115d
SHA256	83d14a6f8097a694fcb1ba88e5aa362be11317fcdb20a960813d57864c713e24
SHA512	292310fb6a909459120751f9e4613c4e18635741e0cf8e6c19f3430281093becd0f813c8810d31d34ca70d71091e9dd89216de9ef6f8ecba59d23a36dc81b446
ImpHash	7735c99c1201cd8635d698bbb79c6687

PE Analysis

Basic Information

▼

Icon	Hash: f457d536bd8fd99e77b9b10da84bbbec Fuzzy: 926cff26fa140229add0ef24f59d5b10 dHash: f0eca6b4f298ecf0
Image Base	`0x00400000`
Entry Point	`0x0045a194`
Compilation Time	1992-06-19 22:22:17
Checksum	0x00000000 (Actual: 0x002d6baf)
OS Version	4.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	8 libraries kernel32, user32, advapi32, oleaut32, version, gdi32, ole32, comctl32
Exports	0 functions
Resources	51 Resources
Sections	8 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`CODE`	`0x00001000`	365,064 bytes	365,568 bytes	6.53 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`5EEBBC719ABCCF72BA31C0D88335E972`
`DATA`	`0x0005b000`	4,708 bytes	5,120 bytes	4.01 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`EEB384ED1DB19E3ED8AA3AA89657CA95`
`BSS`	`0x0005d000`	3,129 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0005e000`	8,956 bytes	9,216 bytes	4.97 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`85255B37A61FD466AF1CA9F59E2A15DD`
`.tls`	`0x00061000`	16 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00062000`	24 bytes	512 bytes	0.20 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`311CFA5810138F2013704D7ABE460944`
`.reloc`	`0x00063000`	25,904 bytes	26,112 bytes	6.68 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`2E45E1A6BB2B2E049B6C048E260DDAD8`
`.rsrc`	`0x0006a000`	62,464 bytes	62,464 bytes	6.51 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`F0B4336A224951460007C31D27A5B369`

Entropy Analysis Alert

3 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 51 (59,247 bytes)

Resource Type	Count	Total Size	Percentage
RT_CURSOR	7	2,156 bytes	3.6%
RT_BITMAP	11	4,892 bytes	8.3%
RT_ICON	4	20,132 bytes	34%
RT_DIALOG	1	82 bytes	0.1%
RT_STRING	17	10,544 bytes	17.8%
RT_RCDATA	3	21,239 bytes	35.8%
RT_GROUP_CURSOR	7	140 bytes	0.2%
RT_GROUP_ICON	1	62 bytes	0.1%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The rack.exe File Analysis