Security Research
CVE-2023-38831 WinRAR Spoof: 0-Click Attack via Archive File Masquerading
Thinking
2023-08-23
4 min read
Research Dossier
#Vulnerability Analysis#Code Audit#Malware
WinRAR’s extraction logic has a hidden behavior — when an archive contains both a “same-named directory” and a “same-named executable file,” WinRAR prefers to extract the executable file to the current directory and auto-execute it. An attacker’s carefully crafted “looks-like-a-safe-image” turns out to be an executable.
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a4d4b6d4ade7253d06d61bf923572a6b8c253d117e8b63642be9ad8c68eaee7d4a02592bcdbd3155abcc6a953135deec61ed6729ad92ae056a76758bfc9dbe3a6985cd89376b141ef5351ad5bb4a1f33c6330e9386395e81f8f762e9dcabda4d6f7b893bf792c95b9f562f6b538563e8445acd6fc30a3cd1cc0ab3692c27a628978efa98057f8084a9abe474b68e6226547d560267ef5fa95936f90dcbf5e39f32ce1339be7ba6105d3c6c1f387591177e0e96eab1e9789f295cccf6c33123a9faa60e18992a9db6c370f66dcad3c4e0ebe35e2b8fdb5741d1b16cac54721c9e7f71c18e45e6723bbd7d117f565462127da0be89cfe472e8998f0c678a8eb95329509951ab9879c0715ed0d95ba8aae014ae12c96e74169ced708d0e72fdc2a72f289ec13ff68053e56fe9308363e9f24d67dd6ba22bf7a3a789ffedb0a38ffd8def06415713c3def31008bffdce09d9f06c3d69b4dd3da61dba83a429143926b8e8360f9389de51db640ea3ea851c1c0363c48b2ec1a6ec3b2ab1fa5dd06a4855a3dbd87d006badb2ffd2324b2a733d248fcda50e1fe96b87eded596657762f32b680fbed439025e71d78ced01a18a72a6bc54a7221dcaf5502b2c1ae7838440da6cb8698eed8f9098624db492858ce03b8e0342d24bae996a2b98444636dc72a159b82aa22db0b88f82d8302aa99e410df81023c37568ac7ab84d9777958c70aba35d6b04ed68a12d85ba71ec6daec1ec6090249e9f8adea2da1bfa42f4378f37c4b90561b25b910181d66958b53b7607e6b2e02157b2b2814a9d68861dee85239fe6036e8749fbde3e805969c28ee7bb45ff59be8a607abd6b38710ebba4a7a194f8c616a5a59d17c240e99a05d919920e63410fe7ee8e2837f07602470cf2d7a465975a0ceb2f81869a6fd84bb3660391f479ba1761513ba492896dc276a1de029e3eebfb912c527b4f5ddb9e003a067ef3773af7e038338c75494c0d0c55301751b7fb713f58cc271818c8906e0dc0776087b95524e2f23ee8ac20e1755682ac443597d01547449b1c3a7c708420b17ec4508d0c49347d59d7e7bc49d951496fbba211cbc581db468696aef3113db73ab85b0efb5ec5747cce1da7a2aefeb52658d909b0a2d25d2130a6699fee7f2716f22e76fd16fdfb6a7b571c4a53f7d5c936a0603d3e95b06f397d458282fa99d227c3775aae01185c268a35e5b6b2810df5adeb4434fd7a6c6800d0cc0b14f26233757ac8f9c2136d4e0d0053a584aaed45a0c2f5e3a332e3007005d2e12029432958d312d9abd8008a452ed0a6b934020955fdcff80edaf064667c6f3bd14c78975124dcc71462eba00cb3a2d740f1e7f699bc44612923ce06c257a744adab0ae511f459f4387424e9e67f4648edf92c9f36138169b38cba090692a5235fcf5cd183212f42c3cad468c28d76101e2456e4564e98d0b67f69421f7929cf59cf5c24ca47f12f3509484f92a12e6ba1720457c2e0e93d99b6665d95919acfc010be5bcaf52e83cbf712befe3492699272a2fdd640b3aa6413c8f952331932c6d0c3a1beb9f650bdc3898137ca9d05059be8b10e412c7a2f7ba29d6c4bf7913043c39c6d177aaed82516f5b554551dc42838b4134dd632704f3e4fd709dc4ef3997b827e7eb4fb16baef3568c5684502bc5c2b950cebce4551ddd8f76b0f3a7f08259a8527f95ff3ba46cf6cf9e8b164fa60c1caeb13c37e623e23999d95ba24eec5cb7720b038a80413a5c6e0b2877ba6539af17e365d373cda436723be090caf11c660e3777b6595564aacc719aa7474defd6ae274722d29dd5c517dddcf43208afeb2e9feb702c13f97c80cc0007ee13844574ee1bbabb66da67065b43c4fcd55ca6265c5a1b665a738cfd4c2262a8114f583821bbbae7186f682d3f8a029d7817f41dbdbe16021951ff6491d9c8418f8e786bc081d1da2315a06e93d184f6a6fd0e4c946ddf853d49ffcd9060b40e0429a7007958da42f93d974d7d69ca756bae8cd1eb5d949f24130ffee4dcfce39c25ce5edb6114cdde4b3a89537ea376c1e09d7e605f36a84b2b5f493a20c5fc94714d52790f22466298de12563447a992db3b9938710523854f44b4c16d089f6d316d57cb174157179ee3e3e4765010f21e4f9fa5277011574b15af452f4f8306cc04b6b241bf32591196cc0ec92936e1d980c2ad52f9a296e354eb1376fc052939c3574434bc5008c4d3f5ca0b7ec5b6dafaebbb8f09ba77c6d583b5c764d234a4c3bda90da3326b7dd34769898e08684340209a15bd2318a9ed2764a59bcce763731d0f8c4db4dd796d69387f6484b06f3efde130b1cb3087590c69385fa74db7b120b60d9f3ee5a6f82ef32787e36d4b3c314cc79c7b76a5e7be2c8bdbe74e36b8b9d2bc770c34b211e6cc95d30ba4fca00e8371cddba7b465063bae99411b5727009cac9e85c223dac7219b7fd0d4cc179432a873130ec630fe9c61344381c5cb39f75c406f74799973b7382c5abe2255050fe15a9c3f2e0ea89d9a42bd4e4e73af0377513eeca05e6c962d2d883f5b77c5b1c7a5c63f4cdf05cd1bf32a8b988c01b857cf63435f14bd7392bda977d6ef187ecbd9bb6a18f8ed38d2d59ec05a0b04ef04895234c276580a352f73e5dfe18c38eeac2f76c2e76583cb551bf2866e924159b8f6897361cad894e1f5ec58d421281025043becd42ceb0d832b31a0aeb33fd5a7259bd8d2d7ab0329aacb5b7387f34a3f68229d65712876a8ff152c3dff2b765c97280bc00c9fc506e347fa08be0a61381e57a04c2daab858c0fa1f40f29b8e07b7acd846bee2160a7073a35647f440df0fa580082918c7b3b9a7b1ce14548a61795f922526f05f735424e1e8677d119e194df2283062ebe358ca2a940bdb8d0a8b742c9c7f4363af925108a259cb871e4f86285ba1c2e7204bb72c1dcb68b35966d34248d9b655a2fee1162f710fcf90d726470c34cb99ad7884a9663f3c88bc80f99af2ad0dfab6625fc6cd0e1c3a00440eebb887b11c11194fd94c6ab873835b994729bdc3e29c3177e7a567d105604051694d4c430c14a9fc9a4abed10fc9856b9872e959f50fafc67feca6df892d663d0a058f08295c97ed8d5375c89c3b9622c5c29e13ab48aa2211ca816f14ceeac82d78941285702f22a91f5a7b3522f4dadf303b948afc214c9704aa086b2f7ee4c83a8a19ab9cbdd74b528c9e06296d685792b1ce0e2bd0de4442db4d4e0d0184cec2bd1062201eab046f139470f57d4e7fc3e6420da5bd18b86b053d13fb6fbb7b406d09c7f76262d76b23e4c7660754c4d2830b8c3be83ca0f1b52f2fcc085652e3c11f4bb6c18c8a362c4111ca09eebb3e39ca9f64b3566113a993cdddc0a4928fcace45e95f0d91b80a03f7b8e8cce1d4a2b05557f79b8e27aee6ff5f210bb87ab5f2a23cdb7b6b7e8a2b40163d65edc2b880c75cca1de3b1ee5ce7d5d976877d11af885a0ad1c1c87165bf6aa6c0ecab07c31b5cfb13f162ff448e1266d52967d1d8f3e73a2d64cf2680849b028213839181737e4b76b71954f340b8446c96902ac63b6d3e71aeef026a1780dfba8e4f61115abcd6c443fdf9c8fab98e63e14cadd3dd773ad81dbb9652ed878ddcfe0af1f01ecce5294fc3a398ef9d929c3b4e862221b57cffb8ac9bc2f5b1b62345b2accb9a7534339ad6ddf6a6aad372ef5a53017267bb68d322ddc6dec81bee869fa5e76c2e7833891c4b613854bc7ef4e5beccbf98e33dc144fcf59204331d8fb5859ddb64a3e182b1e628e93ed3c6ac17d6fc7e17fe398c6f4eeef934da2b911675234b6019a9e9bc6a29d713393c42c5d33859a6c3716b8fc4867ff76186d7e2b43097628303c3aa498cc0755241317b7213e5169119bf2e1500e329c9849b8393e77061d335c033758cf7c543fb5555f6c5a72024c4fd1470549a543126ff6a4572486f9e3cc897d51f9dd6895b934bd5ba3546a164f457dbaab15cf463396e0cca85543c608ac5fa019adbceb484b9a2595043a4f4ea1dce4094a191d410ec010a5f91840cdce079c1d7a97c7194edd98a56b9efc8eccfcd539d9bd85531c846a6b654d3a825821a9812e3e7315c123481a7cefd554a19d4efd26179d86f60b00e0301ae1feee7cdd2652f522a2f478c89ac31c69bf54810de1b5c6e99561a3b894da0cd3b75482c5a56737b7def204d5b269404ef0044d37c72afa087d25755eaa795e428c09553bb2711cb0ecf013207987f7da375a413646c8314f1cf5cc2f20bd4632a4934282c691b3f41e79bf716dfc9bfd3d6e34cc6c6ce0dc187895d033cc8cba6210dcf9462f77caa79ebd61b55b94898ac39f7d1878a99e1e65580137796f457dc5efed4d4c8318e0770b3ffcbf252a4654d5ccd03f5320e0fea66e625d9dce8c41f3d81c0cf4e2dd7ffbea36c2db3e0e941e2ffedd6d824cda13a55ba5b0b90d80c4147995a4835876bc0b8bea6fec8aa5510804d46f35cb6d19284561b67104c28f53335f6e724f6ca76c41fac26b1e23d7a0a2cfb9ed88dbac4afa248ee93f8979b72a33b27cffbb9908ebfaf39a704fa8757b1a27a633762f0e3f8450c81357cadcc81f7d605b24ff5ebd643901d5f07b2332bce88e6e1372b091cee7345ba5f84fb817539b7dbcca23df8b4b74e64c8a60951ce7042870df6da23decea862a5df1339397e9047782a1da7d6dc4895ae14c9f186526fefc15162b96f8ea0e806a5b071e7d168a9b98b2799db969c2e148b275d24021700d2cccb17b7f1a982cdabc3932a6dff8e14a64e6151ffc304decc2cdfb559a30f4cf1517b173a341f38643f39f5e4956f34d83925f734316a142096f2cb2d8df156ff194b799be616adc440a722cf4e512909b58db790b34401bf53d9a70cbb436b9a9bdade371be7be822395c24c2c0e400c50be81f8fe5e78076733b4d96c454ec1e4e1c5bc64d67a13c3a59f5c58126365f7db2381053a515299358a688f4cb5d45be5493bf12ff9baeecce3261dbbc814ff034583ef66ac5e5d96c5bc71a31f3e049f35898dd9428b8c2a1fcae7e411df06cc6c31b9e773620a30920c826b661b2394e5747e8ca7e6a353009758cf873aa256ee8571ac58e13dc0b7dc2b07bc4e0f96f350a779b3bd91fe911a588eb960a5af1344c52893e98b2d1789dd7e6727dccb11e29e7545475675437036723e0ca5ca949ef72eeebc0a04b34d536221dfd3cd5dd9f378a9ca6d60f1bc77a2cfad5c50c2c1072f0afad9c485fabcd5950d8de7d72e1414bb75fdcbfbcf07708a7fe7fa3ad5013f9503f356b21c6322cd75bc77e5d5e5d1a625cbd8a9d6a77677feec7ac9fbc3b9eaf5ccbcd2d9b646d0e23dc40822b8ff1b3e5f3b00d862be9c489f6104265d2f6a2a4e9d2a67a5f67f17580c3790d58cd20b9d6b0363ff910723951c82fa9770ec201f08f1a24d2ce3e3e22f764894ae4940fd9b493415b6b1042007b2a4f1402617021a1078624e40f0aa9db6983f6cd709443d8507e282dda1bf251644b4322b153cc6f3e8f21ac50c53ca6648a8d31076313ae1d0c379f2d5f3a2c7d1db79fa7523fc6571e533c992c650dab35dd91e7ea60f85ecee8ee4691668f1f3e5d5032407b99a145a862975551ee4be7683abe53b877ecde84f4a54b524734bdad74b7ef32fde8b3b6a291046fa38e5ec0d6f434bcfc47cc7c471b49644c47832134998a076198989de5d22d7e2bd7b73002485c62d9820826ff452b762deb647155a611c3c00029410943591f3236683c1b0a5c365c111b2236722442a9df330ec2ae23306c946786d6c410bef26f0aec4beb5e9e6e037b5d06f507ac21826ba01713121a46fe6c6d792d40c440336d59a006b248e68277260fd3bfd0dd2c95ffe42bae06c991f802a3898031f5c5f7112ac148e9062b59fb9f4fad9633c4daf3177b85cdc77fd2fdaf1ca159a574150e8c4f3895a439a2328e584c7132216d79777af8374c9e6c7dc3bcbba65ef7961facd177685b086dd37b75e2b398ca0c409c62ece781187f8a5973d40a9c5de85047c611341bfc778bd85b36907f32fd6d79305af42fbdfb0dd21941a4670256192e75bdc171ebb2685f270ceb36bdf9beabac0b988fc6fff5ccdf3a5f5c54a9204170102315779d49ec0c3088a7495b4cadda3a3f1f17e116aaba90ce8688bd89cfe90eb12c485578c6156b9e7062a65477ff043bfdb14e846e5176f1799b717076687f1d428db87df9417bd2759e9e81341c4af6eccda4b755748c0c07f9af4bc42fed8171323f491eff1da0f6216d66f0d08609e0b3e1d0efe2ba6d0c4a34c1237d391a3c0bd6ddc4dc38c080ec3d816b2f9a69c05bf533be90f609fda6f92b26c084091ea777414e3c2313e4943cb1cf46828ca2bc36158fa34157393569861be1665a9b93abe4eb8028c41777c0d59fdfba2cb7773722c9b92a61a8e2ce2d6f28093a957c561b82496cc35d9bba68e3bc8d71b821bb425b4d45a02c0d15f3af58a875c0b919122dffe353385aaabb99ee057a8cc1e5ad97d3a410dc3fdede29864cf85515634a20a4ec6d5e50a8a891f8f31299aaed396c7f830493ad0d0e79b764360ebe9abb4f0a7b4666576e11887e2a5966a9d095c6f0d845572e78f2d52c7b966f67ed5e10b6283562526091bf73417e6607a2523a8b0409c50a0b1970dbfc7a9279dda5b484db2263e1833d1c58283331cdcf33ca7235f35cc5a5e4710a30830f58df20fd52caffe05fab41e59f440da7a7989e8117e499cae6c94825d4c16a0abf3a2ec2289031755dc6b6d9a2d469b4865a76df59bf24ed4c39f24d8a4f12f87cb7d2ab8a2d8f87fac599eb55abf5b4003c87d3eecae4e8da47a88eb8b57373ca3bd85e03fc17396d9465bb54ca573dc98343d49de4d866c96267f117f81ff357b52714bb5a387b49225414c013cd22504b3122edafe924f004f3f942bed2310229aaf891bece08a2906ce6d5e954eb77911059eab1cfea9c3f6922b204c75edf5e5267761e7298e73997e4620922f7650402551d6f180a8f4e84740e03a4bfd71fb27d2abd5857b7c6eec1a79a5c6817b4b3e7078226f7b7d32662e48bacf66cb78c6835e9aad794631df6a371e5d1c207d91e2db32e9fe213d2b104eb12cdd31421a8e46f67c5596f718b7d65f8f651ed0916192c56faf5613cd8e0e02eb271b506eb71d34821e8139be57b32518b945752409c09f97fbdab8970ed19a8298c1d3668f6f2fd60a9a343f09a832acc5465ada63bddf09aa3fac2b06920fa3e8f25ec6a71d584f9110f5346328937ee8a06edcd137664db7ea9d29f15bdefdc0e2596a9551a4648b8705a16f9a4c089d7ff302feea6e78e6d1daff5dc71b1eaa5f93200eccdabf6c88c899ed0f07f0a4b9a0d3f0360cd0132fc4793d51b8ae272dc447b5ee62bd84489b865e8205b18fa9b50c65da341fa8853f07aad6c305498c81c96e9b1396c7a5a59f697862a83068939537254ca7b5dddfdfe214d21d8d1c5c3e63a7ebcc8e7c704d81a738648f9500917372d72617f41e65408312b86912ca48a9c93ce176e629454e329e173609f7c8ad61d8e7d38db80c240ae6b9a43669b8d96eb7e8a58c6f8a2a89df53cde41b001d1e0bd02e48508c88dd5bd3d8e112ab8336d97b37af6cf88fc6e5eaedd05708b01b1b5963ee185091a23c3084c16a04353a01d7e71250c65ea423b3b6832b979a6497c27224502d2a6eb8c02c38daf6a9c45bd7d24273235b28e2c421bdea799051d04af4e73fa5e0a5e3e87f1b247fb180112d41805de2cc961e78