2

I've downloaded a .rar file from an anonymous client, extracted it and tried to open its content from a .rar opener window. Nothing really happened so I am not sure if it was actually run. It contained a .src file which I didn't run directly after it was extracted. I've scanned the file online:

https://www.virustotal.com/ru/file/95977c01c727e25f244b0791abd3ba84cc16e917d1c6da3cc58ce7e4947870f2/analysis/

but I am not an expert to tell if it is a malicious file and what it actually can do to my PC. Any help to explain that report would be appreciated.

2
  • 2
    It is probably just a dropper, the real payload (that probably did all the bad stuff to your computer) was downloaded/extracted to temporarly location and probably deleted after execution. See WindowsApplication38.exe on the last tab of the VT analysis report.
    – buherator
    Oct 6 '16 at 12:30
  • 1
    An .scr file (screensaver) is just a disguised .exe. Given that screensavers are obsolete, the most likely reason this extension was used is to trick users into thinking it's not an exe and executing it. Jan 5 '17 at 12:06
2

To give a more general explanation for those finding this question via google:

.scr files are a special variant of windows executable (like an .exe file) originally meant for windows screensaver modules. Once executed (directly or after having been configured to run via control panel), these can do everything (including damage) a windows application running under that user account could do.

The fact these are often misunderstood as a kind of video or data file by the average user (who understands that an .exe file from a doubtful source can be bad news) is nowadays used to spread malware.

0

It is a scr file, not an src file.

The report says that 12 out of 56 AV vendors classify this file as trojan horse or reason of concern. Wherever you see the tick box that means that the AV solution in the left column didn't find any suspicious pattern. The others say what they believe the file is and most of them say something like "trojan".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.