Creating a Self Extracting (SFX) Archive File Using WinRAR

8/7/2019 Creating a Self Extracting (SFX) Archive File Using WinRAR

1/12

Creating a Self extracting (SFX) Archive File Using WinRARThis will show how the self-extracting file malware-quiz.exewas most likely created by

Pedro when using the program WinRAR. Lets begin the archiving process for this file. Oras I like to phrase it, Lets roll this evil file up into a self-extracting, innocent looking filewith a pretty little MSN butterfly icon on top.Step 1Start up the WinRAR application; click Browse for folder under the File menu and browseto the location of the file.

Fig. 1Step2With the file highlighted, clicking on the Add button will kickoff the archiving process. InFig.2 we are given the opportunity to give our new archive-to-be a name and selecting the

Create SFX archive option will give the file its self-extracting feature.


2/12

Fig. 2Step 3In Fig.3, under the Advanced tab and clicking on the SFX options button will lead us toFig. 4, where we can now configure our Advanced SFX options.


3/12

Fig.3Step 4This is where all of our self-extracting configurations will be set. The default Path toextract is configured under the General tab.


4/12

Fig. 4Step 5

The Modes tab will give us our ability to drop into silent mode, making sure nothing isdisplayed on the screen when the file is executed.


5/12

Fig. 5Step 6

The Text and icon tab is where you set the title of the SFX window (that were suppressingfrom being displayed, silent mode), the text to be displayed in the SFX window (again, notseen due to silent mode) and towards the bottom is where you can pick the deceiving iconthat you would like to be associated to this file.


6/12

Fig. 6Step 7

The License tab is where you can set the title of the licensing window and any licensingtext that you want to have displayed. Again, this window will not be displayed due to thesilent mode that we will be running under.


7/12

Fig. 7Step 8

After clicking the OK button we are taken back to the main configuration tabs. The Filetab is where you will choose the file you want to archive (the evil file that we are rollingup). In our case its the filemalware.exe.


8/12

Fig. 8Step 9The Comment tab contains a list of all the different configurations that we have set duringthis archive process. The interesting part here is that we could clear out all of this text andhave no comment at all. This would have made it a little more challenging to figure out theconfiguration settings.


9/12

Fig. 9This screen shot just scrolls down the rest of the text so you can see the full comment.


10/12

Fig. 10These next two screen shots (11 & 12) are most likely what you don't see when youexecute and run malware-quiz.exe. Although, the little graphic located in the white box on

the left-hand side could have been different.


11/12

Fig. 11

Fig. 12


12/12

Documents

Creating a Self Extracting (SFX) Archive File Using WinRAR