Exe file to unpack using WinRAR is this the norm?

Question

Malware

I decided to install myself a Photoshop assembly from the Rabbit (2020)
There is only one file there.
When I right-click on a file, I get the option to "Extract Files..."
What I'm concerned about
is an .exe file.
Is this normal? Am I at risk of catching the same Backdoor?
And yet, if I unpack and there is a malicious file, will it be activated?

Answer 1

Take any folder in the system. Using WinRar, compress it into an archive, while specifying in the settings before compression, so that an SFX archive would be created. At the output, you will get the same self-extracting archive in an .exe file, which, of course, can be unpacked using WinRar by right-clicking on the file -> "Extract files ..."

Answer 2

Easily activated.
And self-extracting archives in 2k20 are Riley strange. Don't risk it, use a root tracker.

Answer 3

Exe file to unpack using WinRAR is this the norm?

no
, but not a pathology
, it all depends on the source ..

I decided to install myself Photoshop assembly from the Rabbit (2020)

it is not the format that should be alarming, but the source!
ps
- enable real-time checking in your antivirus (now it is usually enabled by default for everyone, but you can double-check for peace of mind)
- unpack it into a folder and check this pack with an antivirus before starting anything
- all modern antiviruses (including the built-in one) can scan archives
- check the source file itself on virustotal - this is a check by all more or less recognized antiviruses at once
, something like this. after virustotal, you can usually not bathe with a clear conscience
pps but virustotal is not a guarantee either !!! 0-day has not been canceled by anyone (the tricks that hackers found, but there are no antivirus programs yet !!! ...)
.. but here, of course, not a single antivirus will save ..
ppps ahem .. why

it is not the format that should be alarming, but the source!

think for yourself .. do you believe that good hackers distribute hacked paid software .. FOR FREE .. ?
...
still ?
_ _ _ _ _ _ _ fucked teapots are being built by botnets.. that's not the only threat. but it's an industry

Answer 4

- archivers are able to make self-extracting archives, naturally, they are just in exe format
- repacks are often made on the basis of such archives, because such a file can, in addition to self-extracting to the indicated places, also execute a number of other commands necessary for installing the repack
- I won’t be surprised if the repack is also on the root tracker, this does not change the essence

Answer 5

Yes, this is the norm. Archivers can define the exe structure. Exe can be a self-extracting archive (SFX). And such an archive can be unpacked and all files can be obtained. You can even see the command line that is executed after unpacking. This is often done so as not to bother creating an installer.
If you unpack the archive files manually, through the archiver, then nothing will start by itself.
The context menu in Windows can contain third-party elements, as you noticed. And these third-party elements do not appear there by themselves. When the context menu is called, the handlers associated with the file format are called. In this case, we are interested in the WinRar handler, which analyzes the file before showing the menu and decides whether to add items to the menu or not.
PS
Because of this scheme, by the way, Windows can often slow down when calling the context menu, because some kind of crap handler works for a long time. This sometimes happens for example with the Nvidia Control Panel. And it is recommended to simply remove the handler through the registry.