extract files within an exe file

Question

I am trying to work through practical malware analysis and there are a series of labs hidden within an exe file. Since I just need the files to analyse , and would rather not download an entire windows os, is there a way to extract the lab files from within the exe ?

the files in question are located here: Labs | Running the Gauntlet

As of right now when i try to run wine i get an error that says that

Could not load wine-gecko. HTML rendering will be disabled.

I have spent the last 4 hours uninstalling, reinstalling, looking at tutorials etc and im really frustrated because all i need are the fucking files .

Solution 1

The file PracticalMalwareAnalysis-Labs.exe is self-extractor RAR archive. I don't have an idea why 7z or Ubuntu's Archive Manager both can't handle it properly. So you need unrar tool for Ubuntu:

sudo apt update
sudo apt install unrar

Then you can extract the content of the file by the command:

unrar x PracticalMalwareAnalysis-Labs.exe

Where x - Extract files with full path.

Solution 2

The unrar solution in the accepted answer is only applicable to some self-extracting .exe files.

If you get

Your.exe is not RAR archive
No files to extract

then try

7z x Your.exe

In some cases, this will produce something with .cab files in some directory.

To extract the contents of these .cab files, you will need

apt install cabextract

And since the .cab files may actually contain .msi files, you might also want to

apt install msitools

which provides, among other tools, msiextract.

Solution 3

This is what resolved the Could not load wine-gecko. HTML rendering will be disabled. message for me:

sudo mkdir /usr/share/wine/gecko && cd /usr/share/wine/gecko
sudo wget http://dl.winehq.org/wine/wine-gecko/2.47.1/wine-gecko-2.47.1-x86_64.msi  # the latest version currently available
sudo wget http://dl.winehq.org/wine/wine-gecko/2.47.1/wine-gecko-2.47.1-x86.msi  # in any case we download both the 32-bit and 64-bit versions
wine iexplore https://google.com  # verify it works

Taken from Dexter Haslem and updated.

Alternatively, install winetricks and it would manage it for you: sudo apt install winetricks.

Comments

[razeal113]

well this worked immediately. I can't believe i spent so many hours trying to fix wine. Thank you for posting this .

[pa4080]

@razeal113, I have a Windows machine and there I understood that it is RAR archive :)

[Admin]

appreciate the mention! also a little surprised it still works

[emvidi]

7z x aaa.exe did worked for me after installing p7zip-full and p7zip-rar