home

r56998en.exe

WinSFX32M for Win32

MicSoft

This is a setup program which is used to install the application. The file has been seen being downloaded from d3.driverscollection.com and multiple other hosts.
Publisher:
MicSoft

Product:
WinSFX32M for Win32

Description:
WinSFX32M Self Extractor for Win32

Version:
2.80.3.10

MD5:
bd4579b4ec11a316c819af37b9e7629d

SHA-1:
d8e38531d83f76d540e21517296d17b613807063

SHA-256:
bbab982c60c2853bd1522e54ec92bd853dce6b96ab9d717d82f41c69cd5fe00d

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/30/2024 9:33:17 PM UTC  (today)

File size:
4.3 MB (4,525,022 bytes)

Product version:
2.80.3.10

Copyright:
(C)Micco 1997-2003 All rights reserved.

Original file name:
LZHSFX32.EXE

File type:
Executable application (Win32 EXE)

Language:
Japanese (Japan)

Common path:
C:\users\{user}\downloads\r56998en.exe

File PE Metadata
Compilation timestamp:
12/28/2003 5:56:21 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.2

CTPH (ssdeep):
49152:JzR7Or9aRzzA727L+U20NR0lZd0w1ySMQuoBIbejl1rtYOGSVKsSID4M6wE6n6V3:/uL27J2X4AbIUuk7Y5Cfx1ibifIeuN

Entry address:
0x6C36

Entry point:
64, A1, 00, 00, 00, 00, 55, 8B, EC, 6A, FF, 68, 90, 71, 40, 00, 68, 88, 6D, 40, 00, 50, A1, 08, 88, 40, 00, 64, 89, 25, 00, 00, 00, 00, 8B, 0D, 38, 93, 40, 00, 83, EC, 6C, 89, 01, 8B, 15, 04, 88, 40, 00, A1, 34, 93, 40, 00, 53, 56, 57, 89, 65, E8, 89, 10, E8, 03, 01, 00, 00, 8D, 55, D8, 8D, 45, D4, FF, 35, 00, 88, 40, 00, 52, 50, 8D, 4D, D0, 51, E8, E6, 00, 00, 00, 83, C4, 10, 68, 04, A0, 40, 00, 68, 00, A0, 40, 00, E8, CC, 00, 00, 00, 83, C4, 08, C7, 45, FC, 00, 00, 00, 00, A1, 28, 93, 40, 00, 8B, 30, 8A...
 
[+]

Entropy:
7.9956

Developed / compiled with:
Microsoft Visual C, 2.0

Code size:
24 KB (24,576 bytes)

The file r56998en.exe has been seen being distributed by the following 11 URLs.

https://d3.driverscollection.com/1d3f7a8eccd460a/5d1e8f370085ad9f0069867b79ad8837953d53f2574e4c617447abed922fa81a8d90d496bb0c82505d99216c382c349757dad12b/4/140/36/.../r56998en.exe

http://dl2.pcdcdn.com/files/jCiTHtOf4f2AnkG7ZLgKpA==,1473335307/3/4/3/1/.../2/r56998en.exe

http://dl2.pcdcdn.com/files/Oy8qW6H9_hWUGcJleHLUeA==,1470940920/3/4/3/1/.../2/r56998en.exe

https://d3.driverscollection.com/1247ac993fe73ca9/bfb9a32c22f3e665d07c28e3f34849fa0d00b08cb95837de347fadf29a3c94bfd7b85e1b0aa5f4cca86a64fe98e2f0b95568d692/4/140/36/.../r56998en.exe

https://d3.driverscollection.com/6e8574702642/0d0511613de8bbcacd82bfbedd8acd1af07a69dfcae45ce0274e1fbe7c11b1cd1719d32576b92e599039ab8da4226788570beef2/4/140/36/.../r56998en.exe

https://d3.driverscollection.com/1b015bda2caef96/d0824183bc0d4247afdb3c6e4b0b9e8b16bfc79189bbaaf467a10793de40994f3ec13de0107fa87f232ffd7d58964c4a5729b343/4/140/36/.../r56998en.exe

http://dl2.pcdcdn.com/files/VavRKfTMwOj08bN_fPSYWw==,1461527921/3/4/3/1/.../2/r56998en.exe

https://d3.driverscollection.com/1d3f7a8b66faa86/eb48916778f65c3c1c72bf210024b7cd3cda3d56f90a16d01ee1f66d4d05f71c82068f8595effe1ae1fe331c909e1fac56eecc6a/4/140/36/.../r56998en.exe

https://d3.driverscollection.com/1d39c9e7d60d142/6299c76e46cc1d671dc32086b906d4d513be9d3d73eaffbd048c02564d917e98dcd914b9d4c9920aa48726c36c28342856664c1b/4/140/36/.../r56998en.exe

http://dl2.pcdcdn.com/files/lLcvM_40Vlj2vk5XTtfScA==,1452887588/3/4/3/1/.../2/r56998en.exe

http://support.ricoh.com/bb/pub_e/dr_ut_e/0001227/0001227227/.../r56998en.exe

Scan r56998en.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.