home

riffsetup.exe

This is a self-extracting archive and installer. The file has been seen being downloaded from riff-box-jtag-manager.software.informer.com and multiple other hosts.
MD5:
a65c063dee368f668e519ec0595c5632

SHA-1:
3846136f69df988d8297f00d64f6115a79cd3bdb

SHA-256:
ed7ff0f37a41374e985475cae7cf113cb60bedafe0e31e000734504af233dcca

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
4/19/2024 6:27:16 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Dropper-gen [Drp]
2014.9-140612

File size:
8.4 MB (8,797,151 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
11/3/2012 4:00:39 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.50

CTPH (ssdeep):
196608:HyH6O7OWqLrF29Hk2U+nXsVSCOX4EkLk0V2GvAe10w:HyAJXssVHOBkLf2xw0w

Entry address:
0x1000

Entry point:
68, 0C, 02, 00, 00, 68, 00, 00, 00, 00, 68, 30, AD, 46, 00, E8, 10, 91, 00, 00, 83, C4, 0C, 68, 00, 00, 00, 00, E8, 09, 91, 00, 00, A3, 34, AD, 46, 00, 68, 00, 00, 00, 00, 68, 00, 10, 00, 00, 68, 00, 00, 00, 00, E8, F6, 90, 00, 00, A3, 30, AD, 46, 00, B8, E0, A6, 43, 00, A3, 48, AD, 46, 00, E8, 02, 86, 02, 00, E8, 50, 68, 02, 00, E8, 97, 64, 02, 00, E8, EE, 62, 02, 00, E8, BB, 61, 02, 00, E8, A2, 58, 02, 00, E8, 9B, 4A, 02, 00, E8, D6, 46, 02, 00, E8, B3, 2F, 02, 00, E8, B7, E9, 01, 00, E8, 19, B7, 01, 00...
 
[+]

Packer / compiler:
PKLITE32, 0x1.1

Code size:
194 KB (198,656 bytes)

The file riffsetup.exe has been seen being distributed by the following 4 URLs.

http://riff-box-jtag-manager.software.informer.com/.../

http://download.freedownloadmanager.org/Windows-PC/.../FREE-1.56.html?ac14af3

http://click.xda-developers.com/api/click?format=go&jsonp=vglnk_jsonp_14079751575688&key=f0a7f91912ae2b52e0700f73990eb321&libId=25c71b40-42d9-469d-82fe-528ae5f411a8&loc=http://forum.xda-developers.com/showthread.php?t=2265477&v=1&out=http://www.riffbox.org/.../RiffSetup.exe&ref=http://forum.xda-developers.com/showthread.php?t=2265477&page=208&title=[GUIDE] Unroot/Unbrick, Flash official stock… | Galaxy S4 | XDA Forum&txt=http://www.riffbox.org/.../RiffSetup.exe

http://www.riffbox.org/.../RiffSetup.exe

Scan riffsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.