home

rksfax_control.exe

RKS Software Inc. of Oklahoma

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘RKS Fax Print Controller’.
Publisher:
RKS Software Inc. of Oklahoma  (signed and verified)

MD5:
79462a6bb79cf3c0b043f2d652034a5d

SHA-1:
db79a433de4899cfc1537b61686ee6eefff39bc3

SHA-256:
3f50ee0944579860cf0ce4864e720cf1d72c2e2b060dfc6aca68cd8b7b167dca

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/16/2024 4:46:01 PM UTC  (today)

File size:
3.7 MB (3,912,200 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\rks fax\rksfax_control.exe

Digital Signature
Signed by:
RKS Software Inc. of Oklahoma

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
5/10/2007 8:00:00 PM

Valid to:
6/22/2009 7:59:59 PM

Subject:
CN=RKS Software Inc. of Oklahoma, OU=SECURE APPLICATION DEVELOPMENT, O=RKS Software Inc. of Oklahoma, L=Edmond, S=Oklahoma, C=US

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
36B9DA617F009CDD588C458AB1CC5B73

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:J5L5+mZnRo6Nuy0VYn0gfGcAQuU1d4cIM5g4YTkxbKuRjS1URH/cKr8HCy:JpKy0VqkQJd4zM5EWbKuRjnRf1Yiy

Entry address:
0x263F14

Entry point:
55, 8B, EC, 83, C4, F4, 53, B8, A4, 36, 66, 00, E8, 13, 46, DA, FF, 8B, 1D, B4, EA, 67, 00, B8, 98, 3F, 66, 00, E8, BB, F5, FF, FF, A1, 74, EC, 67, 00, 80, 38, 00, 74, 0E, 8B, 03, E8, E6, D5, DD, FF, E8, 99, 00, DA, FF, EB, 3C, 8B, 03, E8, 8C, D4, DD, FF, 8B, 03, C6, 40, 4B, 00, 8B, 03, BA, B8, 3F, 66, 00, E8, 7E, D0, DD, FF, 8B, 03, 33, D2, E8, 75, D0, DD, FF, 8B, 0D, E4, E9, 67, 00, 8B, 03, 8B, 15, 40, 2A, 66, 00, E8, 76, D4, DD, FF, 8B, 03, E8, EF, D4, DD, FF, 5B, E8, 55, 00, DA, FF, 00, FF, FF, FF, FF...
 
[+]

Entropy:
6.3853

Developed / compiled with:
Microsoft Visual C++

Code size:
2.4 MB (2,502,656 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
RKS Fax Print Controller

Command:
"C:\Program Files\rks fax\rksfax_control.exe"


Scan rksfax_control.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.