home

viber+4.exe

Viber

Innovative Systems LLC

The application viber+4.exe by Innovative Systems has been detected as adware by 10 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from viber.downloadable.co and multiple other hosts.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
Viber

Version:
1.0.0.0

MD5:
41b901315ac6f37c0f63d09dc21942a7

SHA-1:
2ee10c8440b9238393fbf6945d9b8f786979b384

SHA-256:
7565945bc93c3e4de6b2272e0d8e8d3b3e6a7d4c33692ee3469f3ba1cd49a94a

Scanner detections:
10 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/15/2024 1:20:19 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.OpenCandy
2014.08.01

AVG
Generic
2015.0.3393

ESET NOD32
Win32/JoyDownloader
8.10186

IKARUS anti.virus
PUA.JoyDownloader
t3scan.1.6.1.0

Malwarebytes
PUP.Optional.OpenCandy
v2014.08.03.05

McAfee
Adware-OpenCandy.a
5600.7049

Reason Heuristics
PUP.InnovativeSystems.H
14.8.3.17

Sophos
Generic PUA CO
4.98

Trend Micro House Call
Suspicious_GEN.F47V0721
7.2.215

VIPRE Antivirus
Opencandy
31800

File size:
489.6 KB (501,392 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\viber+4.exe

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
VeriSign, Inc.

Valid from:
5/19/2014 4:30:00 AM

Valid to:
5/20/2015 4:29:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska oblast, C=UA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
450EACFE8D673E82864CE46BC1A92FCA

File PE Metadata
Compilation timestamp:
5/20/2013 4:23:11 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:EKcXy9id0xmV7OHvwx5minQH7hHmoOWc9ebkqI/4R:0C4d0YVSHqx+VHmodie5I/M

Entry address:
0x333E

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 80, 40, 00, 55, FF, 15, AC, 82, 40, 00, 6A, 08, A3, 78, 4F, 43, 00, E8, A8, 2E, 00, 00, A3, C4, 4E, 43, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, F0, B1, 42, 00, FF, 15, 7C, 81, 40, 00, 68, 7C, A3, 40, 00, 68, C0, 3E, 43, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 81, 40, 00, BB, 00, F0, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8762

Packer / compiler:
Nullsoft install system v2.x

Code size:
24.5 KB (25,088 bytes)

The file viber+4.exe has been seen being distributed by the following 9 URLs.

http://viber.downloadable.co/get_file/wUia6yjQOM3I2mmuF6G5QwMsilYkNHutGxLgJoWHp h152P0sGpyztwJLVXsK7H9P3mulA0bcj/.../0qHDpZrSlGlZpJUyil1QXzWtDDRnwYtpp2mvSGjASr1YyMHgMzYAabk5bBILOb2hDyYqasWNLBojhrOCS3RwOp72z7h9W3ux8VDJlu06W87pJYC8ZDJW3MuvH ogjRZW54v3nwGhOrh 1CakCd1c7dWwAHPquYPTw3gybO9JRIc2dA==

http://viber.ar.downloadable.co/get_file/wUia6yjQOM7Cwj XOm6FVNv3RVqLTPkEh34cpqK57Z0/269qGt42ZtXeVXsK7H5NWG5wFZROnGHWOOkEqdxmu1yz4WXAQaD/S/.../gkrRhHGLjuFvMl7xmApivJp3yOyQezcr F oujR8W6Zr2zlL8ZLgjznDzEcQe5Ma6SWuP6sPF2DckeeMLEJY2dA==

http://viber.downloadable.co/get_file/wUia6yjQOMzI2m6zUbjxEAgnm1x1NTmnEgqmOZ T6bJ/qCeisGMxwd4EPwG Ou6 LXj/yldSICPVT/.../zGDU2nsUj7Cn6X2SeQK5Xi83nPSVRN VmelodOOz9VXBtes3KNBBhhqfuAHNtONywhP8 V2O7tlrJmvZoApe9e4GkbXtOm4WvFqounhcH7Jr2zlL8ZLgjznDzEcQe5Ma6SWuP6sPF2DckeeMLEJY2dA==

http://viber.13-50298-205770.53e08ca366c06.dablecdn.com/get_file/1WlUNoGdpumvtJcMRn8bng/1407228595/13/13/1/.../Viber 4.exe

http://viber.downloadable.co/get_file/wUiS4WnYccXBwj zXP7oQkEsml0kPju1E1v4YtbB8ack5ib0o2JgyskFbk3kYqm/Zieuyw1SM2CHWOOmGL8ll AjhJrMTknToz3zT0zysmn50qeE7MvT0mlJq4dvwEdJF3ygACwyzZ19oWy5SGjaSrhW2pG4a2IVY/o4LhkFIcmuBC89Y8rQc1N3nqqnGCUvasOrhf8 TWO8uEjNnPprA5Kve4GkaXtOion9RKtxjRZM54n5jV/6bKJwni tQMVe5NX7Gi37uNKanyYyYrZBTIwvMjwptui1S0U92kPyxdYHGS/.../wp4jvig==

http://download.dablecdn.com/get_file_for_cdn/13/13/1/.../Viber 4.exe

http://viber.downloadable.co/get_file/wUia6yjQOMnI2nu1Wf6vCxAt2101NSqlGxzga5/ZtukkrTyqsGMxwd4EP0LnarL0LXj/ylVYOHHYQqrnROR hvs81s3eDQmb7WmhXhO1qnD8gfbbvJ BxXFA4p82iUdAVHOgDT5nn4Aj/CHoHieLS/.../PLAlE1fOxUD0hZtC6hP8 TWO8uEia1L81Rseve5ukbnVc2cW7GOglnxZW54v3nxuhOrh zianAMQe5MSxUSCw54Ob2SYibaRCRpY2dA==

http://viber.downloadable.co/get_file/wUiS4WnYccXBwj pXP7oQlssmVQ9fDKkEgq0OYjBvqA862/soGh3zNwOP0ykYrn2LSz/0l8bOGSGCa7 RuFohPpyz4WXBAaDv3asHk20sn61mfDRrNDQg2gIq5M6kQAKFC/.../rBwfhoojvig==

http://viber.downloadable.co/get_file/wUia6yjQOMnI2niiRfO4HBAtwV03OzihGhD6Z9zWvqA87m/s5DEm2dBNJ0Htern8OnS7wEZTcWmPEfvkQeElyOBqxcWWRAaS9T2hVRLlszi1if/Dr9rKmiBBpZ8i1QweAWSsSTR0lck7mHKoDyGCRKIJgJLzPHQNbrMgeUdTZ/.../shnx8c5Zr2zlL5bqBnw3XlQ5MMp4L5H2vi8JuVkD5mPuQWB5Y2dA==

Remove viber+4.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.