home

vibersetup.exe

Viber

RICH MEDIA SYSTEMS INC.

The application vibersetup.exe by RICH MEDIA SYSTEMS INC has been detected as a potentially unwanted program by 14 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from viber.1800download.com and multiple other hosts.
Publisher:
RICH MEDIA SYSTEMS INC.  (signed and verified)

Product:
Viber

Version:
1.0.0.0

MD5:
90ccf83cf9cc7412c8295934ade4df6f

SHA-1:
aff48b272b0a939a4ec5852bbb7076db61d64da4

SHA-256:
2267cc46abba9486a48336d2238da4ed2d20ed0753324f734269cbe29e98eee2

Scanner detections:
14 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/30/2024 3:35:15 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2015.04.21

AVG
OpenCandy
2016.0.3110

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.15514

Clam AntiVirus
Win.Trojan.Agent-855157
0.98/20453

Dr.Web
Adware.Downware.10304
9.0.1.05190

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
9.11503

G Data
Win32.Adware.OpenCandy
15.5.25

K7 AntiVirus
Trojan
13.202.15649

Malwarebytes
PUP.Optional.OpenCandy
v2015.05.14.05

McAfee
Trojan.Artemis!90CCF83CF9CC
17.6.569.0

Reason Heuristics
PUP.Installer.RICHMEDIASYSTEMS
15.5.14.5

Trend Micro House Call
Suspicious_GEN.F47V0330
7.2.134

VIPRE Antivirus
Threat.4150696
39486

File size:
415.7 KB (425,704 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\vibersetup.exe

Digital Signature
Signed by:
RICH MEDIA SYSTEMS INC.

Authority:
Symantec Corporation

Valid from:
2/16/2015 4:00:00 PM

Valid to:
2/17/2016 3:59:59 PM

Subject:
CN=RICH MEDIA SYSTEMS INC., O=RICH MEDIA SYSTEMS INC., L=HENDERSON, S=Nevada, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3F87144C25AF8BCF29F29C5A1FEEF4BA

File PE Metadata
Compilation timestamp:
5/19/2013 4:53:00 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:WiuBy9o+hrAIwK2H6ltniWSTXwYF17Kw7qAWUNEA6q:CI2+hrPf2KtnQxUVA1Wvq

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8437

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file vibersetup.exe has been seen being distributed by the following 14 URLs.

http://viber.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6V7LFjr3f14WJwwclRblXsK7H7NWH7mQoMbSTPCeLkErY90fo5kNSWXgaQ9yS7BkD9qi73y6yT 8vTyGlKpZc4gVNAU3CiAX1/l8k7uHKuSGjaSrpW2sXjMjMCYas5bBIJOb2hCSYrLYzcLVgojqv2GiU3c8b41ecnWDDm50jE3/VtAJivFpv8OjM/ioX4Xfdx10gH5sv3jlLqLvMhhSflCcpX/.../5sZnn1QRo

http://viber.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6V7LFjr3f14WJ0wclbZQe Ku7uNCq2wVBaOmWEHuyjHb50ybpq1p/EUx6avCX6BlT0u2m0yP/SpMuYyDdZqtY6hl9QUXalAzZnn4Aj/CHoHieLS/.../Mz4SXvjoZmTiCdjbbJJV9JkZSoxu6GtHB5rnHDphYgGcHmlQ03t9tKx1QRo

http://viber.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsnV0kOjilERDga5/Zt kksibsqSt4zNEcah65POS7fGG3g15cOHHaQrXyCr50ybhkztT7Xl7EvUytSAO3pi733ufa7dPbm3ES MEiiBZIVny1CT1nn4Aj/SHoGTrNUrcFwsbpPHQNarMga1wdOOz9V3BtedzFZREhhrOiS3I3c8b41 cnDGu/tl/GjvQvDpO9etD6NjIcg5D0WKt4jRZW5433nx6hPP83hSflCclX/JLzAyCr5oObwyYhY7RETYY/.../5sZLn1QRo

http://1800dcdn.blob.core.windows.net/dir195/wi/18/33/1/.../ViberSetup.exe

http://viber.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDu1E1v4YdzZp7dvriWi8yE3iYccJgTtbbHueSrulRZKOSCGHeO1Tuprl wi1s3eDQ6b7Sf7Hk20sni1mbWI svT0mlOq4c1g1dLXGSsSTRxntF/p3evSGjaSr1YwtWHbmVSKtpna11PLfq/.../g0 8wCmyzoFGMlvlmFsf1MJvsOmNXhsu8Gessnhkd7Ij6hhvybaBn1HXyEcQE5MazSDrjsZuCxW8ybPVJQo4vfiZ95L3gXghqzRyy3c8AVz7qRQfyqYjl1QRo

http://viber.ar.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklYyNSrBQUqnIr G8aZ28zC293p5iNEMJ1WjLKn3fHm9ykZZIGjPEe tCuB/g AikdSWXgaQ y3wDkDxu3K7gLbbrdPK1zofs55ziVNIRnSlDzpwndEivSH7WmmLFOUfiJuwfnJFNKs5bBIKOb2xDygqOtzFZREkhrOyTXpxLcfg2q4/.../5sZnn1QRo

http://viber.ar.1800download.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhnyas6H7KB2sTS35you2dBNJ0Ltev2lbSb 0l8bOGWGCb/4ROFigatrh8yfDR6Z/D3zT0zzsmnp0qmEvNKbm2JPq4dW2gcXFhXyTns1ipZhqznxGWmfSq4JgIe4dWIVY A4LhwNO63xU316fcWNLBkonv6nAC1mcoL4w6psUD3l9Rndl7xmB5ivMJv6fXof1cS3D wknRQd/.../5sZnn1QRo

http://viber.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylEBn3ZtXatuh152f0sDcx2dBNJ0DtevylYSfjhxdKOSCGGOO1Xuxj0bIjzsCXFQ6T iv9BVT8 3G7geeH94WNg2gIq5Q0iUckDSTySF0g0IZp4H6yD3GSA7ZfwtWhbmMVY/o4KhIdNq/1X3Jtc43EJREw1fiwAC1mcof4w 42HGL5uFnFjrw1UIC2KcivZ3of1cC9F/.../O IWB5Y2enUhuvCvHghqzRyy3c8AVz7qRQfyqYjl1QRo

http://viber.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv I253eq ysyl4pHaAW7erC/NXa20hIBYDbOCeLkErc90f0k1s3eDQ2b7S7qBwX9u3Gt0qyFvNKbm2FBs5YzkV4BXnWtGH4swNEivSH/UHGcQL5VwNXqdD0BYqtkcERbZu3lXTl1esTcLhgwh LuFCw3Lc2yiK9gHGLjuFvLnvdrB5a6ccalLHtY1dPrRLVxjRZW54n5h0qeN/gg1U/.../4 pDlzwRo

http://viber.ar.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsnV0kOjilERDga5/ZtukkrjyqsGMrwdoGJgTtbLHuaSrglUZTcWmNH O1fuxllvsDkYLYRxLEt3rqBwX9unGt1LbDpZrSlmlZ5sxu1woFF2SsSTR0lMk7qnK5Gj/.../5sZnn1QRo

http://viber.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylEBD6aNzQseh152b0sCsrn8kFdE3mYLC/NXC20g0BZnGHWOOlEqc0wKtrh8yfDR7OvD3zT0zwsmn40quF8Z6bg2gIq5Y6kRUbAGSsSTRwntEs/inzUnGSA7ZewtWlcyUMK7MzJQoOIaS0XHx1apiRek93zrPvUSwncpf60v8 TWO5uEiJxat D9G3dsi8bXNZ28S0D JnlRkf/.../liisEakEvJL5ICyt9tGOz2R1db0AT4U9M2136aHnQUsoy1TsxdYHGSnrFEuq8c m1QRo

http://viber.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6V7LFjr3f14WJxwclOdBP1Y/j2OnmuxVRaO2ueEKqtHr8llvEgnYTIFQfI9S78DkHwsH26iPHa7dPbm3ES MEiiBZIVny1CT1nn4Aj CHoDDzFFOke2syiPTUNerExPRNMOa39RCU8asWNLBwonua9THJ6P8bg2q4/DWOo8QObjvQ1DpO1e4GkbHtOmZjpD JnlRsf/.../iFz9Z7h 1CaiCd0Lt5vuUXKquZCUkD5GPuQWB dofTpjrrfvSAhqzRyy3c8AVz7qRQfyqYjl1QRo

http://viber.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklYyNSrBQUqnIr G8aZ28zC293p5iNEIJ1WyIPulfSauyw1SM2eOE GiEbQ2wLIjzsSXFVPS7SS7BkH9qjzm1aGO6ZrKmiBBop8iwAwWRn3 AD99n4Aj/yvwSDfAA/wAmY6kdWsVY/o4KhIddfalAzhtc43EJREwyviwAC1mcoP4w 83C22/u0jE3/VuDoD5NNClLHtd1dO8D JnlR4f/9Gk2UrzLaB3nT6lAN1Wrc29SWu/.../kxdYHGSnrFAjzoZPs1QRo

http://viber.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PTK1EBvga5/Zs kkuC2 yon2dBXJ0bjarP0NnK0xFxTcWmPEfvkQeElyOBqxc6WRAaS9T24VRLlszi1jv/Dq9namGtZqtY6h19QAi/7Xyx 18ko iHoPDrLFf4/.../j138a6NnnG sAMVPt57vUXKquZOaiC8jdb0AT4U9M2136aHnQUsoy1TsxdYHGSnrFEuq8c m1QRo

Remove vibersetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.