home

audacity-win-2.0.6.exe

Audacity

RICH MEDIA SYSTEMS INC.

The application audacity-win-2.0.6.exe by RICH MEDIA SYSTEMS INC has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from audacity.joydownload.com.
Publisher:
RICH MEDIA SYSTEMS INC.  (signed and verified)

Product:
Audacity

Version:
1.0.0.0

MD5:
2c4a9e9fdcf7086e9f77d0124daa35bb

SHA-1:
4f942785a837153cfcc3d7be14ba557f08aff255

SHA-256:
02bfa26bfba237ae114d6a3ee7e83831fb50d883ada607a35ceb9bc807a890d4

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
5/5/2024 12:58:09 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.RICHMEDIASYSTEMS.Installer (M)
16.2.21.7

File size:
415.8 KB (425,768 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\audacity-win-2.0.6.exe

Digital Signature
Signed by:
RICH MEDIA SYSTEMS INC.

Authority:
Symantec Corporation

Valid from:
2/16/2015 9:00:00 PM

Valid to:
2/17/2016 8:59:59 PM

Subject:
CN=RICH MEDIA SYSTEMS INC., O=RICH MEDIA SYSTEMS INC., L=HENDERSON, S=Nevada, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3F87144C25AF8BCF29F29C5A1FEEF4BA

File PE Metadata
Compilation timestamp:
5/19/2013 8:53:00 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:kiucV6l4g56yAriAE4dzdr1tS++FlnXifEAI+aAVCViBHgb2ySFqMmUechGR/OET:kiuV4hyArNdr1I+GDHgpFNegGR/hiXS

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file audacity-win-2.0.6.exe has been seen being distributed by the following URL.

http://audacity.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjyiGxrzY9zRveh152P0sD4tl49bb1XsK7H/NWG9wVdKOSCGGumtCuFugPk8lY/YRVCD9GzyBEzl6T7r2qaI6pDKmiBBo58ixxFQXzWtCzRnldEivSH5UHHZGehOw4TrND0Vark2PRNMOaz9RDwmLNzFZREkhrPmECMmfIDg2q4/DGOo7Rndl7xmA5ivN5vwOy4bnNO2XuMnlQ9MtNzvhhvybKBnlCu0CIxX6s2pFSC15oOb2SYiZbxRFMFpaCx69Ku6WkM/.../44JDnzR1mZybWszMe3NKe

Remove audacity-win-2.0.6.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.