home

install_reader11_uk_mssa_aaa_aih.exe

Adobe Reader

RICH MEDIA SYSTEMS INC.

The application install_reader11_uk_mssa_aaa_aih.exe by RICH MEDIA SYSTEMS INC has been detected as a potentially unwanted program by 14 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from adobe-reader.1800download.com and multiple other hosts.
Publisher:
RICH MEDIA SYSTEMS INC.  (signed and verified)

Product:
Adobe Reader

Version:
1.0.0.0

MD5:
ff66f5a29ba0bbae5de1a32bb499202a

SHA-1:
413755eada6c6358822ae751ad537747cadeef0c

SHA-256:
bd75859a21429f4610e917a6683b5214a735ce6844301e6027e676c03367471a

Scanner detections:
14 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
5/15/2025 11:23:12 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2015.04.21

AVG
OpenCandy
2016.0.3101

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.15522

Clam AntiVirus
Win.Trojan.Agent-855157
0.98/21511

Dr.Web
Adware.Downware.10304
9.0.1.0142

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
9.11503

G Data
Win32.Adware.OpenCandy
15.5.25

K7 AntiVirus
Trojan
13.202.15652

Malwarebytes
PUP.Optional.OpenCandy
v2015.05.22.04

McAfee
Artemis!FF66F5A29BA0
5600.6757

Reason Heuristics
PUP.Installer.RICHMEDIASYSTEMS
15.5.22.16

Trend Micro House Call
Suspicious_GEN.F47V0330
7.2.142

VIPRE Antivirus
Trojan.Win32.Generic
39520

File size:
415.7 KB (425,664 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\install_reader11_uk_mssa_aaa_aih.exe

Digital Signature
Signed by:
RICH MEDIA SYSTEMS INC.

Authority:
Symantec Corporation

Valid from:
2/16/2015 9:00:00 PM

Valid to:
2/17/2016 8:59:59 PM

Subject:
CN=RICH MEDIA SYSTEMS INC., O=RICH MEDIA SYSTEMS INC., L=HENDERSON, S=Nevada, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3F87144C25AF8BCF29F29C5A1FEEF4BA

File PE Metadata
Compilation timestamp:
5/19/2013 8:53:00 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:iiucV6JgYSccDbhUwqQdQqxcAeO4huaLQO5LQCqy1zRSuQy5QJzgpLkORdX3:iiuZSdDNT5xDu4oQDtiRSuzpLkEd3

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file install_reader11_uk_mssa_aaa_aih.exe has been seen being distributed by the following 22 URLs.

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxLzYtbB5LdpvzDj4D0jn45MP0ykYrn2LSz/0l8bOGSGCa7 RuFohPpyz4WXAwaDqXakWVT8 3G8jf/D94eb1TIX/fpy1gQWATSmC1Ewz6x0vWirNTLIEdMNkZ//Yn9SerJxJRsFIeyuAmh0IcTPLhBhhqfuAHB6JNGnk/8 TWO5uEjOm/.../5nnG sAcVP7cSpSDrjtZuCz2RgPvQWV49kM34nsuqhGRhnjha7lNdHGT6hX1nhqNnuxgU3NmDP 2AX18uVaSa6TgLXjvBtawDy0SXXFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDu1E1v4YtbB8ack5ib0o2JgyskFbk3lYqmjfGG3g15fOHHLQrfzR/J00bIjzsCXFVnZv3a6WVT84XG j/fZr9/ZkGNJqtY6gF9QFC/zGDU2nsIj7CPoUSCTQ7ZOi561JTxeYrg6JFsFN6XlACMjLdzFZREhiqv2S3hmPNSujYJ3Wzju5xjOnZApX/3gM4H/ACANjq7sRLE6ylVA/4O h1n4ZLghzm/.../bC535aC1FllriByigYIYR3mjFAawqZnu1Q4iNmDP 2AX18uVaSa6TgLXjvBtawDy0SXXFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKhEgqnKJyK97Yk5jz0o2xww94NL0PlYbC/NXG20gsbIGjPEe6tCvJune0/g4WPDE b SXqWhmr7C79mf6SpNrSg2JMqYc7wF9BXmT U2pnn4Aj/.../9Wy83zcW5TerJxJR4FIa31VH57eNzFZREmhrOyS3pwao6x2 4zBHvj7BmLzaMwa9DoIZb7LXBdsITmcrRn3Ex6vNms4gmhNrQg33m0CIxX78exUS2w8NHMy2VlJepRTsc3OH0porPzQkg0k1TlhokRUT7qRQfxqYiggx0ufXjFsngVz9KQOnGiVwGE3Oh0Kgjx3zPfFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhv4cpqK4fE9rm/4qHpwydkKKUf1Y/j2PXmunxdKOSCGHOO1X xpl Ynh9SWRAaS9T24VRLlszi1iv/DpsvT0mlNq4dlyxUbFiO1AWd/lccr9iP/XmKeQ7cfwsbhPSVTMfpyc0lGdu2rRHE8cs/MLAlz2P62RztnLdSmhK8nBSqwsVDd36Y4FpnkesOmZDJW3MuvRLBwjRZW54r3n1v7fKE2nSqsEZkCspPuAWvi8JuTkD4hYL5RTsc3PXUx5rv7SAhqzRyz0ddWSnKiQlyv//Wmkl5xazDFuQVRhraOczH5KhCM2ZUuMFrugGmCFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKlEgqtI87Y9ukx53e5 zYmlJxNP0ykYr32LSXjnAANcHGHWOOkEqc2xLFyz4WXBAaDpnasHk20snm1mfbSvNKbm2VBs8B4wwwAAWSsUzR0kMEh/SnyU2acS/9WycfrJWNeK/luflFKcfPlXTl1eczENEp20/OxD2RwKdGnk/8 TWO4uEiL2O1nR5i8etCvfXof1cW3D799w0gH5sv3jl7yfPMr1Gj3X5MyrJLqFyyrspD/.../A08p2wS7lNdHGT6nX1nhqNnuwQU3PHDGvG4Uz9KQOnGiVwGE3Oh0Kgjx3zPfFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKkEgqyOYjBvqA87G/.../uNDC2xl5KMGGOH 2nCr50yb1q1pDEW1mD9GzyD0D9qiLhyLGA8oW30zYa9cByglQtES3IV302xax4r3qVCzrBXukUndXqdD0FYqt2awoEcKX2XGh asWNLB0onve7TnJwOpf5kuc2BHu7tVLdl7xmB5ivKZv6fXof1cO3D onjRZW54r3nwe7fKE2nSusEYgEsJPkBDr7uNKanCYyMv4DHMZoK3R6uuOjHxJnhxS10tRPUCbgBgfh98Onh1N0dzeG5HgfntPSMni6FBWC2q9iK1ehgXSVFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GR/6cteQv I253eq ysyl4pHaAW7erC/NXK ykYJZjzeTvTlTeRjlvtyz4WXBAaDuXasHk20sn21mffTrN3ckXFA4p80iUcUDSryGDU2nsAv9DmjBCDdEeAAp4W0ZmNSKrgzQF1UXPK0FSsQKZ fSUp71L xWnM3c8b40 cnSi2ouRnFnfV BYC2M8itZWMfhpWvFrAunhUeroL h0qhN/.../44JDjzR1iZyyQ5y1Xz9KQOnGiVwGE3Oh0Kgjx3zPfFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsmV0kNyqsWxLwas6X8fE9rm//qHpz2dBNJ0Ttev2la2G3g15eOHGOGeujHLUlyPpqwsyPUVPNq3q6Hk20sni1mfTWpsvT0mlJq4dvwEdJF3ygACwyzZ19oWy5SGjaSr1cwtW1bnRHNOh7alpTIaS0XHt9ctyfckRw2bymR3dxLcfg2q4/.../4 pDlww0tPHPHu2IU1prZM3i6HBiJmvE8YwD6xyLUFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklQwNSr Rlu2MYCP2qFjvDGr4GlzpJ5VQhqkK qTbiLtrwUBan3ZU7y1E/Y9wLNynZ/JFQfS9S3yHkX0qnD8gfbbvJ BxXFA4p82iUdAVnSjDj5nn4Aj/CHoBSCLS/9Wz83zcG5ZPOZ1bAoEcKX0XGg8IZrcLUIojanvUSwncpe2lf8 TWO7uEjOjvQvDpS3YpTxMyUJndO2XuMnlQ8U6oDvhhvyb6p/.../QI8Bv47 ASX7uNKamy4qdecXGtZoJD124bbyXwhqzRyz3c8ESnjzDU75opD2zx0ufXjCsnhBlZmKcie6ThjXif59YQXz1STSAwF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklQwNSr Rlu2MYCP2qFjvDGr4GlzpJ5VQhqkK qTbiLtrwUBan3ZU7y1E/Y9wrlq1pLEREzNrma9Thrlszi1ivfbvIiMzjEevNdl0gEXFmSsSTR2ntFwp3/.../Ge0kjRZW54r3nwe7fKE2nSusEYgEsJPkBDr7uNKamSYyJO8XV49kM34ru6GtGxBz217wjp8RASe4DAz3oZLszw0kNnfP 2AS18uFby78EAPPg7l1agji1CbfFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDu1E1v4Y9bB9rpi/.../ylVSIGueEKqtGbU90e05h4bBVkXUvXPqBwX9uXm1maSF8YuNjCEe8MFlwUdJF3ylACwx0NEivSH7UHGYUrcfwsHrJWJPKOBwegoEaqX2Unh3fczHJBwjh LuESw3Ptymw Z2BG woFjNnvtoBIC2M8isZWMDnNO2XuMjlQ9StNap0h 7fKE2nSisEZkEspKpSDrjsJeaiHV JPISGdhSeypy5LflHBsOy03fip4HQkOwV1yc8sO82Vpta2DP 2AS18uFby78EAPPg7l1agji1CbfFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GR/6cteQv A8/yan9np5ktEPJUykYrn2LTf40l8bOGKGCei1E/Y9wLNygp/JFQfS9SnyHkT1un 7i fa7dPam3EU4oc7wF9FXmTgU2Ahy4Rq7CC5UGKZSq4IkYSha2ZOLftuPRNMOa71XGguLJGccwZg2fCwR2Q3c8b41 cnWyH66xiajvQ1DpO5csqpb3Ne2cC2XuMnlQ9VtNzvhhvyb6Bnnz6tQMVe5NXiGi37uNKamCYyZLVRTsc3PXUx5rv7SAhqzRyz0ddWSnKiQlyv//Wmkl5xazDFuQVRhraOczH5KhCM2ZUuMFrugGmCFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqlHBzycteQv U8/.../giLN2Sjjm7jWNya44UdC8ca3rNB4BnILscrh1znJEtNDj2BCtfKE2nS sEYwEutWwGnPou5rTkC4qdfIHV49 M34pouO1FllriByigYIYR3mjFAawqZnu1Q4iNmDP 2AW18uMc2CjBkvagug4MFykimaUFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxLzYtbB5LdpvzDj4D0jn45MP0ykYrj2LTDllEZTa2mNE LkErY90f85kNSWRAaX9T36DkTzvHutgLbbrNPK1SdZqtY6gl9QVWSsSTR2ntFwp3/oUSCTQrZOy8TzPHQNbrMgelBPau2iRHEmcs/KJBwqhKHmECAuO4/w2/9qTXux8VDIlu0rXczpL4XtfXof1cW3D799w0gH5sv3jl7yfPMr1Gj3X5MyrJLqFyyrspD/.../A08p2wS7lNdHGT6hX1nhqNnuxgU3NmDP 2AS18uFby78EAPPg7l1agji1CbfFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylEBj2Zt/Wtuh152b0sC4rn8kFbk3hYqn PXG4xFRKOSCGGeO1XPElyPpqxcyPBh6avCX6BlSo 2m0yP/WpMufyD0f/.../kSa0VZABupL5UXKquZKaiC0nb6RIBo4 M21j6ba1Fllrjxyi389PUCbgBgfh98Onh1N0dzeG5HgfntPSMni6FBWC2q9iK1ehgXSVFgF4

http://adobe-reader.1800download.com/get_azure_file/.../bah9kSutQMVb5NXtHCW95tOCkW8qZLxRRIM1K3RguuCtD14lnB3z3dxOAS3zDU75oJD2nlZxLHmHsmgez9rQInnrT0LXmrkmPRD7jCvWDAF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKlEgqtI87Y9ukx53e5 zYmlJxNP0ykYr32LSXjnAANcHGHWOOkEqc2xLFyz4WXAQaDqme4VQSiqnDmgfTVrN7RlmRJo5c7wF9GXmTxU2Ighshq9Cj8UHHAHv8YmZu9WHVSOe1nbRkOXOqsOSc8O5 hd0pz4/C9SjhwMNDg2q4/.../WptP5YSxQXP7sJKCkW8qZLxRA91pK3RguuStDxhjjBK0189PUCbgBgfh98Onh1N0dzeG5HgfntPSMni6FBWC2q9iK1ehgXSVFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylHx37YtvXt h152b0sCgrn8kFbk3mYqn0LXj/yldSIDrVT/usW781yatjx9SWRAaS9T27VRLlsyK1iv3a7dPem3Ed/slk1hdQXzWtCTRnlcQh7CC5UGGTUvgY2syiPTYNerggJFsFMq/.../Yp G7zUpsIrMa6LDyy3MzT2X1PNucSKtVkYWF2 Le1FllrjRyikYQQASeiDAv5sZjmxQshPmDP 2AW18uMc2CjBkvagug4MFykimaUFgF4

http://1800dcdn.blob.core.windows.net/dir195/wi/18/33/1/.../install_reader11_uk_mssa_aaa_aih.exe

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GR/6cteQv U8/.../shwm60CIxX7M2pHDr7uNKanSYyIO8dEdt6em0o8 ilFwglygS7lNdFGT7gFAawqZnu1U98amDP 2AV18vbInnrT0LXmrkmPRD7jCvWDAF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/zyn9np5iNEMJ1Xka6n3fHm4ykYOaz/ZCeLkErYxyas5moXZVlDNkG2tXRKi nq 5LCKwYSb0jIk8MRh7AQbDGjyQmtnn4Aj/.../Mz4SXjruYPBznNyMqsBENVpbD0xu6GtGxBz217wjp8RASe4DAz3oZLkwwcnPHHP 2AX18uVaSa6TgLXjvBtawDy0SXXFgF4

http://adobe-reader.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/yWn9np5iNEPJ1XverC/NXG20hAcIGjPEeitCrQlyPpqx8yPXlXF7SS7BkT9qni8mf6SpN3SgzUS/.../VtBpivIZbxPSRBnZTsSbxmjRZW5473nw2wLvM3wj6tWsVc6sWzQHHutZKUkW8qYbxRE9thbSphounkFxlrnBe3389PUCbiDB 1 s72zEwvOHjWumgW2d3TInnrT0LXmrkmPRD7jCvWDAF4

Remove install_reader11_uk_mssa_aaa_aih.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.