home

minecraftinstaller.exe

Minecraft Client Demo

RICH MEDIA SYSTEMS INC.

The application minecraftinstaller.exe by RICH MEDIA SYSTEMS INC has been detected as a potentially unwanted program by 21 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from minecraft-client.pl.1800download.com and multiple other hosts.
Publisher:
RICH MEDIA SYSTEMS INC.  (signed and verified)

Product:
Minecraft Client Demo

Version:
1.0.0.0

MD5:
8d8297671bee13760647427a97a4f25b

SHA-1:
ac28b2b775bfc8d463e8edfb22acd012672cd01d

SHA-256:
0ddcaa0f914f673771b07f9019ce07a2aa085095c277bc68a83ceca0d9abd99d

Scanner detections:
21 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
10/12/2025 3:28:09 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2015.08.10

avast!
Win32:Malware-gen
2014.9-151016

AVG
OpenCandy
2016.0.2955

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.151016

Bkav FE
W32.Clod8c5.Trojan
1.3.0.7062

Clam AntiVirus
Win.Trojan.Agent-855157
0.98/21511

Dr.Web
Adware.Downware.10304
9.0.1.0289

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
9.12067

Fortinet FortiGate
Riskware/OpenCandy
10/16/2015

G Data
Win32.Application.OpenCandy
15.10.25

K7 AntiVirus
Trojan
13.207.16831

Malwarebytes
PUP.Optional.OpenCandy
v2015.10.16.12

McAfee
Artemis!8D8297671BEE
5600.6611

NANO AntiVirus
Riskware.Win32.Downloader.dqybkl
0.30.24.3079

Panda Antivirus
PUP/OpenCandy
15.10.16.12

Qihoo 360 Security
HEUR/QVM42.0.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.RICHMEDIASYSTEMS.Installer (M)
15.10.16.0

Sophos
OpenCandy (PUA)
4.98

Trend Micro House Call
Suspicious_GEN.F47V0401
7.2.289

VIPRE Antivirus
Sevas-S Installer
42736

File size:
415.7 KB (425,712 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\minecraftinstaller.exe

Digital Signature
Signed by:
RICH MEDIA SYSTEMS INC.

Authority:
Symantec Corporation

Valid from:
2/17/2015 1:00:00 AM

Valid to:
2/18/2016 12:59:59 AM

Subject:
CN=RICH MEDIA SYSTEMS INC., O=RICH MEDIA SYSTEMS INC., L=HENDERSON, S=Nevada, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3F87144C25AF8BCF29F29C5A1FEEF4BA

File PE Metadata
Compilation timestamp:
5/20/2013 1:53:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:fiuB93q/bTmFLpVGP/n1l/+SbP4Ae04RSkqIvGA:hW2FXC/1l/+CP4AezSkFvP

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file minecraftinstaller.exe has been seen being distributed by the following 5 URLs.

http://minecraft-client.pl.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylERr1YNrSvOh152b0sC4rn8kFbk3hYqn PXa5wFZKOSCGHeO1Tuprl wi1s3eDQ b7S78DlT8 3G8geeR943KmiBBpJ8ihFdKVn 1AX1/lcMj7H jGSPFEfUZipvzPHQNab84PUVWbfqkFCspPNOdekJ30uX2GWUveo/glaknBSqws1Ddne1nR5i5etD4Ni0Jzcr F smlQ9otNao3hqpOO4MyW/.../c67gEw3NTHOu2AGhICHInnrT0PXmvl8ewm9

http://minecraft-client.pl.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklU0NSraQUanM56C46dPsya68zQunpkQeA yerC/NXK8ykYMayDMR7juXfdr0bIjzsebDR7MpnGtXwSm7j i2KmI 4ecg2gIq5c6kQoBRn3kADl/hoRwoH lHSCLS/9Wzs3zYn9HMftnPRNWOa7zVHN8f87IJhkpz6vnGDR8IdHg2q4/DGOosVndl7xmB5ivM5v6fXoF1cC1FqounBcHrdGpn1O7ZK9/hSukC81U/.../rFAz3oYjvhAUmNGCC4T4G1prZNni6R0PYjfp9ewm9

http://minecraft-client.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklU0NSraQUanM56C46dPsya68zQunpkQeA yerC/NXC20hIBZnGHWOOhEqc1wbxlxMSPDE b SXqWhmr7C79mf6SpNrSg2JPo4c7wF9AXmTjTix 18ko9Dn7SGjaSr9W2oe4YyUMK7M3JQoIMaf1X2h0O8TNLAl71fX2GWUveo/.../6bf5WQhqzRyy3c8bUD7qRQf0qYijnlFxYTWHqmFX19rZIjHxEVPW0fB YQm9

http://minecraft-client.pl.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKhEgqkP4CH4KEk5ib0oWJgyt8MP0ykYr32LSb0gA0aZ3GHQuOmHLc xbhmw8OaDE b/.../D6YCGxTwM4oc7wF9BXmTnU2pnn4Aj yHoXWGRQrVOw4TrNjcNeu1rbFhTYuayFCZtc43EJx0onvy9THN2OtSklfBmUjDv7B7dl7xmB5ivKZv6fXof1cO3D onjRZW54r3nxy8fKE2nS2sEc5P5YSxR3P75cjMzz4rJLxBR44vRCZ95bHlTEwl90jzk4wYT3mjGFi79ojvhAUmNGCC4T4G1prZNni6R0PYjfp9ewm9

http://minecraft-client.pt.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GRzwcteQv A8/yan9np5ktEPJUykYrj2LTPllEZTcWmJEfugGr01yqtrh8yZDR7HpnOtHk20snm9gees94eNwiEa99FJ3RYGBSr7X3xrwYt87CC5UGGTUuMf2syiPTANev5rcUxQdOzlXTl1fsTcc1Ni1eOxAC18coT20 QwC225s1zE3/VvDoD7KZa8ZDJW2cuvH shmh0X/4O h1ryfO4xhSflCc5X/.../8OxmUs3NTHOu2AGhICHInnrT0PXmvl8ewm9

Remove minecraftinstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.