home

teamviewer_setup-iqy.exe

TeamViewer

RICH MEDIA SYSTEMS INC.

The application teamviewer_setup-iqy.exe by RICH MEDIA SYSTEMS INC has been detected as a potentially unwanted program by 13 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from teamviewer.1800download.com and multiple other hosts.
Publisher:
RICH MEDIA SYSTEMS INC.  (signed and verified)

Product:
TeamViewer

Version:
1.0.0.0

MD5:
b3a72b5f066ebfddfe76629974bbbdb1

SHA-1:
dc95cbb06261b7efc4e29f8bb322c20df2d4ba06

SHA-256:
01af43f82b3b4f4111b1fd9f4dcc527828c2d0ea4d9ec872c130d1af046a7370

Scanner detections:
13 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
10/12/2025 8:15:25 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AVG
OpenCandy
2016.0.3150

Clam AntiVirus
Win.Trojan.Agent-855157
0.98/21511

Dr.Web
Adware.Downware.10304
9.0.1.093

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
9.11416

G Data
Win32.Adware.OpenCandy
15.4.25

K7 AntiVirus
Trojan
13.202.15462

Malwarebytes
PUP.Optional.OpenCandy
v2015.04.03.05

McAfee
Artemis!B3A72B5F066E
5600.6806

Qihoo 360 Security
HEUR/QVM42.0.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.RICHMEDIASYSTEMS
15.5.8.23

Trend Micro House Call
TROJ_GEN.R02KH05CV15
7.2.93

VIPRE Antivirus
Trojan.Win32.Generic
38990

File size:
418.1 KB (428,104 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\teamviewer_setup-iqy.exe

Digital Signature
Signed by:
RICH MEDIA SYSTEMS INC.

Authority:
Symantec Corporation

Valid from:
2/17/2015 2:00:00 AM

Valid to:
2/18/2016 1:59:59 AM

Subject:
CN=RICH MEDIA SYSTEMS INC., O=RICH MEDIA SYSTEMS INC., L=HENDERSON, S=Nevada, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3F87144C25AF8BCF29F29C5A1FEEF4BA

File PE Metadata
Compilation timestamp:
5/20/2013 2:53:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:EiuILhW+Ls8ta7oouCL0BVOaZxunI6VWRoD:YILhW8I0hVZXuI6AR6

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8261

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file teamviewer_setup-iqy.exe has been seen being distributed by the following 15 URLs.

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PjK1GQr5I9bRv/Fprnf14WJ1wclJdBmzN/y/LXj/yldSIDrVT/usW781yatjx9SWRAaS9T27VRLlsyK1iv3a7dPcm3Ed MllkV4BXnSjACwxwZJ0uHKvHTbbL/8JjIKhKm5GIadnZ00dOOz9UHBtLYaOf1l3nqq9GCcheo3y1 0zDGyx8VDMlu0sXcave4GkbXtO3civFqounh0f/.../44JDmzR1hemDP 2AV18vSInnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhv4cp K4fE9tG//qmMxwd0EPxKvKOK amG3mV5ZNmGKGu nHLM/yPpqx8yPR1XF7SS7BkT9qnm2mf6SpNrSgzoS9Yc7wF9AXmSkCSx 18kq9Dm8AzeLS/9Wzs3zNTUCar80PRNMOan9RCwgJJqbZAkpz6vlGDQkao6x2 8/HDb5oFGMlvhmFtXkLpbxKDJO1IK3HOkujUlMrsih3BG9LPZnnG sAs9X/.../5fCsXhBjihyik4gVTmq4U0qm4fWnkktgfm d SMKiJGGInnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsml0kPTG1E1v4Y9bB9rpi/26nqGl6wJgEL031N/juNDC2x15KdTrST7bgW6c8gLNhxMyPU1XSv3OpRQO15Gm0yP/QrtPK1TYa/NNp1hIXFmSsSTRzntF/oXeuDyGLS/9Wyc3zNiUMK7M0JQpae uFC9tc5fEJx8giqHtFyAkcI6x2 8/HC3 oFGMlv5mFpOve4GkbHtOhpjpD JnlR8f/4v n1O7ZK5/hXr/.../VInnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklUyNSrjTUmvJoWG8rZ0giar5i0y1oJPZFmyIO7uNDC2w15KcTrYCeL ErQ/yPpqwsyPUVPNq3q6Hk20snq1mfTDpZrSk2lZ/tYiiBZIU3y1TWcrwJxuvTnxGWmbSq4YjNXqdD0GYqszPRNMOaz9RDwmLNzFZREkhrPmECMnfoPg2q4/CGOo5xKPxb05FpnkesOqbXRU28O5Hu0v3BcW55qk1AzqZel/.../jNBmoyRInnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklUyNSrjTUmvJoWG8rZ0giar5i0y1oJPZFmyIO7uNDC2wVRSIDfVWKn7SfxygeVyz4WXBgyb7WutXRux4S743rfDpZrSl2lZ98ps1wAARn3kAD9/hsI79WjwWGmLH/9Ow4TrMD0VL Bse0dIcL38FXB9ctyKYgkpz6vlGDQkao6x2 s/.../hS6vEcQe5MSxUSCw54Ob2SYibaRARpY2enUguvDhRE5zhVW60ddWES7kBAv1sZGnzQwvLDGd7HgfhNPSOHnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PjK1GQr5I9bVv/FjpSWn4D1gwIIELEPlbrv7O3e6yV8bOGCGCar TKc8mrNhzM3eDQ2R9T2sVQW35Cr2zreNvNKbm2JLq4d01gQfEi/yTWs3hshq9CjwSCPAFK5Xi83jPSUFYas5bBINOb2oFWh0O8TJLAll1f wTWFmao6x2 k/HD/j7g/.../VInnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxLzYNbB8bZnsCOn9y8nickFbk3hYqmpdzPlggFKOTqGGu2lH7YwyrBnxc3eDQib7XmhUBPlszi1ifHbvJ2NwD4N MB31hctFyPjT35ozYJg4H6yD3GSA7ZfwtW4bmMVY/.../VInnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/yOn9np5iNEIJ1Xlar7 OXWuyxdSMWmeWLDzCr5uybhoz4WXBgyb7XuhTwar6TL6yanDpZrSkGNBs9Fl0ggEDSPgX3xnn4Aj/.../2zFYvP3bGvmkd39HQOXnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PjK1GQr5I9bQv/FwtDHsqSt4zdEcL0Xiar36LXj/ylZSIDzPCeLkErI90f45mpLCQE D9GzyDkzl/D tgLbbr9PKkHFA4p82iUcXHDb SGtnn5oj/y/4UmeRQrhawMyiPTQNevprewoEaqX2XnE8cs3ENEJ72LPvUSwncpfx0v8 TWO uEiZxaM5Fpn esCqZWMYipDgW7Bx2EhXgsuoyR24c/.../jNBmoyRInnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsml0kPTG1E1v4ZtbB4Kt2tCersGMrwdoKL0DvaLL7Nna3g15eOHHaRLXzTfclyPpqxcyPBh6avCX7BlSx4S tgLbbqNPKk2FOo5M2kV4BXnWtGGcswNEivSH4UHGaQ65Xi83jPSVDLKs5bBIOOb32RHE8csrENE170PT2GWUveoH4w6lgXzT86w Iyb0DR8f5NYKzNjAVwZT1SPsv3BcW55q 1AzqZfN/.../jNBmoyRInnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsml0kPTG1E1v4YtbB8ack5ib0o2JgyskFbk3kYqm/Zieuyw1SM2uHWOOkEqdumu1yz4WXBQaD/CzqBwX9vnGt3aqN oyag2gIq5Q6kVRQXzWtDDRnwYtpp2mvSGjASr1YysHlNz8Abrg5bBIOM6XlAiM8OJKfb15g0LPvUSwkeI/glbhkUy/j5x2a3u1nR5i etDoNiVO1IK3G M2nR8Q7477n1O7ZK5/.../X5pP5YSxQX3jodXFy3FmPuMEEMZSeipn9aK6RFsokEP4gs9PUCbjDB s4IjvhAUiNGCD4TRAgp6QInnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKlEgqtI87Y9ukx53e5 zYmlJxNP0ykYr32LSXjnAANcHGHWOOmEqc20bIjzsWXFVXIqz3zT0z1smm8iOfa7dPbm3EL MEiiBZIVny1CDdnn4Aj iHoDDrFFa5Xi83jMz0VLOxjcl5WZuiiFBU8LYqLZgZ7zej6R25wao6x2 4/HC/j5kjE3/VqDoC/csesaXdO1IK3HOkujUlMrsih3BG9LPZnnG sAs9X/IPuEiSv6sTXz24ybPVJR44vfTsxu6GtHBBzjwS7lNdCGT60Tk2q4c/.../aMHnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhnyas6H7KB2sTS35you2dBNJ0bnYqm4aiLhhg0NdTbOCeLkErc90eYj1s3eDQub7WihUhKo/zitgLbbqtPKxzoX9Ic7wF9AUHy1TmskyYVwq2yvGAzaFfgZiNq4dn4ZPfFnPRNMOaz9RDomLNzFZREghrPmGzQuO4/.../9jUTXu5xjdl7xmBZivcdClLHta1dPoVal93UgH5tH3jFz6aaJzki6hBsQe5MSxUSCw54Ob2SYibaRARpY2enUguvDhRE5zhVW60ddWES7kBAv1sZGnzQwvLDGd7HgfhNPSOHnl

http://teamviewer.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylEBv2YN3avOh152b0sC4rn8kFbk3hYqn PXa xlJKOSCGHeO1Tuprl wi1s3eDQ2b7S7qBwX9unGtz7HDpZrSkGlZoIc7wF9BXmTkU2pnn5oj/.../lSa0AMxP5YSxQnnjocXJ2Wx8Nv8GB9gvMjwpseKtD14030v2jogDRm7zDU75oJD2h1ZxLHmHsmgez9vaInnl

http://1800dcdn.blob.core.windows.net/dir195/wi/18/33/.../1/teamviewer_setup-iqy.exe

Remove teamviewer_setup-iqy.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.