home

vibersetup.exe

Viber

RICH MEDIA SYSTEMS INC.

The application vibersetup.exe by RICH MEDIA SYSTEMS INC has been detected as a potentially unwanted program by 17 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from viber.1800download.com and multiple other hosts.
Publisher:
RICH MEDIA SYSTEMS INC.  (signed and verified)

Product:
Viber

Version:
1.0.0.0

MD5:
5ef5612301c8cf9b4b775069d098c6f2

SHA-1:
5326ce6d2603fff8cc4421fc6de495e6e155153c

SHA-256:
6207e9985dcaf2c666e24ae5d95b5fb8301f550f5831cc184659d6b7897d44d7

Scanner detections:
17 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/25/2024 6:46:44 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2015.04.18

AVG
OpenCandy
2016.0.3135

Clam AntiVirus
Win.Trojan.Agent-855157
0.98/21511

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
9.11493

Fortinet FortiGate
Riskware/OpenCandy
4/19/2015

G Data
Win32.Adware.OpenCandy
15.4.25

K7 AntiVirus
Trojan
13.202.15636

Malwarebytes
PUP.Optional.OpenCandy
v2015.04.19.12

McAfee
Artemis!5EF5612301C8
5600.6791

Panda Antivirus
PUP/OpenCandy
15.04.19.12

Qihoo 360 Security
HEUR/QVM42.0.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.RICHMEDIASYSTEMS
15.5.8.23

Sophos
OpenCandy
4.98

Trend Micro House Call
Suspicious_GEN.F47V0414
7.2.109

VIPRE Antivirus
Sevas-S Installer
39440

ViRobot
Adware.OpenCandy.425736[h]
2014.3.20.0

File size:
415.8 KB (425,736 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\vibersetup.exe

Digital Signature
Signed by:
RICH MEDIA SYSTEMS INC.

Authority:
Symantec Corporation

Valid from:
2/17/2015 1:00:00 PM

Valid to:
2/18/2016 12:59:59 PM

Subject:
CN=RICH MEDIA SYSTEMS INC., O=RICH MEDIA SYSTEMS INC., L=HENDERSON, S=Nevada, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3F87144C25AF8BCF29F29C5A1FEEF4BA

File PE Metadata
Compilation timestamp:
5/20/2013 11:53:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:biucV6xyzR6ygeVQ8kB9q+tLsSBA0tPujIhIItf7tCUbeBCkzKIg+Tvcq:biuBy96Lem8kBrtLsERZ5eBCkzF7Tvcq

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8435

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file vibersetup.exe has been seen being distributed by the following 7 URLs.

http://viber.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylERzyYdjWteh152T qHomkphOcRauLfmgLXj/ylFSICXVSbzlCr50ybpq1oXEUx6apiX5BE20sn21maOO8o2N03FA4p8yiUdKV2SsSTR2ntFpp3/oUSCTRbZOzcfjPj8VY/o4KxIdZfarA2h0O8TPIhEw6vi2R2RGLcG3kfNgRjyouRnFnvV W9Gve4GkaHtOmJjjSbZj3A8eroL h0q N/.../5sZnn1QRo

http://viber.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PTK1EBvga5/ZtukkrTyqsGMxwd4EP0LnarL0LXj/ylBSIDXVR7y1E/Y9wr1q1qDEVVnTnHq8SQbp7TPqmf6SpNrSgzoS9Yc7wF9AXmSkCSx 18kr9Dm HnGSA7ZdwtXgJTxEYrgyJQpbauy3Cis2PYySNBBhhqTuAGB8KtCww Z2BG woA H3KYuUYC2Kciva3NV28S4HuAllF4f7oLvywGsfKE2nSqsEc1f68O Smvi8JuSkD5/.../4 pDlzwRo

http://viber.ar.1800download.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqiHB37cteQv I253eq ysyl4pHaAW7erC/NXa20hIBYDbOCeLkErY90fk5kNSWRAaU9T39DET sGm0yP/SpMubyDdZqsw6gl1JF3yhACwjy599q2noUSCTQrZOwMTzPHQNa7MgdkFbIaS0XHh1as3NNBBhhqXuAHB8JNDg2q4/.../2ErzN6B0ky6vBs1Z7MWySDrjsZuCxW8ybPVJQo4vfiZ95L3gXghqzRyy3c8AVz7qRQfyqYjl1QRo

http://viber.ar.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylERr1YNnTvOh152T qHomkphOcRauLfmgLXj/ylFSICXVSbzlCr50ybtq1oLZFQfS9S7yHkflszi1jf/D IaExTYJs55ziVdIRn6kGDU2nsEj7HS5SGjaSrtW2oC4aWNYL/.../kxdYHGSnrFAjzoZPs1QRo

http://viber.soft32.com/get/file/id/.../?rel=breadcrumb

http://viber.ar.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6V7LFjr3f14WJ0wclbZQe Ku7uNCq2wVBaO2GFGO2vGr50yb1q1pDEW1mD9GzyDUL9qh3m2aCTzYyc1CNV9N1lkV4BXnStGGE2hshq9CzwSCTAHugDj4TzPHQNa7MgaUFbIaS0XHx1aszMIx8nhbPvUSwjcpekjrFhWyuouRnFnvV DJGve4GkbHtOhpjpD JnlR8f/4v n1O7ZKl/.../V91Wrc2 SWvss5OZkj4rJLxAT5Z YCsxu7utHBJqzRyy3c8AVz7qRQfyqYjl1QRo

http://viber.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PTK1EBvga5/Zt kksibsqSt4zNEcah65POS7fGG3g15eOHHZU6n WuAlyOBqxcKfDg6V Cz8CE20snq/geeF95qYzTIC5NdskV4BXnOtGHgsxpZr7CC5UGCTUv8FnNXqbj0GYLJxJRsFIe uAmh0O8TLLAknjKPtGjQuO4/x2/.../h0r7bbh 1CakCd0ZqtWwAHPouYORiCdjbbJJV9JkZSoxu6GtHB5rnHDphYgGcHmlQ03t9tKx1QRo

Remove vibersetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.