home

audacity-2.0.5.exe

Audacity

Innovative Systems LLC

The application audacity-2.0.5.exe by Innovative Systems has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from audacity.ar.joydownload.com.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
Audacity

Version:
1.0.0.0

MD5:
4252143d85e0886f290fc41b8cf3882f

SHA-1:
0bb598e0d908ea96223753c7ba7cf12114ed9aeb

SHA-256:
c2869f1c5eb1f4af7334a286a7374da8f3d296cf4164d056024f73a873e0c701

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
12/25/2024 12:39:28 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Innovati.Installer (M)
16.3.16.6

File size:
496.7 KB (508,648 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\audacity-2.0.5.exe

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
Thawte, Inc.

Valid from:
9/19/2014 8:00:00 AM

Valid to:
9/20/2015 7:59:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
09A91C40EAE34E72CD975B0B218AE4BA

File PE Metadata
Compilation timestamp:
5/20/2013 7:52:48 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:kQa4hphPVDQG3AWM20Z5Ni5NhOxD40OTSAHxmjEZzLw:VHhPVQ8fM2N53IvO20zBLw

Entry address:
0x331F

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, D8, 7A, 7A, 00, E8, A8, 2E, 00, 00, A3, 24, 7A, 7A, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, D0, EE, 79, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, 20, 6A, 7A, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 20, 7B, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8452

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file audacity-2.0.5.exe has been seen being distributed by the following URL.

http://audacity.ar.joydownload.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL6as6C8Ldnvjy663p5iNENJ1WhMe/uNDC2w15KMGOICeLkErY90fo5kNSWXgaQ9GzyCkzl7TP/0reEvNKBm2JPoJQ5glZBXH6sSTR2ntFpp3/oUSCTQ7ZOysflJTxEYrs4PUdMIaS0XH11aomXeE99y L2GWUvfI/gh7RpW3ux8VDOlPV VdfpIZH3KzhB3d 9A w6ylVA/.../MapSDrjtZuCzHN8M MBV49 M30pouqjDxEihBW6xYQdRz7qRQfxqYjmwx0ucw==

Remove audacity-2.0.5.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.