home

skypesetup.exe

Skype

Innovative Systems LLC

The application skypesetup.exe by Innovative Systems has been detected as adware by 22 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from skype.joydownload.com and multiple other hosts.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
Skype

Version:
1.0.0.0

MD5:
f448c6ba0f85c704d28fb843185a8753

SHA-1:
1dd2f0b864ced97175de705073dcc7b53210d901

SHA-256:
ee28c87dc6908a0de30973ec492a3141394153fb5d462a3c8f1f40291634fd54

Scanner detections:
22 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
12/27/2024 6:02:25 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2014.08.22

Avira AntiVirus
APPL/Downloader.Gen
7.11.179.234

avast!
Win32:Adware-gen [Adw]
2014.9-141112

AVG
AdLoad.OpenCandy
2015.0.3292

Baidu Antivirus
Adware.Win32.JoyDownloader
4.0.3.141112

Clam AntiVirus
Win.Trojan.Opencandy
0.98/21411

Comodo Security
Application.Win32.OpenCandy.~WD
18598

Dr.Web
Adware.Downware.6712
9.0.1.0316

ESET NOD32
Win32/JoyDownloader
8.10592

G Data
Win32.Adware.OpenCandy
14.11.24

IKARUS anti.virus
PUA.JoyDownloader
t3scan.1.7.5.0

K7 AntiVirus
Unwanted-Program
13.184.13741

Malwarebytes
PUP.Optional.OpenCandy
v2014.11.12.01

McAfee
Artemis!79994A15D9CD
5600.6948

NANO AntiVirus
Riskware.Win32.OpenCandy.cxlnia
0.28.0.60253

Reason Heuristics
PUP.Installer.InnovativeSystems.K
14.11.12.13

Rising Antivirus
PE:PUF.OpenCandy!1.9DE5
23.00.65.141110

Sophos
Generic PUA IK
4.98

Trend Micro House Call
Suspicious_GEN.F47V0927
7.2.316

Trend Micro
ADW_JOYLOAD
10.465.12

VIPRE Antivirus
Trojan.Win32.Generic
34106

File size:
546.5 KB (559,608 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\skypesetup.exe

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
VeriSign, Inc.

Valid from:
5/19/2014 3:00:00 AM

Valid to:
5/20/2015 2:59:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska oblast, C=UA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
450EACFE8D673E82864CE46BC1A92FCA

File PE Metadata
Compilation timestamp:
5/20/2013 2:53:11 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:aKc2LjVecCUu9Pgv6QtEXGXgLAXVJ2vpCRanJZrGxtjJ:mwjXWgvN113MplnrrGxtF

Entry address:
0x333E

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 80, 40, 00, 55, FF, 15, AC, 82, 40, 00, 6A, 08, A3, 78, 4F, 43, 00, E8, A8, 2E, 00, 00, A3, C4, 4E, 43, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, F0, B1, 42, 00, FF, 15, 7C, 81, 40, 00, 68, 7C, A3, 40, 00, 68, C0, 3E, 43, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 81, 40, 00, BB, 00, F0, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8776

Packer / compiler:
Nullsoft install system v2.x

Code size:
24.5 KB (25,088 bytes)

The file skypesetup.exe has been seen being distributed by the following 14 URLs.

http://skype.joydownload.com/get_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6Q7qp2uHf14WJ0wclbZQe Ku7uNCq2wVBZMmWIGumgH750ybpq1p/EUx6avCX6BlT2vWm0yP/TpMuH0nFA4p83iUcFDSjzVXk2hshq9CjwSCDAFK5Xkc3gPHQNa7MgaUFbIaS0XHx1aszMJxwmi7PvUSwjcpekjrFhWyuouRnFn/V BZW8YsntZXJWzYHkSfsv3BcW55r8jl7qZel/.../rBwfhoojvig==

http://skype.joydownload.com/get_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GR/zcteQv E8/yG6sGMxwdoEP0b1Y/j2PHmuhg0MIGjPEe tCrc1wr5kw9SWRAaT9T2nT1T8 3G4geeW94eMziQIs55ziVNIRiPvSmc3wdEipyH7XmKZRr5ZyMfhPHQNa7MgbEFbIaSuXHt0O8TNLAli1fX2GWUve4/g0O4zHGL5uF7Fjqk1WMeve4GkbnVWzaLmVKlx/EhRqMjj2BCtfKE2nS2mCd0Jt4T7Hyig9tPMiCdjbbNJV8dmcD92ounkFxlrnE/.../ypojvig==

http://skype.joydownload.com/get_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6Q7qp2uHf14WJxwclOdBP1Y/j2PHmuwVdeIGjPEeqtCuxul6trh8yfDR6Q j3zT0z0smn50qHDpZrSl2lZo5cxhFFFRn3kADh/hpV2on vGHGSA7ZfwtXgMDYVY/o4LRIdbOzlXTl1f8TcYUJ82P6jUTQuO4/22/9jVzXvoFGMlv5oDoDeK4vuOhIJm4T9A7xsyg8eroL h0q7N/.../rBwfhoojvig==

http://skype.joydownload.com/get_file/wUiS4WnYccXBwj pXP7oQlssmVx1NTutClirNM7Y9uk153f/oW5gwJgEL031LP/uNDC2wV5KM3GHWOOkEqdumu1yz4WXBQaD/irqBwX9unGt1LbDpZrSlmlZ5sxu1woFF2SsSTRzntF8tmujGDaLS VWycPgNzAGbbsxKxNMOaz9RDwmLNzFZREkhrPmECcifILg2q4/CmOo5AOTye1nR5i8dMi8DCoVn5TeSK1h3wNApd3vhhvyb6p/hXj/.../rFAz0oojvig==

http://skype.1-136-221747.54144503a016a.jdcdn.net/get_file/FNu46B5UNJ-0ZlyFnMZvGA/1410618131/1/15/1/.../SkypeSetup.exe

http://skype.joydownload.com/get_file/wUiS4WnYccXGwj 8XPavWwllklYyNSrEQ1GyNb G8aZ28zC293p5iNEMJ1WjLKn3fHm9ykZZIGjPEeinEqdjmvogmJfUQk7N7SS7BkP9qjjkwrWEvNKbm2BBs9Zp10dJDXymAX1/ksk7q2O6AyHMUrcFwsblNjcDbrAwLxoEcKX0XGg/IZrcLVgoj6v2EyUjao6x2 8/HDb5oFGMlvhmFtXkLpbxKDJO1IK3HuM2xkRB/4O h1ryfKtwhSflCcxX/.../rFAz0oojvig==

http://skype.joydownload.com/get_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjuhChOxatrZp7VpsTGr4Hp5iNENJ1Xmb7ruNDC2w15KdDrYCeLkErM90btixcGZAB6avCX5DEzl7CL8y6mA55yazXFA4p81iUcBDz/nXyx 18kv9DmvEiPAAulOw57rNjMGaL46LRwONKS0XHl1apeXcgkpz6vmGDQkfZf5kuc3BHv 9kjE3/.../UlK04Ijvig==

http://skype.joydownload.com/get_file/wUiS4WnYccXBwj zXP7oQkEsml0kPj21E1v4Y9bB9bpi/269qGt42doNK1XsK7H/NWH/mQBKOTqGGuLkErY90f85kNSWRAaX9T36DkfwvHytgLbbr9nSgzcS4tVs0hwHFiq1AX1/kck7vXCzGjaLS/9WzM3zYW5bPas5bBION6XlNSE2OJutc19nzL xWnM3c8b41 cnWDbm5g NjvQvDpG3YsOpbmNXnMu/F/.../UlK04Ijvig==

http://skype.1-136-221747.5413269e43184.jdcdn.net/get_file/pFRHCx3HEfnN-poUL9Jg3g/1410544814/1/15/1/.../SkypeSetup.exe

http://download.skype.com/.../SkypeSetup.exe

http://skype.joydownload.com/get_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/yan9np5ktEPJgTtbLHuaSrglUZTcWmNH O1e 5 g wDkYLYRxLEt3rqBwX9vnGt3aqN oyag2gIq5Y6kVRFVWSsSTR2ntFvp3/oUSCTRrZOysXgMDMAerJxJRkPOb2jDzk/.../rBwfhoojvig==

http://skype.1-136-221747.541473e65d17a.jdcdn.net/get_file/I2VhP0Y-_urFe7OSiTscEw/1410630134/1/15/1/.../SkypeSetup.exe

http://skype.joydownload.com/get_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjymGB7xYN7Tt h152b0sCsrn8kFdE3mY/j2O3mulg0EZ3GHWOOmHL8loOIphJP UkjUvzGtRBPlszi1iP/D6ICMg2gIq5M6kVdAVXGjDSx 18kq9DmjAzeLS/9Wys3zNjIVY/o4LRIdbOzlXTl1f8TcYUJ82P6jUTQuO4/w2/9xSnux8VDOlu1tFpn esSkfScDg5XoX/sv3BcW55r8ilnqZel/liysEZsErYfnEjCs8c2CkW8qYrxRBt90eSoxu6GtHhBzzk/.../rFAzwpYjvig==

http://skype.joydownload.com/get_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6Q7qp2uHf14WJxwclIdBP1Y/j2OXmuwlZZNWeLCeLkErY90fk5kNSWRAaS9T35D0Dlszi1if/D6p3KmiBBoJ8igkdJF3ykACw2zZc79XLwW2jaSrpW2pKpd25FPas5dhION673U353fsnKLVgoiqv2RHl5LNCww Z2BGqwoFvIne1nR5i5etD4Ni0Jzcr F gglQ92tsG92DutKu81iXnuVt1Wrc25SWu28IOb2SYnbaQEHNppZjhgounkFxlrnE/.../ypojvig==

Remove skypesetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.