home

skypesetup.exe

Skype

Innovative Systems LLC

The application skypesetup.exe by Innovative Systems has been detected as adware by 21 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from skype.joydownload.com and multiple other hosts.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
Skype

Version:
1.0.0.0

MD5:
ab6eef5598f4c5199b5202068a57e81e

SHA-1:
959b0158b598959ba9a19923dc13504284d5a17c

SHA-256:
1963491f0dd49bfe5da1bac63223b0c232bbea7c689a89c789836d4fd57feed5

Scanner detections:
21 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
12/27/2024 5:02:58 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2014.08.22

Avira AntiVirus
APPL/Downloader.Gen
7.11.176.180

avast!
Win32:Rootkit-gen [Rtk]
2014.9-141006

AVG
OpenCandy
2015.0.3330

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.14106

Clam AntiVirus
Win.Trojan.Opencandy
0.98/21411

Comodo Security
Application.Win32.OpenCandy.~WD
18598

Dr.Web
Adware.Downware.6712
9.0.1.0279

ESET NOD32
Win32/JoyDownloader
8.10515

G Data
Win32.Adware.OpenCandy
14.10.24

IKARUS anti.virus
PUA.JoyDownloader
t3scan.1.7.5.0

K7 AntiVirus
Unwanted-Program
13.180.12456

Malwarebytes
PUP.Optional.OpenCandy
v2014.10.06.09

McAfee
Artemis!AB6EEF5598F4
5600.6986

NANO AntiVirus
Riskware.Win32.OpenCandy.cxlnia
0.28.0.60253

Reason Heuristics
PUP.Installer.InnovativeSystems.K
14.10.6.9

Rising Antivirus
PE:PUF.OpenCandy!1.9DE5
23.00.65.141004

Sophos
OpenCandy
4.98

Trend Micro House Call
TROJ_GEN.F47V0604
7.2.279

VIPRE Antivirus
Opencandy
32442

File size:
496.8 KB (508,720 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\skypesetup.exe

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
Thawte, Inc.

Valid from:
9/19/2014 3:00:00 AM

Valid to:
9/20/2015 2:59:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
09A91C40EAE34E72CD975B0B218AE4BA

File PE Metadata
Compilation timestamp:
5/20/2013 2:52:48 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:XQgLMwvx826UXtVSlAmmCayHN7HfpGe8EEQ+eTrkK37:gSMwm9SzSimmWHN7HxiJQ+eTr5r

Entry address:
0x331F

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, D8, 7A, 7A, 00, E8, A8, 2E, 00, 00, A3, 24, 7A, 7A, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, D0, EE, 79, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, 20, 6A, 7A, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 20, 7B, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8638

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file skypesetup.exe has been seen being distributed by the following 21 URLs.

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv U8/zOh/jwnickFbk3kYqn O3quyxdSNmmeTbD7Tac8gLNhwMyPRFfYv3q7WQKy GXqw6DDpZrSkmlZ4sxkkV4bXnesSTR2ntFwp3/oUSCTQrZOysPzPHQNa7MgaUFbIaS0XHx1aszMJBsjjrPvUSwmcpeyiLknBSqwsVDdnfxqFpn esSkfSQUn5j/SPsvxhcU6Yn/j139ZqlxnG sAs9X/.../rBwfhoojvig==

http://skype.il.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/.../ykYbazeeELCtGb50ybpq1obEUx6avCX7BlT2u32tgLbbrdPK1zofs55ziVNIRnSlCD50ltEivSH4UHHdBK5Xi83gPSUGerJxJR4FIfmoCi4qOtzFZREhhrPmFi83c8b41 cnWyH66xiajvQ1DpO5ccCqb3Fd3MS2XuMglQ9DtNSon1O7ZKtxnT7lWIYdu4TuBzyprcTYzz4rJLxCRY4vbSZg8L72VF8j0gS7lNdBGT6iXUSz9ojvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjuhChOxat/Zp7pvuXf14WJwwckMKVXsK7H6NWHpiBQBcDaeELCtGbE2wb9mwMGYBQfS9S3yHhm0qnD8gfLbvJ6BzzcU5tYiiBZIVXatGGos14N1r2K/GD LS/9Wzc3zdGxOKOwgJFsFMKXlFSMrasWXLBopz6vgGDRzIdmnw Z2BGi uEiMx7YsUdHoNIfucSQUitO2XuMmlQ9RqZr2zlL5ZLh0hSflCcxX/IHiF2vi8JuWkD4iZbRDRIYvMjwptui1S0U92kPyxdYHGS/.../3qojvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4ZtbB47xquTC8sGMxwdgEP0XjYan3fHm ykYcdnGHWOOmEqc20bIjzsSXFVPS7SS7BkH9qjzm1aGO6ZrKmiBBp58i1h0CDTTyGDUsnsIt/ynyWGKRQrpXi83iPSVBMe0gJFsFNaXlVHh9eM/MNBBhhqDkGDRxIcayjbx8SyvmoFGMlvpmFtHmOYL7fXof1cW3D799w0gH5sv3jFzyfOku3mzzQJoZq4elFjG8oZrTkC8qdfUaEZY2YHUiu6GtHhBzzk/.../rFAzwpYjvig==

http://jdcdnnet.blob.core.windows.net/fas/wi/1/24/1/.../skypesetup.exe

http://skype.il.joydownload.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhv4cpyK4fE9rm/.../oUTqTQbcfwsbhPSVTMfpyc0lGdu2rRHE8csvENFh5xeGxAC1mcof4w7J2HGL5uF3Fjrg1WsbiN4G8ZDJW3MuvRLBwjRZW54r3n1r8fKE2nS sEYkEutWwAHPvuYOSmC4gZrRRTsc3P3Ux5arnRFg0nB3p3dxAEi7kBA31qpnvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjuhChOxatrZp7Z rTy893p5ktEPKUblarj/.../T3zT0z1smn7z fa7dPZm3FKs55ziVNIRiD4Vmog1tEivSH5UHGbRLVOw4TrND0VMeBmPRNMOa39RHh7asWNLBkonv6nAC1mcoL4w6psUD3l9Rndl7xmBZK3Ypb3LDEAjoj4X7U2lF4f6ILvzgOxLv9nnG sB8VPuJ7nFmvi8JuRniYyJO0KBdF bDtm8PzyVU9zhVW61NdWUHW1FAaqqZvvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmVx1NTutCkGrNM7Y9uk053f8pnp5iNEMJ1W4K6n3fHm7ykYfaz3YRK7kCr50yb9q1pPVR1XTqj3zVUz2vHq9iPLZp9vRmiBBop8ixQwWRn3kADh/hsEr/Cv7WHGSA7ZewtWlcyUMK7MzJQoOIaS0XH51apiXek4wh LuEyIvasapmK1gTTz 9xrRybc5Fpn esOuZWMIhoL9Qbht2l9J/4O h13yfOku3mzzEcQe5MGxUS 278XF2D4rJLxAT5Y/PXYxu6GtHhBzzk/.../rFAzwpYjvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1Ghz7cteQv c8/zOn/j1gwJgELEPtevindjPpgwEcdyOSTqHyCr50ybpq1oXEUx6apiX5BwX9u3Gty6yFvNKbm2BBs5QzhUdJF3ykACwzzZc79WjwXGmLQr5eyMbjJTxEYrgyJQpbauy3Cis2PYySNBBhhqTuAGV McWnw Z2BG woA H3KYuUYC2Kciva3Be2ca5H sklF4f74Lv0hvqZel/.../rBwfhoojvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqlGBnwcteQv A8/yWn9np5iNENJ1Xma73uNDC2xl5KZyvMQqvyCr5uybhkxcSYAA2V/.../dl7xmApivJp3yOyQezcr F oujR8R5Jr2zlL6ZLgq1D6tQMVa5NX8Gie97NbTiCdjbbRJV8B5K3RguuOtDxtzhVW61NdWUHW1FAaqqZvvig==

http://download.skype.com/.../SkypeSetup.exe

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqlGBnwcteQv E8/yG6sGMxwdoEP0b1Y/.../q0Az46ONCbbk4wh LuESw3ONymw Z2BGqwoFvMmu1nR5i7etD7JzEFnZSvFrAunhkU74j5jVz5b6E2nS sEZYEutWwAHPruYOSnj4rJLxCRY4vbSZg8L72VF8j0gS7lNdBGT6iXUSz9ojvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmVx1NTqtCly2cteQv I8/2TsqSt4zdEcexi7PO6 LXj/yldSIGGIEvusW780yas5nZKPDE b/SXqDkLlszi1iP/D7oCMg2gIq5Y6kVRBUmSsSTR0lMk7qnK5Gj/.../UlK04Ijvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1Ghz7cteQv A8/.../UlK04Ijvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmVx1NTytCk6rPInBvqA87GH0sCspgptbbhKjLfviajvp0l8bOGKMEfvzQfZ3n gpgYTBFQfS9SryHgWs8Tvqmf6SpNrSgzoS9Yc7wF9AXmSlDix 18kr9DmlGXGSA7ZbwtWmbmlTN/5xPRNMOaz9RDomLNzFZREhhrPlESA3c8b41 cnWDbm5g NjvQvDpG3YsCqZmNXnMu/.../tg2w8eroL8h0r5fKE2nSqsEZoVrp75Fmvi6puRni0iYL5ARYc7Mjwps i1W0M1nB3z3dtOAS7jBA3yoYjvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjuhChOxatjZp7VvsTDsqSt4yt8EPwS8IfupfCb4hRRGZyvZCeLkErQ3yas0nYXdW13Yum2kHk20sn61mbaK55mNg2gIq5M6kQMdCCLySCx 18kq9Dn4XmqLS/9Wy83zcW5TerJxJR4FIa31VHp etzFZREkhrOxWmZ8OtDg2rQ/.../UlK04Ijvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklYyNSrkQ1GyNZ G8aZ28zC293p5iNEPLU31POK/fy/tiREabnGHWOOiEqd0mPAgkdSWRAaX9T2tRAau i6tgKzbr93Zk2VKp5w5hV4BXnStGHoxhshq9CrwSGKLS/9Wzs3zYWhbPOxwPRNMOaz9RHh7cdzFZREhhrOkS3I3c8b40ucnD2q8oFGMlvxmFtTkJNClLHta1dO/H sknh8H5sv3jlLqLfMhhSf/Cc5Wrc25SWu28IOb2SYnbaQEHNppZjhgounkFxlrnE/.../xp4jvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklYyNSrkQ1GyNZ G8aZ28zC293p5iNENJ1WnMe/uNDC2w15KM2CKCeLkErY90fo5kNSWXgaQ9GzyD0zl4SLrmf6SpNvSg2FPs55ziVNIRiPvSmc3wdEipyH7XmKbRr1awMTkPHQNabk4PUxWcO rBzM6OpLcLVgoiav2UX1sONDg2q4/DGOo9h7dl7xmBZivcdClLHtf1dP7RL02lF4f64Lvj1r6bqt3hSflCclX/.../UlK04Ijvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEh74comb9bp0uHf1 2Jzz9oMLULkbLv/NDC2xl5KZDzQT7zlCr50ybpq1sSZDh6avCX6BlSo 2m0yP/WpMufyD0f/tJzkV4BXnenACwhzYBponqzHyHFUrcfwsLrJXRcIflnPRNMOaz9RDkmLNzFfxEjh LuESw3Ptymw Z2BG woFjNnv9tBoC2M8iqZWMKhp3oD JnlRwR55q 1hG4O kg02nmHZoVu9WwAHPquYPQw3gybPVJRo4vOHwlounkFxlrnE/.../xp4jvig==

http://skype.joydownload.com/get_azure_file/.../QnvrtJeTki4rJLxCRY4vbSZg8L72VF8j0gS7lNdBGT6iXUSz9ojvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklYyNSrkQ1GyNZ G8aZ28zC293p5iNEIJ1WyIPulfSauyw1SM2eNGe vG7M3y7IjzsSXFVPS7SS7BkH9qjzm1aGO6ZrKmiBBp58i1QoeACPlGDU2nsAj7Cn U3GSA7ZdyM3zY25EKOVjZl1Nb738FXB6ctyNfVJi2bPvUSwmcpe0iLknBSqwtFDdnv1uBJO/YsntZXJWzZjkSfsv3BcX55r/iUrzLaB2nT7lWptP5Z6xQnKquZOaiGhkdb0AT4U3K34xu6GtHhBzzk/.../rFAzwpYjvig==

Remove skypesetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.