home

skypesetup.exe

Skype

Innovative Systems LLC

The application skypesetup.exe by Innovative Systems has been detected as adware by 22 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from skype.joydownload.com and multiple other hosts.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
Skype

Version:
1.0.0.0

MD5:
53e8da892a7ffc9e787ef7041a7ecf6e

SHA-1:
c11346fe1031cc7825584f26b1774ecede160e69

SHA-256:
15632dc0a038ceafebaba24af2a0daba5493e32dda62afee13282dadd0bf34c9

Scanner detections:
22 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/25/2024 10:25:29 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2014.11.14

Avira AntiVirus
APPL/Downloader.Gen
7.11.185.132

avast!
Adware-gen [Adw]
2014.9-141119

AVG
OpenCandy
2015.0.3285

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.141119

Clam AntiVirus
Win.Trojan.Agent-803351
0.98/21411

Comodo Security
Application.Win32.OpenCandy.~WD
18598

Dr.Web
Adware.OpenCandy.55
9.0.1.0323

ESET NOD32
Win32/JoyDownloader
8.10297

G Data
Win32.Adware.OpenCandy
14.11.24

IKARUS anti.virus
PUA.JoyDownloader
t3scan.1.7.5.0

K7 AntiVirus
Unwanted-Program
13.180.12456

Malwarebytes
PUP.Optional.OpenCandy
v2014.11.19.10

McAfee
Artemis!53E8DA892A7F
5600.6941

NANO AntiVirus
Riskware.Win32.OpenCandy.cxlnia
0.28.0.60253

Reason Heuristics
PUP.Installer.InnovativeSystems.K
14.11.19.22

Rising Antivirus
PE:PUF.OpenCandy!1.9DE5
23.00.65.141117

Sophos
OpenCandy
4.98

Trend Micro House Call
Suspici.792C221A
7.2.323

Trend Micro
ADW_JOYLOAD
10.465.19

VIPRE Antivirus
Opencandy
32442

File size:
496.4 KB (508,264 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\skypesetup.exe

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
Thawte, Inc.

Valid from:
9/19/2014 9:00:00 AM

Valid to:
9/20/2015 8:59:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
09A91C40EAE34E72CD975B0B218AE4BA

File PE Metadata
Compilation timestamp:
5/20/2013 8:52:48 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:MQgL+gW+muwOkRJgD/2y/cOv/hE2NKZcuOgyB38bxgp6:tS+8LIJI2bG/mRyVIR

Entry address:
0x331F

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, D8, 7A, 7A, 00, E8, A8, 2E, 00, 00, A3, 24, 7A, 7A, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, D0, EE, 79, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, 20, 6A, 7A, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 20, 7B, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8653

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file skypesetup.exe has been seen being distributed by the following 32 URLs.

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmVx1NTutClirNM7Y9uk153f/oW5gwJgELk31LuKoLXj/ylJSIGGOGe2hHac8gLNmztTLWFDFqm3qBwX9u3GtifbQvNKbm2BBs8xp10dJF3ylACx3kNEivSH UHHPGeAJ2syiPTYDYqtxdFFPZuyiEj8/ZpuGcwkpz6vmGDR6O5f5kucyBHv96wSbw7gvFpn esSkfSQUn5j/SPsvxhcU6Yn6ilH9a61xnG sAs9X/.../rBwfhoojvig==

http://skype.es.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjymHhH6Z9vQtuh152f0sDcx2dBNJ0DtevylYSfjhxdKOSCGGOO1Xuxj0bIjzsCXFQ6T/Sv CVT8 3G9geeV6svT0mlKq4cxkV4BXnWtGH4swNEivSH5UHGYQ7pOw4TrNjcNeu1rbFhTYuayFCZtc43EIxEwz/qtUnM3c8b40ucnTTDuoFGWlv5nR5i etD3NiVO1IK3H M2nRkH5sv3iVLqOPMpwj6tQMVc6s2pACKg88TTz2hlJ6gWDdEvMjwptui1S0U92kPyxdYHGS/.../woojvig==

http://skype.il.joydownload.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6Q7qp2uHf14WJ0wclbZQe Ku7uNCq2wVBZNGCIHuyvEb50ybtq1pneFQfS9SjyHgGu5i/gzLbDpZrSkmlZ58xkkV4BXnCtGDx3lscv znxGWmdSq4KkZu0JTxEYrg2JQpMaOa3AzkqPIuOOE5q2bPvUSwncpe2lf8 TWO7uEjOjvQvDpG3Ypv3O2NXnMu/F/smmw8eroL h0q4N/5nnG sAMVP78S9UXKquZKaiG95M6RIHI48Mjwptui1S0U92kPyxdYHGS/.../woojvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqlHB73cteQv A8/yan9np5ktEPJgTtbrHuaSzglAEaIGjPEeqtCrc0wqtrh8yeDR7RpnvqBwX9u3GtivbXvNKbm2dBs8Np3wBQXzWtCzp/hoByt2uvGTbdBfxCnY 0JTxEYrs4PVxLIaS0XHt1as/cLVgojaHuAHJ8O8WugKRwTDWouRnFmfV R8n0MJe8ZDJW2cuvSKFkxl9A/.../UlK04Ijvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhv4cp K4fE9tG//qSt4yNEcax6zerC/NXW20lZaMGeKHvusW780yas5nZKPDE b/SXqDkLlszi1ivXbvI2B0iMX8Nx1wQlQXzWtDzRn15hgvn7oUSCTRrZOnpi9Y2JFerJxJRsFIa30V2h0O8TILAl3xOG9UHM3c9z40Ok0CW6zs1zIlfQvDpG3YoL3O2NXnMu F/.../UlK04Ijvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmVx1NTutCkGrNM7Y9uk053f8pnp5iNEMJ1W4K6n3fHm7ykYfaz3YRK7kCr50yb9q1pDCW1jEvT3zT0z0smm9iPTDpZrSkmlZ58xkkV4BXnCtGDx3lscv znxGWmaSq4ckZPzPHQNa7MgLhsJIaS0XHt/.../HCrh xqajvQvDpa3YpT3MyRO1IK3HO0ujV5OpMiozg28K prwmTzEcQe5MWxUT2toZrTkC0qdbdRTsc3P3Ux5arnRFg0nB3p3dxAEinoAQr6qpLvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4ZtbB4Kt2tCersGMrwdoKLEHlb7j9OHq3g15aOHHIX/usW782yath1s3eDQ b7WmhWFT8 3G5gefTrNvcl2ZZqtY6glVIRiL SX4pxYpsvHfoUSCTRbZOi5yod2IVY/o4LBIdc/.../wgp4RV2mhGFi79ojvig==

http://skype.es.joydownload.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjuhChOxatrZp7Z rTy893p5ktEPKUbiYLj8Pne9yxdSMGmeX621E/Y9wrNyxdSWRAaS9T2 VRLlszi1jf/DrNvalWVOs55ziVRCXmTzU301yJJgu2mmSGjaSrlW2oS6fndSerJxJRsFIeyuAmh0IcTPLVgoiKv2RH95LZf5kuc0CmOo8QGG3KovUdb4MNz7JyRO1IK3HuM2xkRB/4O h1ryfKhxhSflCclX/.../UlK04Ijvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4YtbB6qAk5ib0pWJgjIJQeRigK6n3fHm6ykYObT/YTqu1E/Y9wLNyxsWcFQfS9SzyHgau7Gm0yP/.../o4KRIdZue3DzgqasWXLBomjafmGy8ne4f5kucxBHvs6waajvQvDpO5etDtNDgcioLoWaxkgUhduJr2zlL6ZLgx0z6tQMVc5NW6UXKquZKaiGp5M6RIBo47M20hsuCjGx9zhVW61NdWUHW1FAaqqZvvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjymHRDwY9XStOh152b0sC4rn8kFbk3hYqn PXG4xlFKOSCGGumtCuFugPk8lY/YRVCD9GzyCUzl yD2y6DDpZrSl2lZ98ps1wAARn3kAD1/hsEq/.../UlK04Ijvig==

http://skype.ar.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4Y9bB9bpi/269qGt42doNK1XsK7H4NWHqmQgNIGjPEeijEqd0mPAgkYXIQ0nR4XqwWVT8 3G8geeX943KmiBBp58igVdAUHCiGDU2nsIp9DmuAyDZHO0VjYW9JTxEYrw4PVtUeu iRHE8csjENE190PWxUDQuO4/.../83DWiouRnFmvV Udr9KYD7fXoF1cC5HO8mnBoT5Ij2zlL6ZLgx0z6tQMVc5NW6UXKquZOaiHNjdb0AT4M3Kzh67rb4WllzhVW61NdWUHW1FAaqqZvvig==

http://www.skype.com/.../getskype

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhr4coOQp h152L0sC8rlY9RagT1Y/j2PHmugw0MIGjVEeisW782w7NykJ/.../gh7JpWjz4oFGMlvxmFpC cdClLHtf1dP9RL02lF4f7oLvjFv fKE2nSqsEZoVrp75Fmvi6puRni0nY7NAQoI0Mjwps i1W0M1nB3z3dtOAS7jBAn1pojvig==

http://skype.il.joydownload.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqlHB73cteQv E8/yG6sGMxwdoEP0b1Y/j2OXmulRwYayHZCeL ErQzwr5hx8ebBAyavCX7BlS04S tgKzbr9Kbm2BBs8xp10dJF3ylACx3kNEivSH UHHPGeAJ2syiPTYDYqtxdFFPZuyiEj8/ZpuGcwkpz6vlEiw3LNyxkbFkRyz47kjE3/VpDoD K4vuOmNXnMu F/tkxkkH5sv3jlLqb6lzhSflCc1X/Jj4UXKquZaaiGt5OeIcAscvMjwptui1S0U92kPyxdYHGS/.../woojvig==

http://skype.ar.joydownload.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6Q7qp2uHf14WJwwclRblXsK7H7NWH7mQoMbSTPCeLkErY90fk5kNSWRAaS9T35D0Dlszi1iP/D94CMg2gIq5c6kVdGRn3kADx/hodt7CC5UGKTUr1Ow4TrMz0VPuBuegoEcKX2UnBtO5WHZk5h2eWhUjhwMNDg2q4/CGOo5AWTyKouFpn esGkfXNf3tO2XuMnlQ9TtNzvhhvyaKBnlS6kB8lY/.../jocTY2nViMqRIHI48PX4lsuanFR9jhVW61NdWUHW1FAaqqZvvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6Q7qp2uHf14WJxwclIdBP1Y/j2OXmuwlZaNmWJCeLkErY90fo5kNSWXgaQ9GzyDkzl5zitgLbbqdPK1joV9cp3wEdJF3ykACwszZc79WjwWGmLQrhOw4TrMz0VPuBuegoEcKX2UnBtO5WHZk5h2eWhUjhwMNDg2q4/CGOo5AWTyKouFpn esGkfXNf3tO2XuMilQ9Apcikzw3qZfN/.../rBwfhoojvig==

http://skype.pl.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4YdzZp7dvriWi8yE3iYccJgTtbbHufCj1gAFKOSCGGeO1R/YlyPpqw8yPQFXPq3C/T1T8 3G7geeH94WNg2gIq5Q0iUcBDz/nX30g0IZp4H6yD3GSA7ZawtW0f3deKuwgJEEFMqv2UHl8fMvLJxBhhqPuAGJhao6x2 w/HGiouRnFn/V QsvpYsntZXdWzcO/H 0img8eroL h0q4N/5nnG sAMVP78S9UXKquZKaiG95M6RIHI48Mjwptui1S0U92kPyxdYHGS/.../woojvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqlHB73cteQv A8/yan9np5ktEPJgTtabv2LSflgxQEYyrJWbW1E/Y9xrNyh53UR1mD9GzyD0zl CLrmf6SpNrSg2JIp4c7wF9BXmT U2pnn4Aj/CHoWGeLS/9Wys3zc3MVY/.../vig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjuhChOxatrZp7VpsTGr4Hp5iNENJ1Xla7ruNDC2w15KazrYCeLkErc90btk1s3eDQ6b7XC7Hk20sny1mbKI8I2H1iBZqtY6gF9QEi/.../OLAl21eKkTndsPceuw Z2BGywoBmU1b85Fpn esGkfTIFi9O2ROMllF4f6YLv2wGkO7h 1CanB8VPrZzyAyyq5tXV2jJ1L NRTsc3P3Ux5arnRFg0nB3p3dxAEiriDgXxo5zvig==

http://skype.ar.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4YdzZp7dvriWi8yE3iYccJgTtbbHufCj1gAFKOSCGGOO1W xj0bI5zseWRAaT9T28SFT8 3G gefQvNKbm2VBs8B4wwwAAWSsUzR0kMIu/ir UmCQS/9WzM3zYW5bPas5bBION6XlFSE2OJuNc19nzL xWnM3c8b41 cnWDbm5g NjvQvDpG3YsCtbmNXnMu/F/t73A8eroL6h0q/N/QhyGvlEcQe5MSxUT w54Ob2SYmbaRBR4Y5P3oxu6GtHhBzzk/.../rFAzwpYjvig==

http://skype.es.joydownload.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklYyNSrkQ1GyNZ G8aZ28zC293p5iNEPLU31POK/fy/tiREabnGHWOOiEqd0mPAgkdSWRAaS9T2 VRLlszi1jf/DrNvalWVOs55ziVNIRiPvSmc3wdEipyH7XmKfQrpaz8LhPHQNa7Mgb0FbIaS0XHl1as/NIAkpz6vmGDRhPJf5kuc0BHu7oFGMlvxmFsvkJNClLHte1dO/Gfsv3BcX55qizkrzLaBynT7hWpEJsYD4UXKquZKaiG95M6RIHI48Mjwptui1S0U92kPyxdYHGS/.../woojvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhr4coOQp h152L0sC8rlY9RagT1Y/j2PHmumQ0MIGjPEeutCrcz0bIjzsWXFUzIqz3zT0z0smm iPPDpZrSkGNBs8FpwBUeBT/iSGJnn4Aj yHoGTjQAOlOw4TrND0VLuBmPRNMOan9RHh9esrIIwkpz6vnGDRmIdHg2rQ/.../Hug2lF4f6YLv2wGkO7h 1CanB8VPrZzyAyyq5tXV2jJ1L NRTsc3P3Ux5arnRFg0nB3p3dxAEirgAwz7opPvig==

http://skype.es.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4ZNbB47pquHf14WJzz9EcbhyuKO6/ajf5gEoNejaeEKqtG78lheA01s3eDQqb7S36DkLxvWm0yP/TpMuc1XFA4p8xiUdDRn3kADx/hpxq7CC5UGSTUvsFlpO cHQVY/o4LBIdcPajRHEmcs/FZREkhrOyTXpxLcfg2q4/DWOosFnOjvQvDpG3YoL3O2NXnMu F/.../vig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsm10kPjuhChOxat/Zp6VvuXf14WJ0wckML0Xjbr7uNDC2xl5KZDzQT7zlCr50ybpq1sSeBh6avCX5DEzl7CL8y6mA55yazXFA4p81iUcBDz/nXyx 18kv9DmvEiPAAulOw57rNjMGbrowKxkGNKS0XHl1apeXcgkpz6vmGDQnfJf5kuc3BHvl8UjE3/VrDoD6KZz6MDYfzcr F oujV5MuZr21FL5Zel/.../rBwfhoojvig==

http://skype.es.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/yOn9np5iNEIJ1Xlarn4OXauyxdSM2OGCb3 W/VrkvAlhpqPDE b iXqTx2 C6tgLbbqNPKxCsL NdlkV4bXnejCzh8l8Ag/CvxGWmaSq4ckZPzPHQNa7MgLhsJIaS0XHl1apeXcgkpz6vmGDQnfJf5kuc3BHv 9kjE3/VtDoC8YsntZXVWzZfkQbw2lF4f7Iz3nxujJ og1HniRo9Du4/uUXKquZKaiG95M6RIHI48Mjwptui1S0U92kPyxdYHGS/.../woojvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjymHRD6ZdnRtuh152b0sC4rn8kFbk3hYqn PXG4xlFKOSCGH O1Tuxrlqtrh8ycAwaDvHSxTBO07T/6y uE5ozKmiBBoJU6kQEbFzb7W3cw1p879WjwX2mLA cViJLzPHQNarMga1wdOOz9V3BtedzFZREhhrOnS3I3c9z40OZ2BGqwoBqWyO1nR5i etCvbHdO1IK3G M2yUJJud2/n1O7ZKl/hS6lAt1Wrc25SWu28IOb2SYnbaQEHNppZjhgounkFxlrnE/.../xp4jvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GhvzcteQv A8/yWn9np5iNENJ1Xma73uNDC2w15KazrYCeLkErc90btk1s3eDQ6b7XC7Hk20sny1mbKI8I2H1iBZqtY6gV9QEDK1AX1/lck7/znxGWmdSq4KkZu0JTxEYrg2JQpMaOa3AzkqPIuOOE5q2bPvUSwjcpenma1sTDyouQPFnfttA5a7eMCsbnof1cK3D6p9yw8etIL8hhvyb6p/.../QI8Bv47 ASX7uNKanyYyJO0KBdEvMjwps i1W0M1nB3z3dtOAS7jBAn1pojvig==

http://skype.joydownload.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmVx1NT6tCk6tPIiG9/E9rm/9qHpwyNocJgTtarHuezeuyxdSM2meGvusW780yasmnZKPDE b SXqDkT1vH26mf6SpNjYm3Ef NZw3wQLETT7GDU2nsYj7GihEyPMUrcfwsTrJW5ePKs5bBINOb31Umh0O8TMLAl9z7PvUSwicpe1iLNhUS75oFGMlvxmFtLkJNClLHtf1dO8Hu82lF4f64Lv2BC4N gghSf/.../wgp4RV2mhGFi79ojvig==

http://jdcdnnet.blob.core.windows.net/fas/wi/1/24/1/.../skypesetup.exe

http://skype.ar.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4Y9bB87pi/269qG542dkML0Phban3fHm6ykYObT/YTqu1E/Y9wLNyxsWcFQfS9SnyHhO/ CL93ufa99PZlWJMpJQwhl1BXzWtCz5/.../8kSa1Kp D9G3c8i8LygIzcr F oujRwW65r2zlL6ZLgq1D6tQMVa5NX8Gie97NbTiCdjbbRJV8B5K3RguuOtDxtzhVW61NdWUHW1FAaqqZvvig==

Latest 30 of 32 download URLs

Remove skypesetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.