home

bsplayer.exe

BSplayer

Innovative Systems LLC

The application bsplayer.exe by Innovative Systems has been detected as adware by 20 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from bsplayer.joydownload.com and multiple other hosts.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
BSplayer

Version:
1.0.0.0

MD5:
c4f33911869e394682deec9657848ab1

SHA-1:
ef163d5f7bc0379a8a02f5532b0e332ee9e2a1f5

SHA-256:
ac0c264cfc0b11c037a0fcb655a6010de1f3fdba78d59e1cd476893aec4b33d7

Scanner detections:
20 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/26/2024 10:20:34 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2014.12.08

Avira AntiVirus
APPL/Downloader.Gen
7.11.193.70

avast!
Win32:Malware-gen
2014.9-141209

AVG
OpenCandy
2015.0.3266

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.14129

Clam AntiVirus
Win.Trojan.Agent-803351
0.98/21511

Dr.Web
Adware.OpenCandy.55
9.0.1.0343

ESET NOD32
Win32/JoyDownloader
8.10587

G Data
Win32.Adware.OpenCandy
14.12.24

IKARUS anti.virus
PUA.JoyDownloader
t3scan.1.7.5.0

K7 AntiVirus
Adware
13.183.13286

Malwarebytes
PUP.Optional.OpenCandy
v2014.12.09.03

McAfee
Artemis!C4F33911869E
5600.6922

Qihoo 360 Security
HEUR/QVM42.0.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.InnovativeSystems.I
14.12.9.3

Sophos
Generic PUA EL
4.98

Trend Micro House Call
Suspicious_GEN.F47V1115
7.2.343

Trend Micro
ADW_OPENCANDY
10.465.09

VIPRE Antivirus
Opencandy
31600

File size:
496.4 KB (508,280 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\bsplayer.exe

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
Thawte, Inc.

Valid from:
9/19/2014 3:00:00 AM

Valid to:
9/20/2015 2:59:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
09A91C40EAE34E72CD975B0B218AE4BA

File PE Metadata
Compilation timestamp:
5/20/2013 2:52:48 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:wQHtvh6qDmXxl9q22eGWA+tgcTWfKuN783YjryI0ZjXPRrj/Evl0t:hHdz6Xxl9GaecCfr76YjrSpprjG0t

Entry address:
0x331F

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, D8, 7A, 7A, 00, E8, A8, 2E, 00, 00, A3, 24, 7A, 7A, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, D0, EE, 79, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, 20, 6A, 7A, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 20, 7B, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8900

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file bsplayer.exe has been seen being distributed by the following 12 URLs.

http://bsplayer.joydownload.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsml0kODG1E1v4ZNbB47pquHf14WJzydEcfwSnNOq1ajGilRwNIGjPEeutCup00bIjzsGXFUvIoXunSwXlszi1if/D6p3KmiBBoJ8igkdJF3ykACw2zZc79XLwW2jaSr9W2p64YyUMK7MwJQoNN738FXB5ctybblt7zvT2GX8veYHz2e0yDWq4slGMlvlmFsTiLJb7LWNXnMu/F/.../5nnG sBcVP7MW6QHzooZrTkC0gbaQXHMd9ZS5q9aD7DxEihB66xY8HU3CwT1ixsZGp

http://bsplayer.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjymHxv6YtXbteh152H0sD4rl44cJgTtabn2LSH/gAgJezbOBbzvTac8gLNjztTEXliD9GzyDkzlun tgLbbrNPK1SdZqtY6gl9QVWSsSTR0lMk7qnK5Gj/ICfkelNXqdD0PYqtgbFhTYuaiFGh0O8TMLAl9z7PvUSwicpe1iLNhUS75oFGMlvlmFsTiLJb7LWNXnMu/F/.../5nnHWsAsQe5MSxUTmw54Ob2SYibaRETJY2enUguvDhRE5zhVW60ddWES7gBQjysZGp

http://bsplayer.il.joydownload.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmVx1NTqtCkexcteQv Q8/yKn/DwtjJgcJgTtarHuezeuyxdSM2meGvusW780yas5nZKPDE b/SXqDkLlszi1j//D ICExHFA4p8xgV9QBjXnVm88wYE3q2OvSGjaSrpW2pKpd25FPas5dhION67/.../HGu4s1nKne1nR5i etDuNiVO1IK3H M2mBQH5sv3jFjyfP4s1Gz6UoYYrJupSDrju5uCyG9gO cKEMYvMjwptui1S0U92kPyxdYHGS7rFAnxsZGp

http://bsplayer.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjymEBrwZt/UtOh152b0sC4rn8kFbk3hYqn PXK/xVVKOSCGGOO1Qexj0bIjzsSXFQ6V7SS7BkX9qjjm3 fa99PZmiBBpZ8i1QweAWSsSTR0lsk7rGi6BjLQFf5CnY 0JTxEYrs4PUdMIaS0XH11aomXeE99y L2GWUveo/glaknBSqws1Ddne1nR5i7etD4MC0IioOvFqounRcH6Yrvhhvyb6p/hXj/.../kxdYHGS7rFAr6sZGp

http://bsplayer.joydownload.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmVx1NTqtCkexcteQv Q8/yKn/DwtjJgcJgTta7HuZiro0l8bOGGGCeujCr50yb9q1pPVR1XTqj3zVUz2vHq5i/LWrNzQmiBBp58i1QoeACPlGDU2nsEj7C/4SGjaSr9W2oG4YyUMK7M0JQoNMa70U3ttc43EJxsonvW9UWZ5Kcy3k7EnBSqwulDdzrwsWMP0JYC8ZDJW3cuvWa02lF4f7ILvjErzLaBxnT7wWpMI/.../kxdYHGS7rFAr6sZGp

http://bsplayer.joydownload.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqmGx3zcteQv A8/yWn9np5iNEMJ1XgYan3fHm/ykYBazeeEKqtGr8lwb1yz4WXAQaDqXCkWBO1qnD8gffbvN3ag2gIq5M6kQAKFC/.../HCrj5kjExfVtD9G3csi8KzVO1IK3HOM2ng8eroL8jVLqOvM213D3SoofstWwAHPhuYPC2Wx8Nv8WB5Y2enUhuvD4XghqzRy33c8DSnK1WUqwsZGp

http://bsplayer.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv U8/zOh/jwnickFbk3lYqn4PWG3g15eOHHZU6n WuAlyOBqxcKcAQiQ/i37CU20sni1mbWI svT0mlJq4c3ikdJF3ykACwzzZc79WjwXGmLQr5dy8LgJTxEYrgyJQpbauy3Cis2PYySNBBhhqnuAHRmONmjmLh3HGL5uFnFjrw1UIC2KcivZDJW3cuvWa02lF4f7ILvjErzLaBxnT7wWpMI/Mz4SXjruYPC2Wx8Nv8WB5pocSoxu6GtHhBz10/.../3sZGp

http://bsplayer.pt.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4YdzZp7dvriWi8yE3iYccJgTtYLHubTD8nAURZyGeEKqtGr8lh/1yz4WXBgaD/j3zT0zzsmnp0qmEvNKbm2JJq4diwBUeBT/ySCAg3JY79WjwWGmLH/.../4O h17yfKh3li jAt1Wrc24SWup6sWCkW8qZbxRQo0vMjwptui1S0U92kPyxdYHGS7rFAnxsZGp

http://bsplayer.joydownload.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqmGx3zcteQv A8/zyn9np5iNEMJ1XlbKn3fHm9wF5KZjrPW7X2UfB1n6trh8yVDR7DvG kXQ i mm0yP/SpMuYyDdZqtY6gV9QU3 1AX1/.../JHkHy288YOb2SYibaRHR5Y2enUhuvD4XghqzRy33c8DSnK1WUqwsZGp

http://bsplayer.joydownload.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEh74coqM6bdjr3f14WJwwckKL1XsK7H/NWHlmQBKOSCGGeO1GrElyPpqwsyPUkTRpm2tHk2usnq7ivPZq9vdkmJA4p80iUcUDSryGDU2nsIr9DmoGSPFEfUJitm0f2IVY/o4LhgFIfuuFTojKYeLZEcwh LuGiw3Ksayjbx8WyuouRnFnvV W9Gve4GkaHtOmJjjSbZj3A8eroL h0q N/.../kxdYHGS7rFAr6sZGp

http://bsplayer.joydownload.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklY0NSr1W1iuMZWG9/1jpTDsqSt4ytsEPxO K/ugbjr5gghKOSCGE O1SvZ3n gpkYSPDE b SXqWQ634Tnqmf6IpNjckGROpJA0i1BJF3ylACwx0NEivSH7UHGYUrcfwsTrJXdePKs5bBINOb3wX2h0O8TMLAl9z7PvUSwicpe1iLNhUS75oFGMlvlmFsTiLJb7LWNXnMu/F/sgnQ8eroL h0q7N/5nnHWsAsQe5MSxUT w54Ob2SYmbaRBR4U PH4xu6GtHhBz10/.../3sZGp

http://jdcdnnet.blob.core.windows.net/fas/wi/1/24/1/.../bsplayer.exe

Remove bsplayer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.