home

jre8u20windowsx64.exe

Java Runtime Environment

Innovative Systems LLC

The application jre8u20windowsx64.exe by Innovative Systems has been detected as adware by 16 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from java.joydownload.com and multiple other hosts.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
Java Runtime Environment

Version:
1.0.0.0

MD5:
93a7204279983cde09796a741998ee3c

SHA-1:
96c2f5a648c34952f4b6228e9873753e15bec880

SHA-256:
3acfcd17fdd34ef0ed4d49000395db258cc10cfba2b1ca9a855a3f6294ed9c7a

Scanner detections:
16 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/24/2024 9:19:54 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
Dropper/Opencandy.505344
2014.09.11

Avira AntiVirus
APPL/Downloader.Gen
7.11.177.36

avast!
Win32:Adware-gen [Adw]
2014.9-141008

AVG
OpenCandy
2015.0.3327

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.14108

Dr.Web
Adware.Downware.6712
9.0.1.0281

ESET NOD32
Win32/JoyDownloader
8.10526

G Data
Win32.Adware.OpenCandy
14.10.24

IKARUS anti.virus
PUA.JoyDownloader
t3scan.1.7.8.0

K7 AntiVirus
Adware
13.183.13333

Malwarebytes
PUP.Optional.OpenCandy
v2014.10.08.11

McAfee
Artemis!93A720427998
5600.6983

Reason Heuristics
PUP.InnovativeSystems.R
14.10.8.23

Trend Micro House Call
Suspici.218D75EB
7.2.281

VIPRE Antivirus
Sevas-S Installer
33236

File size:
496.8 KB (508,680 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\jre8u20windowsx64.exe

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
Thawte, Inc.

Valid from:
9/19/2014 2:00:00 AM

Valid to:
9/20/2015 1:59:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
09A91C40EAE34E72CD975B0B218AE4BA

File PE Metadata
Compilation timestamp:
5/20/2013 1:52:48 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:zQx9LkXk/qkl7rOfwFGePzJOyZVGDniosPUCj+y:cx9oXk/dOIFGeL3ZVXosrKy

Entry address:
0x331F

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, D8, 7A, 7A, 00, E8, A8, 2E, 00, 00, A3, 24, 7A, 7A, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, D0, EE, 79, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, 20, 6A, 7A, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 20, 7B, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file jre8u20windowsx64.exe has been seen being distributed by the following 11 URLs.

http://java.joydownload.com/get_azure_file/.../o4KRIdMa32UXN5asWNLB0onve7TnJwOpf5kuc2BHu4tlvdl7xmB5ivM5v6fXoF1cC2XuMglQ9DtNSon1O7ZKh0nT78QZpVq8W7BCC3587X2WQmY6gWDdEvMjwpseKtD044zVbshpQBUXDzDU75p5D2nV5jb2DP9Q==

http://java.joydownload.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GhzzcteQv E8/yG6sGMxwdoEP0b1Y/j2PHmugw0MIGjVEeisW782w7NykJ/eR1DAtmq6UFT8 3G7geeL/5 Jg2gIq5Y6kQwbAGSsSTR3ntEr jnxGWmfSq4JgIe4dWIVY A4LhwOMqnzX395f8WNLBgonue9RjQuO4/02/.../h0qnLbh 1CahCd0at5nvHD6qoZrTkCgqdeAaGdEvMjwpsuOtD0Aj2x711d0DSnK1WUqw65zg2Vpta2DP9Q==

http://java.joydownload.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL2as6J5KVn/269qGp42YRNP0ykYrz2LTTlngAHdSCeEKqtHr8lleY8kJPfFQfS9SzyHkTzuWm0yP/TpMuc1XFA4p8xiUdDRn3kADp/hpVwon7oUSCTQr1W2p2jYj9Carl1dkZbbOi0Hnx7ZpuGcwkpz6vnGDR8IdHg2q4/.../liinAslc6MC5QHKquZKaiGx5M6RIBo4 M20hsuC1FllrjRyikYQQASeiDAv5sZjmxggsOGDP9Q==

http://java.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjymGh3yYN/Qveh152f0sCw22dBNJ0bterruNDC2xl5KZDzQT7zlCr50ybpq1sSZBh6avCX7BlS34S tgLbbrdPKk2FJs55ziVRCXmTzU301yJJgu2mmSGjaSrhW2p2wcWYVY/o4LBIddfajRHE8csjENBkgjabtFDQuO4/x2/92Vz2ouQPFnfQvDpa3YpT3MyRO1IK3H gujUdXuIC4j1i/N/.../rAQfh5MO6k1BifWDP9Q==

http://java.joydownload.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GhzzcteQv c8/zOn/j1gwJgEL0bteuG anv5wlQfaz3YRK7kULMz3ewokdSWRAaQ/yXqWB 0 CfuwrCT8svT0mlPq4dq0hMTRn3kAD1/hoNwqjnxGWmaSq5eysXzPHQNbrMgelBPau2iRHEmcs/KJxokj6HmFyQuO4/x2/.../rAQfh5MO6k1BifWDP9Q==

http://java.joydownload.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklU3NSr9Wk36Jd7T8rpouTq54SB0z8VbZRL1Y/.../44JDmzR0nOmDP9Q==

http://java.joydownload.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPTy1E1v4YtbB8ack5ib0o2JgyskFbk3kYqm/Zieuyw1SM2jPEe tCuB/g AikdSWXgaQ y75C0/ sHi3gLbbqNPKxzwX9cBykV4BXnWtGDxxldEivSH UHHPGeAJ2syiPTUGYqtobU0Hdq33ESMhLJGJZVMkiL xWnM3c8b40ucnSDDuoFGMlvlmFpC/ccWnaWNXnMu/F/t73A8eroL6h0q/.../QhyGvlEcQe5MSxUTmw54Ob2SYjbaRBR4YvMjwpseKtD044zVbshpQBUXDzDU75p5D2nV5jb2DP9Q==

http://java.joydownload.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsm10kPTqlChOxat7Zp6dy/269qGl42docJgTta7HueSro0l8bOGWGCeulGbI xatrh8yfDR7OvD3zT0zwsmn40quF8Z6bg2gIq5QwiUcWDTXnVm880YF17CC5UGeTUuYNjpbzPHQNa7MgdkFbIaS0XHh1aszKNBBhhqfuAHNtONywhP8 V2O7tlvOlP1vDJS6e4Gka3tOiZjhSPsv3BcX7ILv1xqtZu93l2v/.../rBQfh4MOw1QR8NHPP9Q==

http://java.joydownload.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEh74coqM6bdjr3f14WJxwckMKUb1Y/j2PHmuhg0MIGjPEe tCrc1wr5pwtSWRAaS9T24VRLlszi1iP/DrNvag2gIq5Y6kRYbAGSsUzR0n4Aj iHoDDrFFa5Xi83jNj0VMvtnJ10NM iuCC4gP42GIB882emxAC1mcof4w7J2HGL5uF3Fjrg1WsbiN4G8ZDJW2cuvSKFkxl9A/.../44JDmzR0nOmDP9Q==

http://java.joydownload.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GhzzcteQv E8/zq9sGMxwdwEPwC Nu jeDCuyxdSMWmeQrDzCr50ybtq1sSZFQfS9SzyHgau7Gm0yP/SpMvak2FZqtY6hV9QAT7nU3wghshw9Cr W2KcR7xey87qdD0GaLMge0FMc/OmHz89JNzFZREmhrO Q2B0ao6x2 k/HD/.../dl7xmBpO3YpjsOnkZ3cH6RLdwwFpWpY75kw2wO7h 1CalCd0et5OpSCDjsprTkC8qdfAaEZY2enUluvClHxtmhxCi3J5OESbzQknhqNnuxgU3P2DP9Q==

http://jdcdnnet.blob.core.windows.net/fas/wi/1/24/1/.../jre8u20windowsx64.exe

Remove jre8u20windowsx64.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.