home

setup-plusforskype-3.0_ch.exe

Messenger Plus!

Yuna Software

The application setup-plusforskype-3.0_ch.exe, “Setup - Messenger Plus!” has been detected as a potentially unwanted program by 5 anti-malware scanners. The file has been seen being downloaded from www.msgplus.net and multiple other hosts. While running, it connects to the Internet address unallocated.barefruit.co.uk on port 80 using the HTTP protocol.
Publisher:
Yuna Software

Product:
Messenger Plus!

Description:
Setup - Messenger Plus!

Version:
4.0.0.500

MD5:
5f991321062f0ea80fa1f05b3731ea26

SHA-1:
6afb336e1f0b2da4dd04557cb48b30f91a9afc17

SHA-256:
468ffdc63bccfa4720371008969128b9c35c183bc7e57ba2dcb80230dc8bac7f

Scanner detections:
5 / 68

Status:
Potentially unwanted

Analysis date:
4/24/2024 7:40:44 PM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
PUA.Win32.MessengerPlus
4.0.3.15218

ESET NOD32
Win32/MessengerPlus.A potentially unwanted (variant)
9.11184

McAfee
Artemis!5F991321062F
5600.6850

Trend Micro House Call
Suspicious_GEN.F47V0121
7.2.49

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.3

File size:
1.4 MB (1,461,760 bytes)

Product version:
4.0

Copyright:
Copyright (C) 2001-2015 Yuna Software

Original file name:
MsgPlusForSkypeSetup.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\programs\setup-plusforskype-3.0_ch.exe

File PE Metadata
Compilation timestamp:
1/21/2015 2:42:01 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:iyyH6lRwgHeayX0wB7uxD6piVtwj0hVPsQcaWRJ1xuVnGPP9ByAw:i96lRl+jX0ausiVg0h9sUWr+VGPPnA

Entry address:
0x9B893

Entry point:
E8, A9, C2, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, 8B, FF, 55, 8B, EC, 83, EC, 18, 53, 8B, 5D, 0C, 56, 8B, 73, 08, 33, 35, 84, 21, 4E, 00, 57, 8B, 06, C6, 45, FF, 00, C7, 45, F4, 01, 00, 00, 00, 8D, 7B, 10, 83, F8, FE, 74, 0D, 8B, 4E, 04, 03, CF, 33, 0C, 38, E8, F2, B4, FF, FF, 8B, 4E, 0C, 8B, 46, 08, 03, CF, 33, 0C, 38, E8, E2, B4, FF, FF, 8B, 45, 08, F6, 40, 04, 66, 0F, 85, 19, 01, 00, 00, 8B, 4D, 10, 8D, 55, E8, 89, 53, FC, 8B, 5B, 0C, 89, 45, E8, 89, 4D, EC, 83, FB, FE, 74, 5F, 8D, 49, 00, 8D, 04, 5B...
 
[+]

Entropy:
6.9353

Code size:
745.5 KB (763,392 bytes)

The file setup-plusforskype-3.0_ch.exe has been seen being distributed by the following 17 URLs.

http://www.msgplus.net/.../DownloadSkypePlus.aspx

http://www.msgplus.net/.../DownloadSkypePlus.aspx

http://www.msgplus.net/.../DownloadSkypePlus.aspx

http://www.msgplus.net/.../DownloadSkypePlus.aspx

http://www.lo4d.com/get-file/messenger-plus-for-skype/.../

http://www.msgplus.net/.../DownloadSkypePlus.aspx

http://www.msgplus.net/.../DownloadSkypePlus.aspx

http://www.msgplus.net/.../DownloadSkypePlus.aspx

http://www.msgplus.net/.../DownloadSkypePlus.aspx

http://msgplus.net/.../DownloadSkypePlus.aspx

http://mirror10.msgpluslive.net/Plus4Skype/20150121/.../Setup-PlusForSkype-3.0.exe

http://www.msgplus.net/.../DownloadSkypePlus.aspx

http://www.msgplus.net/.../DownloadSkypePlus.aspx

http://msgplus.net/DownloadSkypePlus.aspx

http://mirror10.msgpluslive.net/Plus4Skype/20150121/.../Setup-PlusForSkype-3.0_CH.exe

http://www.msgplus.net/DownloadSkypePlus

http://www.msgplus.net/DownloadSkypePlus.aspx

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to server-52-84-87-184.yul62.r.cloudfront.net  (52.84.87.184:80)

TCP (HTTP):
Connects to unallocated.barefruit.co.uk  (92.242.142.2:80)

TCP (HTTP):
Connects to server-52-85-63-112.lhr50.r.cloudfront.net  (52.85.63.112:80)

TCP (HTTP):
Connects to server-52-85-221-89.cdg50.r.cloudfront.net  (52.85.221.89:80)

Remove setup-plusforskype-3.0_ch.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.