» skypesetup.exe
Overview
Analysis
File Details
Downloads (18)

skypesetup.exe

Skype

RICH MEDIA SYSTEMS INC.

The application skypesetup.exe by RICH MEDIA SYSTEMS INC has been detected as a potentially unwanted program by 17 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from skype.1800download.com and multiple other hosts.

File name:

skypesetup.exe

Publisher:

RICH MEDIA SYSTEMS INC. (signed and verified)

Product:

Skype

Version:

1.0.0.0

MD5:

e1856ff7957b883436e71b5ba26440f5

SHA-1:

7e8a948b4e421112a616558345ae5562c6beca35

SHA-256:

2daed1c45eb183fb73567ed283a445b50d0137d96bf0c77787c60e5310bbe956

Scanner detections:

17 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

5/17/2025 6:38:46 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Riskware.Agent

7.1.1

AhnLab V3 Security

PUP/Win32.OpenCandy

2015.04.20

AVG

OpenCandy

2016.0.3132

Clam AntiVirus

Win.Trojan.Agent-855157

0.98/21511

Dr.Web

Adware.Downware.10304

9.0.1.0112

ESET NOD32

Win32/OpenCandy.C potentially unsafe (variant)

9.11499

Fortinet FortiGate

Riskware/OpenCandy

4/22/2015

G Data

Win32.Adware.OpenCandy

15.4.25

K7 AntiVirus

Trojan

13.202.15641

Malwarebytes

PUP.Optional.OpenCandy

v2015.04.22.05

McAfee

Artemis!E1856FF7957B

5600.6788

Panda Antivirus

PUP/OpenCandy

15.04.22.05

Qihoo 360 Security

HEUR/QVM42.0.Malware.Gen

1.0.0.1015

Reason Heuristics

PUP.Installer.RICHMEDIASYSTEMS

15.5.8.23

Sophos

OpenCandy

4.98

Trend Micro House Call

Suspicious_GEN.F47V0415

7.2.112

VIPRE Antivirus

Sevas-S Installer

39500

File size:

415.6 KB (425,584 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\programs\skypesetup.exe

Digital Signature

Signed by:

RICH MEDIA SYSTEMS INC.

Authority:

Symantec Corporation

Valid from:

2/16/2015 4:00:00 PM

Valid to:

2/17/2016 3:59:59 PM

Subject:

CN=RICH MEDIA SYSTEMS INC., O=RICH MEDIA SYSTEMS INC., L=HENDERSON, S=Nevada, C=US

Issuer:

CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

3F87144C25AF8BCF29F29C5A1FEEF4BA

File PE Metadata

Compilation timestamp:

5/19/2013 4:53:00 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:uiuRLY1ZkYkAOd2udooNWWWmcCWO+p38H7Y:q1YgYkjd2udXNZWXCWFp38Hk

Entry address:

0x331C

Entry point:

81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00... 
[+]

Entropy:

7.8203

Packer / compiler:

Nullsoft install system v2.x

Code size:

24 KB (24,576 bytes)

The file skypesetup.exe has been seen being distributed by the following 18 URLs.

http://skype.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklYyNSrEQ1GyNb G8aZ28zC293p5iNEIJ1WxN eoajGuyxdSMWmeGeihCr50ybtq1oLZFQfS9S7yHkflszi1jf/.../2zEI=

http://skype.il.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDu1E1v4Y9bB87pi/269qG542dkMKEPhYan3fHm4ykYOaz/ZCeLkErQzyasDn4/dUm/Eu2q4EhO/7Wm0yP/SpMuYyDdZqtY6gF9QVXWhGDU2nsIp9DmuAyDZHO0VjYW9JTxEYrw4PVtUeu iRHE8csjENE190PWxUDQuO4/.../83D2 ouRnFnvV QNave4GkbntO3tO2XuMnlQ9WtNzvhgHyb6J 1CagCd0IpofiASz7uMiamygibrdKQ405OnRguuCtD0UinB3z3dpOAWu4WFms5Nn2zEI=

http://skype.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDu1E1v4YtbB8ack5ib0o2JgyskFbk3jYqmqZi/.../x3lto1gIPdGVnZqj3zT0zxsmnqw7WI7IzKmjpBoJEyildGV3CjCTU2nsAj7GijDnGSGbZdwMyiPTENeu9tc0xacb38FXB8ctzMJx0wh LuESw3ONymw Z2BGqwoFvMmu1nR5i etDoNiVO1IK3G M2nR8Q6Y70n1O7ZKt1nT7yWowdspbyBju1oZrTkCkqdfUYDMRoK3RguuCtD0UinB3z3dpOAWu4WFms5Nn2zEI=

http://skype.1800download.com/get_azure_file/.../rBAfhoJn2zEI=

http://skype.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1Ghn0cteQv I253eq ysyl4pHaAW7erC/NXa20hcDeyPZCeLkErc90f0k1s3eDQ2b7S7qBwX9vnGt3r2R95uNg2gSq5Q0gVxGV3 hCzh 18kt9DmsAz/MUrcfwsblPSVkM/.../5nnG sAMVP78S9UXKquZKaiGp5M6RIBo47M20hsuejGxNzhVW61NdWUHW1FAaqqZvszEI=

http://skype.pt.1800download.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEh74comb9bp0uHf1 2Jzz9kHKUbkbbj6NDC2xl5KZDzQT7zlCr50ybpq1sScAR6avCX7BlSu4S tgLbbrNPKkmBZqtY6gF9QFC/zGDU2nsAj7Cr5XHGSA7ZewtW dCUMK7M1JQpIavGjCT08asWNLBgonue9RjQuO4/02/83DGy tFPdl7xmB5ivM5v6fXoF1cC1Fqounh0f/.../2zEI=

http://skype.1800download.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhv4cp K4fE9tG//qmMxwd8EPxG NO7uNDC2wVBSIADXUqnye Bzhvl kY7IFQfS9SzyHh u7Gm0yP/TpMvbknFA4p8yiUcdF2SsSTRyntFup3WuBSTaUrcfwsTrJXFePKs5bBIJOb31VH97fsfcLVgoj6v2Un9xao6x2 4/HGi5tEjE3/.../xopz2zEI=

http://skype.ru.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL3as6Q7qp2uHf14WJxwclIdBP1Y/j2OXmuwlZdNmWFCeLkErM90ewohJ/fUh6apiX5CET u365ivfQpZrSlWlZ98xs1kdJF3ymDjRn95hgvn6ZDyfcAKIJgJLzPHQNarMga1wdOOz9V3BtedzFZREhhrOkS3I3c8b40ucnD2q8oFGMlvlmFsTiLJb7LWNXnMu F/smnhsH5sv3jlLqN/.../MS4UXKquZKaiG95M6RIHI48MXRguuCtD0UinB3z3dpOAWu4WFms5Nn2zEI=

http://skype.ar.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv U8/zC24jEwnskFdE3mbLn1PHu5xV1eOSCGGeO1XPElyPpqxcyPBh6avCX5DEzl7CL8y6mA55yazXFA4p81iUcBDz/nXyx 18kq9Dm6AzeLS/9Wy83zNjQBerJxJRwFIfmuCi9tc43EJx8onsK/.../xopz2zEI=

http://skype.1800download.com/get_azure_file/.../uNDC2wl5KMWCeEKqtG78lgOA01s3EDQ2Z9GzyD0zl CLrmf6SpNrSg2JIp4c7wF9DVHy1Xmc21J94t264BnGSA7ZZwtWibH5HPas5bBINOb2zEmh0O8TPLAkjnqqnGCUvasOrhf8 TWO8uEjNnvpoApuve4GkaXtOion9RKtxjRZM54n5j1H9a6hwny tQMVb5NXtHCW95tOCkW8qZLxRR4U7K3RguuCtD0UinB3z3dpOAWu4WFms5Nn2zEI=

http://skype.ru.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1Ghn0cteQv E8/zq9sGMxwdwEPwC Nu jeDCuyxdSM2OGCb3 W/VrkvAlhpqPDE b iXqTx2 C6tgLbbrNPK1SdZqtY6gl9QVWSsSTR2ntFvp3/oUSCTRrZOysXkMzEOerJxJRsFIe uAmh0O8TNLAkjj6f2GWUvfI/gh7RpW3ux8VDOmPV Z8n0MJfNOjUZn9/.../Mz4SXrjodLJzj4rPrxCTY9 M3kporfvXUMj2wS7jtdFFy7oAA76p53jzEI=

http://skype.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylERnwYtnTveh152P0sD4tl49bb1XsK7H/NWG wVJKOSCGGeO1XPElyPpqxcyPBh6avCX5DEzl7CL8y6mA55yazXFA4p81iUcBDz/nXyx 18kq9Dm8AzeLS/9Wzs3zNTUCbL87PRNMOaz9RDkmLNzFfxEjhKqnGCIvatOrjbgnBSqws17Fjpw3TdLoE5fqKjFCionoD JnlR4f/8ik2UrzLaB2nT6nAMlP5YSxQXP77NKCkW8qYLxRAt1jbSBk8/.../rBAfhoJn2zEI=

http://skype.ar.1800download.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqiHB77cteQv U8/zC24jEwnskFdE3mbLn1PHC0wFJQOSCGGOO1W xj0bI5zseVDE b/SXqSALlszi1iv/Dr8vT0mlKoZ8i1wwBFCr2Q3s3yNEivSH/UHHaG/UcndXqdD0BYqtkcERbZu3lXTl1e8TcJBoknqqnGCIvatOrjbgnBSqws17Fjpw3TdLoE5fqKjFCionoD JnlR8f/9e n1O7ZK1/hWv/.../rBAfhoJn2zEI=

http://skype.1800download.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqiHB77cteQv c8/zOn/.../xopz2zEI=

http://skype.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylERnwY9TStOh152f0sCw22dBNJ0bterruNDC2w15KdDrYCeLkErM90btiwcKbDh6avCX7BlSu4S tgLbbrNPKkmBZqtY6gF9QFy/zGDUsnsIh9WjwWGmLH/9Ow4TrMD0VL Bse0dIcL38FXB7ctyYf0d3nqqnGCchcpeRiqR1Wwrv9h PgqokUYC2M8itZWMchpWvFqounBcH7Iv7n1O7ZKx/.../2zEI=

http://skype.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylERz0Y93Tveh152b0sC4rn8kFbk3hYqn PXa4xl1KOSCGH O1Tuxrlqtrh8ycAwaDnHSxTBOU7T/6y uE5ozKmiBBop8iwwwWRn3kAD1/hsIq DnxGWmbSq4YjNXqdD0GYqszPRNMOa39RCU8asWNLBwonua9THJ6P8bg2q4/D2mwoA6W378wVdv4Mp68ZDJW2suvXrJt30gH5sv3jlLqN/MhhSflCc1X/.../O IWB5Y2enUguvClHBxzhVW61NdWUHW1FAaqqZvszEI=

http://www.skype.com/.../getskype

http://skype.ar.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKjEgqkOYCGp h152T6qHoRkJJOeCSyLP68ISb0lUZTcWmOEfvjXKc8gLNhztScFQfS9SzyHgCu7Gm0yP/XpMvak2ZPp5wiiBZIVXatGGos14N1r2K/GD LS/9Wzc3zdGxOKOwgJFsFNaXlAzI/IYybNBB7hqDgEC8neIL71u4 TWO5uEiPxat D9G3c8i8bnJazcr F 8ujUtKsdyoz0rzLaB2nT6kAslP5YSxQXP77NKCkW8qYLxRAt1jbSBk8/.../rBAfhoJn2zEI=

Remove skypesetup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.