home

slimdrivers-setup.exe

SlimDrivers

Innovative Systems LLC

The application slimdrivers-setup.exe by Innovative Systems has been detected as adware by 10 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from slimdrivers.joydownload.com.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
SlimDrivers

Version:
1.0.0.0

MD5:
3eed82e47417b37a0a41061f642bd8e2

SHA-1:
c578814d9d1c2b5f8105f7f03ac9708847f1d3fd

SHA-256:
d557f774af549626f87e21e28d6b2f4a313aeeffcc77a7b189e20b468db95711

Scanner detections:
10 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
4/25/2024 3:48:41 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Adware-gen [Adw]
2014.9-140807

AVG
Generic
2015.0.3389

ESET NOD32
Win32/JoyDownloader
8.10180

IKARUS anti.virus
PUA.JoyDownloader
t3scan.1.6.1.0

Malwarebytes
PUP.Optional.OpenCandy
v2014.08.07.10

McAfee
Artemis!3EED82E47417
5600.7045

Reason Heuristics
PUP.Installer.InnovativeSystems.R
14.8.7.22

Sophos
Generic PUA MF
4.98

Trend Micro House Call
Suspicious_GEN.F47V0717
7.2.219

VIPRE Antivirus
Opencandy
31772

File size:
489.6 KB (501,384 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\slimdrivers-setup.exe

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
VeriSign, Inc.

Valid from:
5/19/2014 3:00:00 AM

Valid to:
5/20/2015 2:59:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska oblast, C=UA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
450EACFE8D673E82864CE46BC1A92FCA

File PE Metadata
Compilation timestamp:
5/20/2013 2:53:11 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:nKcs1woPlr9hoDLqyasb4sFX4bcDA0zVnfhUVnFlQheMBpj:JT4lEbascsFX9rz55UVnFnYpj

Entry address:
0x333E

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 80, 40, 00, 55, FF, 15, AC, 82, 40, 00, 6A, 08, A3, 78, 4F, 43, 00, E8, A8, 2E, 00, 00, A3, C4, 4E, 43, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, F0, B1, 42, 00, FF, 15, 7C, 81, 40, 00, 68, 7C, A3, 40, 00, 68, C0, 3E, 43, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 81, 40, 00, BB, 00, F0, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.9083

Packer / compiler:
Nullsoft install system v2.x

Code size:
24.5 KB (25,088 bytes)

The file slimdrivers-setup.exe has been seen being distributed by the following URL.

http://slimdrivers.joydownload.com/get_file/wUiS4WnYccXBwj pXP7oQlssmVx1NTutCl6rNM7Y9ukw53f8oGl3ytscJgTtbrHuajv8mRYNIGjVEeijGLIzx75nxsCWRAaT9T2nT1T8 3G4geeW94eMziQIs55ziVZIRjb Xix 18ks9DnyWGGdSK5Xi83nPSVRN VmelodOOz9VXBtec/GNBBhhqDkGDRxIcayjbx8SyvmoFGMlv5tDoD LJvzOzMFmZT/.../44JDnzR18ZybWsyke39PBMXG6Tgw=

Remove slimdrivers-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.