Software Association LLC – 16% Detection Rate – Sevas-S / iBryte / OpenCandy

Hi there! Just wanted to give you the heads up on a file called skypesetupfull.exe that’s digitally signed by Software Association LLC.┬áThis is how it looks when double-clicking on the file and Software Association LLC appears as the publisher.

Software Association LLC uac

Software Association LLC is located in Ukraine. The certificate is issued by DigiCert SHA2 Assured ID Code Signing CA.

Software Association LLC certificate

The issue is that skypesetupfull.exe is not an official Skype download. If it was, it would have been digitally signed by Skype Software Sarl. Here’s how the authentic Skype looks like when you double click on it. Notice that the “Verified publisher” says “Skype Software Sarl”.
Skype Software Sarl publisher

The reason I’m writing this blog post is that the Software Association LLC file is detected by some of the anti-malware scanners at VirusTotal. AVG detects skypesetupfull.exe as OpenCandy.F33, AVware names it Sevas-S Installer (fs), Jiangmin detects it as Adware/iBryte.hhhm, K7GW names it DoS-Trojan ( 200b63e51 ) and Malwarebytes reports PUP.Optional.OpenCandy.

Software Association LLC virustotal

Did you also find a file digitally signed by Software Association LLC? Where did you find it and are the anti-virus programs detecting it? Please share in the comments below.

Thanks for reading.

Leave a Reply

Your email address will not be published.