Hello! If you’ve been following my recent posts here on the FreeFixer blog, you know that I’ve been looking at files that have a valid digital signature and bundle various types of programs. This morning I found another publisher named Astro Network (Fried Cookie Ltd.).
The following screenshot shows the User Account Control dialog when running the Astro Network (Fried Cookie Ltd.) file:
You can also check who signed a file by checking the digital signature tab. According to the certificate we can see that Astro Network appears to be located in Tel Aviv, Israel and that the certificate is issued by GlobalSign CodeSigning CA – G2.
What caught my attention was that the download was called Skype_Setup.exe. This might look like an official Skype download, but it is not. If it was an official download, it would have been signed by Skype Software Sarl. And that’s why I’m writing this blog post. If you are looking for the official Skype download, go to http://www.skype.com/ to get the real deal.
I uploaded the Skype_Setup.exe file to VirusTotal, but none of the 50+ anti-virus scanners detected it. Was your file detected by the anti-virus programs?
Did you also find a file signed by Astro Network? What kind of download was it and where did you find it? How was the download promoted? Did it appear in the sponsored search results in one of the search engines?
You can find Astro Network (Fried Cookie Ltd.) by downloading camstudio, a free software, here: http://camstudio.org/ (v2.7.2, Build r326, October 19th 2013)
Thank you Syn!
I uploaded the CamStudioSetup_v2.7.2.exe file to VirusTotal. It was detected by 7 of the 53 scanners. I also tried the setup file. Seems like it did not install anything in addition to the camera program.
When I have seen “Astro Network (Fried Cookie Ltd.)” it looked very weird to me, I have searched it on the web and I have found your blog. It still very suspicious even if it does not install anything in addition to the camera program (and maybe the camera program has been altered).
Popular others softwares look like to be signed by “Astro Network (Fried Cookie Ltd.)”, you can find a list here: http://www.herdprotect.com/signer-astro-network-fried-cookie-ltd-1121d5280137ec081e84aed06fdd52e337a0.aspx
http://camstudio.org/ looks official, domain created in 2005 (but with fake information), a website with terms of use and a valid postal address… Maybe “Astro Network (Fried Cookie Ltd.)” is just the signature of a software installer and sometime someone uses it to add malware to existing software.
The official binary can be found here: http://sourceforge.net/projects/camstudio/files/stable/ which is safe.
You can find here a report about the Astro Network version: http://www.herdprotect.com/camstudiosetup_v2.7.2.exe-8699b3217cadca6b742e6110a4ed64368ec48faa.aspx
I got it from a search link and it is acting like an adobe update. I caught it before it finished the download and install but I do have it on my desktop and I cant delete it. it acts like the install didn’t finish? im afraid to do anything to it lol.
If you download a file from http://camstudio.org/ you get a 728 kb with Astro Delivery as Publisher and a lot of trojans detected by Virus Total
https://www.virustotal.com/en/file/1a0e2fd4b7816427238cc9e3bffcb53dfc21c6a77ec4a67bce75cbf8bff96440/analysis/1422935284/
—
If you down it from Sourceforge the file is 3’027 kb with publisher CamStudio and no malware detected by VirusTotal
https://www.virustotal.com/en/file/89fa3371206f7d21ffdf0caaf7107532b24838db3ea2d62c287a6f8dab21cba5/analysis/1422935371/
Thank you Mark!