home

icreinstall_itunes installer.exe

Application Installer

Criteria Quality (Fried Cookie Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_itunes installer.exe, “Application Installer Setup ” by Criteria Quality (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download Apple's iTunes but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Installer   (signed by Criteria Quality (Fried Cookie Ltd.))

Product:
Application Installer

Description:
Application Installer Setup

MD5:
4bb7a4a361db26e86eb44e9a29284f13

SHA-1:
4496d7aee0d619c56e45460d3e515b03cbeca4a4

SHA-256:
eaa0bcb19ffa27b211f307d3ed6244ae299787b6ac75c190b79a6b39f7258cfe

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/29/2024 3:49:02 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.24.21

File size:
969.4 KB (992,656 bytes)

Product version:
1.2.7

Copyright:
Internet

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_itunes installer.exe

Digital Signature
Signed by:
Criteria Quality (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 3:21:34 PM

Valid to:
6/29/2016 4:39:55 PM

Subject:
CN=Criteria Quality (Fried Cookie Ltd.), O=Criteria Quality (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11216ABCF20419312093F809F0E003C850D7

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:lN7LKXirSl5g5MYuHz9GNh6zCaWM4UEIBtot+k2G:lR2XirSXXYuT9GrMDE6Rk2G

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_itunes installer.exe has been seen being distributed by the following 14 URLs.

http://www.nowappclear.com/c?x=A4ypxEIK1keAGAUvVbAbpWPpB2/hyL63pFqVlZYE7bQ=&c=AQ3yQLY9NEhhKhIDSETxIbkOvrfgEwO6E7JFIieo7utQeUc26PdhpkjgZXKMhVYp9gedYypxDondsZEWZvl4bamsyBm5PeJn2VeOWG3cUa8s/P9IYjog1pCH5BiC4cUO&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.giftbestsafe.com/c?x=U9yr 3Tr9VZiNaXZPW7ZGvoGRM MFqPDYTQutAQMmTA=&c=AB4iNP8rgafvI293b7rvW64xOe PjBEtvuzner0jQ2qZ9PxB WBq5SlzsmHLhJcLFSyLpWy HfDZ7jo9ZWWobfapvOgQ/AojH490G0hvKGNzaZJ7ADgwbg AORx8m5JH&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaultranchbyte.com/c?x=gPsmMoW2iUvsjlYXhCjU9po0f2IEwXE45LQEudybvcg=&c=1vYj6TbYN5dS8EcA9Th2bMDyEwfdmlSpTmFnLwNso4YkRDBIrPtNOScraamYhzbwaAH5vxuuKApItaowI372FiNeqwdq8iC0I6ZUy7T1I8IEYImvY8Mw CaOdtyJB9Fx&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.filestomes.com/c?x=uUMqBwS/f1QfX0uheRG18K51uuBab t8rtw8npwE5ps=&c=xgXx0P/dKyY1/xJjNRjlqjUvdZLm4tCYoaDps6RMPvz24rw0bM/BN1poH/o Gydj979gwS6xuREqYGQEuDDs5/7MRvIAUQYELrL50s0lQ9rgCw4Yq7g0yD7qzTwvLZeX&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.tourworldmeta.com/c?x=NHi0JkdezRQ2dyT56qWvUtX5761OXK6vOl86iQ9L6ts=&c=8Tfxxagqud/girtjMRbmL1eFHVC1ikaKEaljUqKqoavtOLtG/paB1EMseo5i/i7cmZnFS2iArPacSZpc/PBhbY 6DRC7RNyCLNz TD25VtyC7wN6q1Q/yVHP3xEZP4TP&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.filestomes.com/c?x=jbuTSwJh9fuL4CRUHFE/TacBWwrcIi6Wdm oPHEbvvg=&c=pC1XVE7c23pJMEimE1FNew8zoTP/cLzeeEqWIav5Io/m300Cv9vYgP/lHDXBOxzJOsLY cPKoTn 9y3WX2qPZYgxDDd6FmWf/aJABg5C30vvMwcf2qZkyPyPQlPxHLi6&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.giftbestsafe.com/c?x=zFw zURtjUpG3AuyLIb 4/EfWaedAkkDrr437dMmV5w=&c=N2wVTa7 1l40soBKZiHSlJMlb/ wqPZTPBRcYsyQ4nCrscNOjkjQcw2CF3qXqnFL6Pm5vWs9HPV6nCV a3uTYCoBQEqdbQQUtpexWZJZ8fqsOhxBWRiJjr4N0OTlfp2T&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaultranchbyte.com/c?x=9sOUzSyuzrZ5PO6raHx4IrNAqgrVTGCnbED7e1DwFTQ=&c=2QDgCKonqwUnt7R47NlcSAAPEhZnh7RkYXVVYjmJmhTO33l1oPvXYzTwAjgyLsNS/Sh8tGfczpAab8652zxFBvsw4h3b9gKMVsfUUzyo8Lo958TZnKQb7VAgXQN93niz&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.giftbestsafe.com/c?x=IsplxjTNuQTqFyF5lSX8Hma3KXSdBVHJDepVOVQIlv8=&c=RIUKhjysRmRStyqmRAp4vrB9FTVdpDAW3K39ldF5CkAWArqbIHWbLBy3OlrAsFu6OkLoN091usmZUy8WrUDtggn6Q1AgexlaOLOSTDkxEPwdjij5Lh/Zubwr0iJTr9Kn&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.filestomes.com/c?x=u6QF3PX7H3zGXBBDpwA7TNFcO0J9swI7JqQ00Ltng2M=&c=APpchAX jnkXyTphAX/e4VMijiyk40ET7e/42J8OwDM2g/AJzw5ChXmDSBPT6EpytopV4tMfzqw5UuoCL6EP cswexXPJ97AlBJ/yQmSRPpkbIUJqU/umqPXInXaLzPU&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaultranchbyte.com/c?x=6rJxaBnUhIacPctCb0FBoNa8t1Z4Ifk10shKCIncnjQ=&c=UzX/ykeYbG GFBB/vcldNVLeQ9DMSOtHRKHgcN0NQjlkICKl b4aaJLOqMjgjGcp7HxSineL1ral6oK7m9sycSkRf66dMwz zgrSoDcpQf5ZVPs39hN16OOhz3ivwEGH&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaultranchbyte.com/c?x=zq8yJiNIsebhfatgkTltr3ftSl7wgqO95FZzc8wlgd0=&c=je//gd2Ab2vUZwA53wkLeF7QX1/X3jSHGV/LUSgTS7oh8JYi62wYG3Y7yUTjCA0P6udnZwHL4rFRGZbQphW6qhBgWWUEYHbmeWneI9G2BUnAF6rBarYM0kqhKcu9URPx&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.nowappclear.com/c?x=xoPsCUf1cP562nB/4/73jrim4PivFexWNyfYBTCedIM=&c=QgQ8mHUe0KSFZIFrGYsk/N06K8R8cQPuNQBgqGRreXAdRsCtd8JNn9SB2l/PIwtQiXDiG g/OB70RLAc dUsThCxkwm RuFn7X3fejDRtsj5AxYXVLXCsYIXfxtqg2A &downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.giftbestsafe.com/c?x=tgqDqXDbGVCUJA471GTvx6mTPH9nVlW1zSAdUNwpA5o=&c=E1TajQvZUeoLIgI61x D6lrvSFQ90B5BTkYgeav/miPOiEIjG1xeTRTmNHdPKyw8WiCkYAma1MdDyewJ7xDcfX 6LbnziwAMZbtpY1o bDLBa/1deF71tytjEi/v1IHq&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_itunes installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.