home

itunes installer.exe

Getetese

FlashFunnel (New Media Holdings Ltd)

The application itunes installer.exe, “Getetese Setup ” by FlashFunnel (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download Apple's iTunes but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Baheb   (signed by FlashFunnel (New Media Holdings Ltd))

Product:
Getetese

Description:
Getetese Setup

Version:
3.4.1.3

MD5:
11964d262686bad21b19c6e668b03c07

SHA-1:
84fe34fd5d110578abf4f32c41610186d8e84576

SHA-256:
ced4a6288147ae6eb30a0fbf38b223581b46daa38b7b7f054468b270782f8b52

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/30/2024 9:04:04 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.4.14.5

File size:
969.8 KB (993,040 bytes)

Product version:
1.7.7

Copyright:
Lite Fast

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\itunes installer.exe

Digital Signature
Signed by:
FlashFunnel (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 2:30:20 PM

Valid to:
6/1/2016 5:03:11 PM

Subject:
CN=FlashFunnel (New Media Holdings Ltd), O=FlashFunnel (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DF62995B705C263C7C1BB644682A9A73

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:2QMaHtCHqOdwKlKtejxpBs4NIcx1Kz3c/iePW5ITSG/jJGvJVOivKL+SNkihszMK:2QMStCfdqoZs4NIciuMg/EvSiiCMa

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file itunes installer.exe has been seen being distributed by the following 21 URLs.

http://www.todaysendsoftware.com/c?x=MpeuRJs5XgNXrFfNGATcNkNby4IlHPvVNFOgEwUE1MI=&c=yb8/BeTXKCmknTeJDc6ywg1RaUbaVEY1JxPif8V2rTZbauV/iNViLI55l56fZN9NAEIPVXTRgWeABGwGSjW9 kDIMSegeVb6zOcLwHwb6yCNBX/tsODi6TSM6fV/BB1/&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=97lrptb96yH1DrCO7UoTQeLMeBkt8UMiOn8g3RKvlGs=&c= v0kR0FdKk2wV1PFl dYQGGB3xswP J72PUWsa8LNYptjL7cwg3FSr4gxyqWOst1lfhWaXcuF5R/PTk5AIgSnd5Fl0KZvMFcywfNMbEHooYGQob5VC1KwG bL4U/g XJ&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=swOoP9Z OjvL4qdheE2GIETjeJkL5OLfALFb8sFjCog=&c=w1MX1CHXsvxToJ6C Io3D8Kw4u0v/3zcHCHSJlHDxvSu3xeGrvS4JcfKIr9YqaEU yP7dRDi/o/C5fAFBzx7W5pVTSS0 Z2LmNg8acJBw/80ENYtRWAjf0fboc33ThUV&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.filebitscentral.com/c?x=rZhNLmD2qN4DV73WUu9ZA7WXJ7iyS4O9lUmBwk6Byvs=&c=YMeDo rsthcp3LlLO5k70KFSr2Ym3zm6M6az4w/AyMFCbJt7MzKV9ApBF289boF4nrp2roruE3HreErmv5WRZ8wcJm55D1FDl6sC57ONNO57b8KP6sO9iSneXdBrn30z&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=cklzB4hDsETp9FX4iGLCi2r/m 1TMCJsgk7fNkhdu4A=&c=HNm0pk9f HBEKNd u64h9HHiY1/b/r8HIPCyJZ12Ow42jDOHZYSWtXpI4UdXSl wd5YoQkWCsYfpTxDIvZZPPK4iTITgmzFXZL6GyCleq/4HWRbtzVjvp1zwusO6QJjk&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x= RZ92lRZBI5BHtr05xWEhImLWqszEOQwTAe/QSHkDdY=&c=GyxYlOkm1T3yrs0UTJ1LTXIiPlZIxVmZQU0k5/QOimNtSlQp3A6MVgI/IBd6uF/gxuXm rH6EjuFCuSz9cxmLYDpF76FIReZacJfxWehv58Rl2wItNuIimsM9H7Gtzy9&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=gMtLsqRT1VAbFRYqmb/HWIxms92RqVf1QAWewXpf2MI=&c=oNg4/rPimLya2k/cyFf5Apbx//A3yY5LyF8MMdJcfVdtD1pK0vE/OfmWDVDLOZz8I0aiG 2o6y2Uux9xzFjs3NkCNfy1W9MXgffxg7XHageMKMl7zlHZpjghyWKIjgBk&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=5CeOAIIDtjsxhxHhfanMwkeZGH6Ly0wgTo zwfq2jbM=&c=uMeLS6t0s2KbivLrgaUKHDm7v2R3XojFlXUNfOzZ1krlxhe7U6auDHrCMGhLQs8ceIVebsDIdICHperJWLgqY V5h7ZJu70LEfYT5t0KHxQ1E7ziPmuGC10eBSl7nwIl&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=jGsr9Nx44XDhn2nT0OFR3NwjXe1vtRholMFumho/bBM=&c=/OUMpt621GlMsMg0fXUH Rt8vCswe241E7OHn596hi3cOcbRp QUjU VVY9v9UaeTYlqRT9 5nHdlCvX1ebWh FuE59IbT7PFPBQVWvdjDLSJq7Zj0zEss8BiIzPV9G0&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=vI/KsEa2UIabW7sG7Hhxrosf08pDp9NEymKA9bP8QUc=&c=eBrDiuMSDs/us7NvsCDLdPw7VHDSlsZ9KaWsLcoQhrbOSxeqv3VB6mJCw5sT7/svu6R2d5fcRQAg00hbBx4bsl6GoYnoloiGx/IAe6DhMWtdps9nKHafJvq71ujTQjLy&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=JCgP3HqOaURWIjMXj1 sbVqejfBNLzbzEujIU6l2zSk=&c=6gAHuQ1/yBMues vewIfCcwcs/Yo1ZPEyirtgr24Ok6V swYFU8cKGTF5IKt7ZqR oeEofLVTYvc2sSr5miETHe2sVBBZw2t/RRrFOh0zAx7 xRGgAyeGZa3hX5KqEAi&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=8KV09G02QTikK/bNIARkIBPJDHDoMX/qrj asECQw7M=&c=xfEJ48efNVVVBWbKDj7OhQGWb ynmVpThLwnxnB UHBUGNcabKzb1LAdura/hXj/Be55fSHJ52xLTDtZo9CxRjQAe/A4jEMEsJINECG0Uuok1oIIetNR1t5Nbz9PCxzc&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=e/hZvVsZ/l9N7K6TSrUUGhFl0Ai27MNpdSay6gzRemM=&c=ZGih7D4CKgw5gSSzYQ5PZ5SzL5rpvGjJHI48MVtzwSQIJit9AyCeE2eOYITTX7benscHh2fjTBh7v9Ezq8RuQOYUkZh3sUMd XA70HzMWr3vm8edPn3tZTLKrPbP5pXb&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.guardquickbyte.com/c?x=R/9sMqoHh1Ke1GvtWEz9eGQo z/1L3MqF/JxXYsSk8U=&c=cW36OTZGcL FnnXuQB0XvJv1AmAKMc9M2B IlS3EM4iaZPjjQxMTHEC8W4myHHymnxB0KmY YSVbutOmLbSpXKuHT L084w9BtCf/86VeJJLERdaodoq6hEaPeH9D8q3&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=SfuGRedLbbuUf30GSUgbAkaksrYGG1qMMCYFGWKkoDc=&c=rK3o6iCtm2J1OlFwPM7wwKmS6bu5VbEOZSrsc7eAAXHFvzWOc8n/c3zaiRx0hgsTg7abi2qKGqBtqsYSpQmYPB0nWnZbzUyxm33t2uQkuxgkipFKmuyPk1VrYLIMhL1f&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.guardquickbyte.com/c?x=W8bpoybCbqOFu557T34OPTkzet4gKfIOoXN/pWLQiIw=&c=fmB MXgqnr/9lwkVxLKC2YgDd2407i3XHhHB1YIX6ZfW2w6bZvjOxqM7I2rkMyg3SqYkZ9lBUgAUp2krOobGR wmL afYmVkEYJqfHriMIcLSIrbmnvarlW8Fzfz66S&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=UtBdh0FMDh4ziuy9FkcIM3qYSwBPNue7FJP4XaoQffA=&c=Td8TWQiE1i9Uws8XzsCokfzqtnciQRmDvQG OVIcmskTEY/cP0G OPzKM94dxBT8A/iCsqfSGIgRYxMEtgL/SvAmIAOb/t8EPy4yrQM7FT2kDRAdz34az4Cw9ErBbF22&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=x/CHz5tR1yo0l/IoUjfX zQpHrRFdKqOIHGfUCCPLNw=&c=6OwlqUD4CFOqu5RL 1IQrujk7T7CiQ3tcf1t4B9XmPn1Sq2PJA/qZUP5HeWfIoP3KyIfI3/aMDYMfFpV/Zjlni5ZXxo0L0tATwxx/I2w0cPhs72QA UoTZgm3Ns0XE5k&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=Ysj/7UpzPMFJvh6P5smxPQcTRO3LwddA tdxECf6GXA=&c=dv6sCJ4ipfOZHaduIMzlnHi1j/dOtkkZAWIVLqZWYvnupthfab5zWdbd1sUqS0nFgOh7MhAS/tjMWamYCm2S5vX1Yjj5TTPtI7prffHJ1lLZ2H7fY69Zzbq05LnZh2aS&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=bu4qACHnTmB 04z z3jBGQ7kFgGW 7deKsOYacmBq I=&c=tgsMXm2D5A57yErwfBwttwlGJ qAiRPexqQNDS5YgJ1 W8Se6JLIb/ZvBKAoG1aXaxaFlM 2phyQOa3Pa3ikC0WQiSwkLfLh5sRKPUIfW lMzY/f3m2QAX7FOyrBFiOK&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=kHy5RcIc/MWh076v42mH2ptDCusOwwpZ/NZjtP24Ohw=&c=AvfSO6Ymgg1AqLKg3kEsaMKypiHi7nQ/m3y72AcmfRmurvfsf8YewgUWx5NXNGUGj0PS4/SWv2pLKSGZTGjRdPZtDfnXYOVI9rxdl3IS0P5HruZNCwKpErfXu3q7yEPn&downloadAs=iTunes Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

Remove itunes installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.