home

itunes setup.exe

Beni

Darwen Marketing Inc.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application itunes setup.exe, “Beni Setup ” by Darwen Marketing has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Apple's iTunes but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Darwen Marketing Inc.  (signed and verified)

Product:
Beni

Description:
Beni Setup

MD5:
155e05a103f437bc4cd94970537dd6ae

SHA-1:
4fa6354c78cf8aa8bb6ca18ab07b646dc33d90b2

SHA-256:
b60904ba108e428ee5e3c9b26562c16eaf8f9200d22e5d2a6b6cd99a19a57c42

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/27/2024 4:35:35 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DarwenMa.Installer (M)
16.3.24.18

File size:
1007.6 KB (1,031,760 bytes)

Product version:
3.3.0

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\itunes setup.exe

Digital Signature
Signed by:
Darwen Marketing Inc.

Authority:
thawte, Inc.

Valid from:
2/16/2016 5:30:00 AM

Valid to:
5/18/2017 5:29:59 AM

Subject:
CN=Darwen Marketing Inc., OU=IT, O=Darwen Marketing Inc., L=Victoria, S=British Columbia, C=CA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1F1F22B813CDB509DAAD9139C753C40F

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:5mC2dUuHKAsjmBXsvrPXxj9ddUrxnkrmeqz9+OYIws:5f3qSXxj9d2tkrVYtYh

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9110

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file itunes setup.exe has been seen being distributed by the following 4 URLs.

http://www.hostgifthead.com/c?x=AJLKetabMeVeuRKPwU6j52ck2JVgQRF0o9FZvbFNi1o=&c=rjHLN0p8b6tVSg7nrIOlyouL lKlSfbG4 a5cXnBkLljTw1n34qrB/p3Q8XvTFYt6iFIw4ha8jo2ms b xovmG/ftjy7GjAxPwjuwR5hb5qxSgLyIqnqyuhU7BG2z1ZWTjTKfr/aMlKR7T80Hse6Uljp /fhc0oICGxu0AZHce4=&e=0&downloadAs=iTunes Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.downloadsbundlebyte.com/c?x=uE8XtKW5OJ/edSPYOfDw mXjPlSXKLhwqcH0E4Dj4Ws=&c=Cw5U qhR7rHCNRDlLSVpUurMpLmfTspS/saIgEmQDeXq1JiO3e2o2VBeuc1iP7 bMlBdngsgYV 7eualkmLTGqmyo01HDItiX8WOBhFj8mF70uVCqMfwssSGByz9KQnUJSof9c b iJ 33BYpCl2XBm0Qh/jWI1PE/TVPKoKe1w=&e=0&downloadAs=iTunes Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.hostgifthead.com/c?x=sivWLg1ydjExlEWA3uK02IVJGD06Pxuih/uGMox0TmA=&c=BYD8KiZkZ6HWhrrf4SKgMJmfEmZBipzYAH0O a4t noBddE2wU5zeqDceVxjj0yeSwEoqlxAbz1VStH4KmbXbXN/X8HFsi68M4nUCk4MfqqbfVC34hw JlroFLn7xLgEF9p6FDoXVSbtt45ujbBKbzNn1PuTeOuIVN0j5YKE5EY=&e=0&downloadAs=iTunes Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.heartcontentvault.com/c?x=mPwiPlvqAg7VQo/OHSHah7m1wAqNBHa9BaFmS1AhTB8=&c=cSOyNSbPg VcQIXrucj5cwIxSvybVif5sx0sOpf5CY0FqeDY179E72lMlTUbku22eCGrRBetmbuntCfLTr tZzRAynj8B8SinsmZfTAiKd5lgu RLfMJPzYPy6YpxsB0Y0qD8zWOGIX/nQhcxQA2aLTGErHcGehSb5X1DsWCC4Q=&e=0&downloadAs=iTunes Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

Remove itunes setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.