home

itunes6464setup.exe

Application program

Insane Entertainment, LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application itunes6464setup.exe, “Application program Setup ” by Insane Entertainment has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Apple's iTunes but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Generic   (signed by Insane Entertainment, LLC)

Product:
Application program

Description:
Application program Setup

MD5:
f083daddb3048854d6cfd79a682802fe

SHA-1:
0dc6b01c87c2cfa7bb7dc5a3e94fd3842621daf6

SHA-256:
8e474e8e141b24494cce55cc1845586b9aacb392e52b41bf7acce2bfca178b77

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/15/2024 6:34:57 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.InsaneEntertainment.Installer (M)
15.12.20.12

File size:
984.7 KB (1,008,328 bytes)

Product version:
4.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\itunes6464setup.exe

Digital Signature
Signed by:
Insane Entertainment, LLC

Authority:
GlobalSign nv-sa

Valid from:
11/12/2015 11:00:51 AM

Valid to:
11/12/2016 11:00:51 AM

Subject:
E=ido.chernobroda@ironsrc.com, CN="Insane Entertainment, LLC", O="Insane Entertainment, LLC", S=Florida, C=US

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121E1C7AB30E292D5352CB1E51A0E0020AA

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:/qvK82fhBxqd1ckLTNqK6fQ/Q0Y85Cp53TOYQ:/qydJBx21DLxzJH9EJq

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9220

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file itunes6464setup.exe has been seen being distributed by the following URL.

http://www.dlcleanlaboratory.com/c?x=/7jJw Dze1aydpbDJ4oA1S 29U W0T6JXq2IueCsLgs=&c=IJ2UEGGe v rdz9cqmahYkJftyVFF6ph05wYjov1bI/mA DFBvoWjCt/e22nU Anpmut21zMoKPI/ThkpNxRAlsQ9Cu7Txtobi4hlttM9vTarqXp2zVmWsN3Grj1mmVqnHZRP3//MtPVdP7Z5iYfDg==&downloadAs=iTunes6464Setup.exe&fallback_url=https://secure-appldnld.apple.com/itunes12/.../iTunes6464Setup.exe

Remove itunes6464setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.