home

itunes6464setup.exe

Program

Agile Install (New Media Holdings Ltd.)

The application itunes6464setup.exe, “Program Setup ” by Agile Install (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download Apple's iTunes but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Internet Installer   (signed by Agile Install (New Media Holdings Ltd.))

Product:
Program

Description:
Program Setup

Version:
3.3.3.6

MD5:
dff24b39e369b64e12d855fd03e708d2

SHA-1:
58c2ca7f7907e8fdf748688f3d712b3f7605c351

SHA-256:
998a18a398e544cfc151af0ef332c79152527f468720435923920f1844586fd4

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/28/2024 7:52:06 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.9.3

File size:
988.9 KB (1,012,656 bytes)

Product version:
1.1

Copyright:
Internet installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\itunes6464setup.exe

Digital Signature
Signed by:
Agile Install (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 6:08:20 AM

Valid to:
10/30/2016 10:39:05 AM

Subject:
CN=Agile Install (New Media Holdings Ltd.), O=Agile Install (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121E708A02FF07CE5E25618BCF50F6A6CAE

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:IZigW/sM2VCClql7wYsckYuy/g45fLv2bGKC1RwmhAGZ/y1e:IZ1dDUClql70ckY645fboGT1Dt

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9280

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file itunes6464setup.exe has been seen being distributed by the following 10 URLs.

http://www.appsdeliveryupdate.com/c?x=t7ScfbwA6FWxOaAXaYIYPy9CE/7rzexx JETEKuNN4k=&c=jfLvxQKr/C6j2IcC4fdPmSQ1RARs m99bWvbNouhUuttuEY3X3oJHSqq0OX6OBJ/k437rMUSpNUhzrmhO217mGG/f/zJAYC/B9no7 QUGxkY7xpIOhfWjVkMUHOjWHZmA4FyFEETWNCKU6RbCEMiPw==&downloadAs=iTunes6464Setup.exe&fallback_url=https://secure-appldnld.apple.com/itunes12/.../iTunes6464Setup.exe

http://www.appsdeliveryupdate.com/c?x=8RjH31nwtIEQ1XLNXNhCed2TDEcbMhT9IZomis1bGH8=&c= Hd9OnVTbxWsogvEj9KovpqL39OZ0Kr7k1lbihK tI3gGGJc6jT5b0I yPsbxfOWrUrtaNyfq/81m4KWRiQxfulXsSDv60pbP5H0545/rdDKN4dxwkUoTTwnhK96dUc54SIGAQ1/PUBQlPA7TgGzMw==&downloadAs=iTunes6464Setup.exe&fallback_url=https://secure-appldnld.apple.com/itunes12/.../iTunes6464Setup.exe

http://www.bundlesvaultsdownloads.com/c?x=JkIeDVDXOBKplAmEa4YRTt26j6HDxeshuNUWsqlCyG0=&c=aipAWz1EEzM3LXXMdTKHvw9s0u3dnfosTR1bBjaBEj3ERxP4LcXzdQBKSZ4mx XbdO7yQ9vkADcouuigdqbXIo/INjBAQFWu1F76bEtAUin9CjeoCcR7YMG9scFJ qe2&downloadAs=iTunes6464Setup.exe&fallback_url=https://secure-appldnld.apple.com/itunes12/.../iTunes6464Setup.exe

http://www.presentsignchuckle.com/c?x=bZJyy3fAjfW5C6jVW5fExxKogmNrw5Z6NsCWoDti/Ps=&c=WfLUx1E2rjt1vGpXCaXCOiPD/4C9uX0jjzhIpZ40VeVSeC5Hg4lk31KeleqSDYyx8yX/Kq4Izh8nYJZRhxLGkPgVKUt75cGqZVdTo5EtRlyU hCqQRHorD6 dLCC Kw4&downloadAs=iTunes6464Setup.exe&fallback_url=https://secure-appldnld.apple.com/itunes12/.../iTunes6464Setup.exe

http://www.presenthostgift.com/c?x=DmseWIePl oVdVE7kjIWPieApQI3KT6BTsTFywUJGg0=&c=qnlGUQjyDaNqfp/g/zP/Avfi0JAtID1MGH8RHKU5 Z2F QY/NoSQUz/O5kkwSGOxNgJZIDvUE8YLe4yDRn6IipXILUUR Wm/KPjK8XiNmOW/6cIyObZD 2bQcEJyWTBo&downloadAs=iTunes6464Setup.exe&fallback_url=https://secure-appldnld.apple.com/itunes12/.../iTunes6464Setup.exe

http://www.shareconceptsdownloads.com/c?x=BrfGyo2dc3hpnB/Py8V hhPBS tmtDcrwio wZiDyjY=&c=DsZSctKILiRCJTf7I uaWJSQ2b2eYmeXoHQxDLa1OqPrhCXVpttQg0s21RLTtQyWYJO5oeYauJMj/IUpNCWQfeMtYTJ/J7I41L97vND4TDT5R/HfZa5RUnutg8q9pyBk&downloadAs=iTunes6464Setup.exe&fallback_url=https://secure-appldnld.apple.com/itunes12/.../iTunes6464Setup.exe

http://www.presenthostgift.com/c?x=UKKesZVVJDQfcjHZX/NwHE39rTZB0v3MwUYNOIit7xM=&c=jLUy9G8nTtxo2WHjyCZR9uqBmcterMloqsRL/4btx3jYleO25d6XyeAobbwvkk14SRcf307G1TI9nZOyqbD06KJO//sVy3MXVdKFMBGEMZA vpK13YOcevq9icx8lknq&downloadAs=iTunes6464Setup.exe&fallback_url=https://secure-appldnld.apple.com/itunes12/.../iTunes6464Setup.exe

http://www.bodyhostingtour.com/c?x=h2JDS1EUWi8i5zksyedeUp4YfSYS/Gt5sf4YSLsCd/Q=&c=qC4zCEBSaDbtlyutRiWWGh8x AeCfIPEeZcW0lOFV27cOWRVyY6WoEV6RbUJHzsKC7xgfuMxDVAN9OvEgZQNxpplgvWnuXD633SANwnqPSOiBO9YtU7knNRnlKh5t8fR&downloadAs=iTunes6464Setup.exe&fallback_url=https://secure-appldnld.apple.com/itunes12/.../iTunes6464Setup.exe

http://www.contentsignbulk.com/c?x=YOu/VC7tFH 0 3hECHq8Sss6SNZ8b6spoDbZyHIC2W4=&c=eR36hsXCGqKQauboTL0eIw9BUIF5/tdyQ7OEiAxt/xSiWwPXvF9jx/L1vUMysf9wlQzwCWAF xYMez1H6ATiFpzzIjEGRj eFJuUlaAe8mFblv75i4cuqXNZpbI4YaVH&downloadAs=iTunes6464Setup.exe&fallback_url=https://secure-appldnld.apple.com/itunes12/.../iTunes6464Setup.exe

http://www.presentsignchuckle.com/c?x=ATAsyCg 6Ut1rfY1xZeTvVnTF5vNQ0cVOsry2 bjEzk=&c=6Cycm0Q TeVTWMrPVd9QkhJte5 CWOLEIfV1f9N5ySDSkrN/bwmNBHortCGfd97i0W9DrUh2foNs1kxd L1udzWKvJ 7kw1zaNQIBdPr8F9MBP4 mSUCvIx8J 81eOPE&downloadAs=iTunes6464Setup.exe&fallback_url=https://secure-appldnld.apple.com/itunes12/.../iTunes6464Setup.exe

Remove itunes6464setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.