home

itunes64setup.exe

Software

Fried Cookie Ltd.

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application itunes64setup.exe, “Software Setup ” by Fried Cookie has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download Apple's iTunes but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
TeleCharger  (signed by Fried Cookie Ltd.)

Product:
Software

Description:
Software Setup

Version:
1.0.5.a0.1_33288

MD5:
e880166db12005d927e840c44f9c767d

SHA-1:
46a3743567f7c701e4e158c6b55927fa32452fa6

SHA-256:
c75c3cb9bbb36175f737147dd8f842e86988947330094deb2bac152e414c2149

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/25/2024 2:45:44 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore (M)
16.8.10.13

File size:
691.3 KB (707,888 bytes)

Product version:
4.1

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\itunes64setup.exe

Digital Signature
Signed by:
Fried Cookie Ltd.

Authority:
thawte, Inc.

Valid from:
12/24/2014 1:00:00 AM

Valid to:
12/25/2015 12:59:59 AM

Subject:
CN=Fried Cookie Ltd., OU=IT, O=Fried Cookie Ltd., L=Tel-Aviv, S=Israel, C=IL

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
7AF7564936A3976396DE017B6EDADD0D

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:xXKQp7Ja9uMwlfDtIp0n6ig+Y6t2Mk5jYNeOFMY2A/VLsUEomv1QA:xXdJpjBDOY6ig+Y6t2PKIyd/1s3fn

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file itunes64setup.exe has been seen being distributed by the following URL.

http://d.telechargerhosting.com/?data=YCZSXHwHGuATYMGa2NKyi40txWgIG4viRQFr4TzaHvoDxkbTby4s2MqTZMdj1V3CF9oejmVix8sqj8LflMXwjKws52hdJAkT SUe206PrpNsg9lT7E Iz4794JMJauWwrZCLttMq3B2DLktfQkzZB2r 0t CUIlHMPWr2Y5M9BpHmWuEqtNDqZ/8KM n2onC7sfUzrNkDofwXDZvJVqhfgJEepDsQ0AJm2vaGZOV9EIDUQ374oQCZJIWK88pVu6yZ 2cIMiRRziofpbT5gBuy pZu43YfX53W3ZJeGh76cdHsJzTzA/VeDRySqTAY2LOLT2u6KXdgoXvmH JJzUqud FClonScpj55SWC3lj/uEUcv5gwyohD NqJ5XI1u 6vgjtH5dDab4MDa06nZRyO5OQggQThJ/0aGPB10FprEbqD5HnAltLsfioxbzfhm78H6dAtumiNN4DhxPlWJySZOD4blwH bjEWLTYma75QrHVqMm5YANxb85pBtIXkNGAGW0sWqju4VxzAatP5R0FYdzVBx05nv1fJDOBLqfMUkmlj8rdLD4b1BOUsgHu OZhCgRYZQ==&key=OkW2mstsVXjQtSbXg r4nDNJ anj/JCAMspPZZ1uNpW8 r1kQWj5LkwI6 SPhy5X9PMfv 7W4zMgp2w77Pr1SHE1S3hv76swxxIcqraXR0Rz0EosjT0RF/hVPxSrFgxdioFd/eoAIJ0Qzb6oS3L2RaBCn7eJPe/QszDOA 1UvR/89OphByGbvJhPwUgVGwY0vl0LSpf//1deaEIk8TtjJoHjz5WFcRc4HBSwqJ3WuJJOaG1k6uQUyhv55x77Z7A2MJJ4oPV EkAwGaDtpbNhjwHpMXVR7fCX k8F3m qaXPGqi7fmMDBfhr2SIY2Z3sPdk8rvMUdpF4Lm25RcW3jFA==&ic_user_id=9257&fallback_url

Remove itunes64setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.