home

itunessetup-win10.exe

Hamonog

FlashSetup (New Media Holdings Ltd)

The application itunessetup-win10.exe, “Hamonog Setup ” by FlashSetup (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Apple's iTunes but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Piruriponi   (signed by FlashSetup (New Media Holdings Ltd))

Product:
Hamonog

Description:
Hamonog Setup

MD5:
eae11986a32e73a2cbfee22e6f8acf35

SHA-1:
cf6291e0b6450f265aec54a907c8c4f4424f1424

SHA-256:
fa725c1b90a06cd998e1fcf814fa193f5ff847a5af3fc6c39e3020236cb4df92

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/28/2024 4:20:20 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.3.26.18

File size:
1007.2 KB (1,031,360 bytes)

Product version:
3.1

Copyright:
Internet installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\itunessetup-win10.exe

Digital Signature
Signed by:
FlashSetup (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 5:31:27 AM

Valid to:
5/26/2016 8:06:50 AM

Subject:
CN=FlashSetup (New Media Holdings Ltd), O=FlashSetup (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121FDED645F5771D0B9771141024E9B6BFB

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:VWWp+ArJI68hN70VWgUxYhJ/n3zhKkOZHAlfkV4:VvcAz+J4VUOhJfzhKkrcV

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9129

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file itunessetup-win10.exe has been seen being distributed by the following 6 URLs.

http://www.presentcapitalquick.com/c?x=9U3P1Dd a6ewPO1Q2APmb1Gr Y9LLpwlKwJRRZ3H0rA=&c=JdikbZTt6Aer2Bxh6pNwJVzCcCduX/uMVC4xBJcODhzYVlti1Mtq3YGB /0Lf/pPO7R 6cxoHe3KuCFHYHwDHyMfOPOyN/vPPwxrbvZnkNfTmHLp5WOgaWNMg LkEg5N&downloadAs=itunessetup-win10&fallback_url=http://.../iTunesSetup.exe

http://www.presentcapitalquick.com/c?x=Hw15QZ6Ccx73E dVoCclrecFRMpGAvaqiEbLDpeM1Os=&c=KhSauVL29dTSGfGDi5wpQOrYfJsqkLRT5ok9tjJ7HRor69i5OxKEbN5munoEgh0bIEI8TcPFtjtOSp9U4JV 4J0IyEOJuddr4Kl7jjKB/iBFalEI2f1x3S38XI7azLon&downloadAs=itunessetup-win10&fallback_url=http://.../iTunesSetup.exe

http://www.presentcapitalquick.com/c?x=1fF4oeDEbDYS7zTlJpPIeFl9o01qz0gnQksBd3S1EsQ=&c=SNCb Wx0rJldruUdk9hT5FDhS1zE0E9zsvpQNZdYr64m37IbV59qldv4fD2znB5GE Ft0zLxbk9x QR6ZjHDFop7ZJ4zCLHtrWmuLgFwvaa/pVstx/JsUPKZHrSx9WrL&downloadAs=itunessetup-win10&fallback_url=http://.../iTunesSetup.exe

http://www.presentcapitalquick.com/c?x=9kK JlP7 qXJSlewb1s2RCx808zd2Fbv0xfosM9uTkU=&c=m/Qh9HHBeJDcisgHS80te7pxh0twGNLRd01H96LXCxRi8EMGPkq2B9v2M3LEqXTDS0ROyB7G5oizdtkSg uAzI7XJt/tG00hdk0RrUuAPnOJ L YT/uwWLHJlYv8yXjn&downloadAs=itunessetup-win10&fallback_url=http://.../iTunesSetup.exe

http://www.binariesfilesdl.com/c?x=uexmrvIzSyFl VS9CLWtef3fL36IiA1xON5uqrZuKgg=&c=2Fk0c2cKmn2ctLGpstlwFrSwoCt mpiJOyUaZnjPw/AhuV2BdklneY8XNKeftkmNK8UrQLuv010ZkpikdutgdT9B2ReLQRCslsos3X0OgVViqhxWkMNK 1kyrsXhEmpX&downloadAs=itunessetup-win10&fallback_url=http://.../iTunesSetup.exe

http://www.presentcapitalquick.com/c?x=jd29dmeeUAmXFP3X9LDPQvjilcTIS4TFa9SndUq7Hyk=&c=Xzum75ZMcgyD7dThTGp2zKZFUl1IyYBgB2JIJ3GvZNKC a5lekoBkXezRjB7E0H2W7Wd4HMgP27bg5je/10KH9c8o4Lb3Cyl3nD3yEZ2yRTeocQ9f0noFTeoLCjsz vG&downloadAs=itunessetup-win10&fallback_url=http://.../iTunesSetup.exe

Remove itunessetup-win10.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.