» itunes-64-11.1.3.exe
Overview
Analysis
File Details
Downloads (15)

itunes-64-11.1.3.exe

iTunes

RICH MEDIA SYSTEMS INC.

The application itunes-64-11.1.3.exe by RICH MEDIA SYSTEMS INC has been detected as a potentially unwanted program by 15 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from itunes.1800download.com and multiple other hosts.

File name:

Publisher:

RICH MEDIA SYSTEMS INC. (signed and verified)

Product:

iTunes

Version:

1.0.0.0

MD5:

41604fa103568c46d78989752a73f2e3

SHA-1:

cf16817ad800a9d74f4b615286008c4d966a8ac8

SHA-256:

2df57383a70a727e6cb2b3bd2eaf30d0869857f6a68ede334b75bab6746a64b0

Scanner detections:

15 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

10/11/2025 4:28:32 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Riskware.Agent

7.1.1

AhnLab V3 Security

PUP/Win32.OpenCandy

2015.05.01

AVG

OpenCandy

2016.0.3105

Baidu Antivirus

Adware.Win32.OpenCandy

4.0.3.15519

Clam AntiVirus

Win.Trojan.Agent-855157

0.98/21511

Dr.Web

Adware.Downware.10304

9.0.1.05190

ESET NOD32

Win32/OpenCandy.C potentially unsafe application

7.0.302.0

G Data

Win32.Adware.OpenCandy

15.5.25

K7 AntiVirus

Trojan

13.203.15767

McAfee

Artemis!41604FA10356

5600.6761

NANO AntiVirus

Riskware.Win32.Downware.dqybgj

0.30.24.1357

Qihoo 360 Security

HEUR/QVM42.0.Malware.Gen

1.0.0.1015

Reason Heuristics

PUP.Installer.RICHMEDIASYSTEMS

15.5.19.4

Trend Micro House Call

TROJ_GEN.R0EAH05CP15

7.2.139

VIPRE Antivirus

Threat.4847482

39676

File size:

418.1 KB (428,184 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\itunes-64-11.1.3.exe

Digital Signature

Signed by:

RICH MEDIA SYSTEMS INC.

Authority:

Symantec Corporation

Valid from:

2/17/2015 5:30:00 AM

Valid to:

2/18/2016 5:29:59 AM

Subject:

CN=RICH MEDIA SYSTEMS INC., O=RICH MEDIA SYSTEMS INC., L=HENDERSON, S=Nevada, C=US

Issuer:

CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

3F87144C25AF8BCF29F29C5A1FEEF4BA

File PE Metadata

Compilation timestamp:

5/20/2013 5:23:00 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:YiuQJaIJ3lGULxCI8JgIlBoh0hsCX0m7+mZPG:kQJaIJ3rLYI8kIj7+5

Entry address:

0x331C

Entry point:

81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00... 
[+]

Entropy:

7.8728

Packer / compiler:

Nullsoft install system v2.x

Code size:

24 KB (24,576 bytes)

The file itunes-64-11.1.3.exe has been seen being distributed by the following 15 URLs.

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhnyas6H7KB2sTS35you2dBNJ0HteuK4ei3pg0ZTcWmKEfvyUPVugexyz5 XBgiT Cj5C0byunD8gfbbvJqBxXFA J8xi14BXnWtGH4swNEivSH4UHGRQ65Xi83iPSVeMe0gJFsFMaXlVXltc43EIBEw2v64RnNnao6x2 4/HGi8sUjE3/.../YghSflCc1d5NXiBzy35tKNnCg9ZrddRJo Jypr5fCsXhBjhATvlM9PUCbmDB 0 sSwmEhmLHmJ

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/yan9np5ktEPJUykYr32LSb0gA0aZ3GHQuOmHLc/x7hlwc UDE b yXqWh r7Wm0yP/TrtPKyCcO/8BznlNGSXemFD9rl918tn7oUSCTQbxW2pO4dHdbOfB3bUQdOOz9UHBtIYqLeE5hnqqnGCUvasWrhf8 TWO4uEjHn 1nR5i/.../sljRZW54v3nwGhOrh 1CakCd1e7dWwAHPvuYPGxXB0MvRRTsc3OnUxseSkDxEihBW6xZsdRz7qRQf3qYjszgcsLHmJ

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL0as6K8aZouCbsqSt4z9Ecex67Pan3fHm wF5KayfJRbzkBbMz3rhh2seDBBLEt3rqBwX9u3GtyKyFvNKBm2JDqtY6gF9QDS/zGDU2nsEj7Cj5SGjaSrpW2pKpd25FPas5dhION63/UHx3cMfOLVgoj6v2VH9xao6x2 k/HGGzulPdl7xmBpivNIa8ZDJW3suvHPsv3BcW55q91AzqZel/.../CsXhBjhATvlM9PUCbmDB 0 sSwmEhmLHmJ

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv E8/yG6sGMxwdoEP0b1Y/j2PHmugw0MIGjVEeivE/Y9xbNykY7dXk7E7SShBkfzun25i/DZqdvT0mlPq4dm2gkXRn3kADx1ntFwum6kDyCERrhBycb/NikEdux6egoEcKX2VnBtLJeNZkdzxeSmTjQuO4/02/9sSizk5xndl7xmB5ivNpv6fXof1cW3D EtlxQH5sv3jlLqLvMhhSflCc1X/M 4UXKquZKaiHV5M6RIBo4/.../CsXhBnhATmiIEQRm7zDU75oJD2xgkmLHmJ

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDu1E1v4YtbB6qAk5ib0pWJgjIJQeRigK6n3fHm ykYcdnGHWOOmEqc20bIjzsCXFVnZv3a6WVT84XG j/fZrt/alWZMqtY6gF9QEi/.../9Wy83zdG5TerJrJRkHOOz9UHBtLpGSck5gnqqnGCUvaoT00v8 TWO5uEiPxat D9G3csi8Z3JO1IK3HOkujUlMrsih3BG9LPZnnG sBcVPt4P HSyqoZrTkCgqdeAaGdEvMjwpsuKtD0Mly0jllMBCFzHgBxPyvZn6kkdwLHmJ

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsml0kNzu1E1v4Y9bB87pi/269qGx42dMHJU71Y/.../a0FiYuMYuMegkpz6viGDR8PMCshK4nBSqwsFDdw7x D9G3d8i8KCgCi576Xvsv3BcR55qr1AStfKE2nS6mCd0EqoLlFjr0tZWNmy0 ZqhAW9F1bG0o8 ihFwg0xlbplYhWGHXrBwnxpJ3nzw8iPXmJ

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKhEgqnKJyK97Yk5jz0o2xwzNIGJUbkb7C/NXC20g0BZnGHWOOlEqc0wKtrh8yfDR7Vuz3zT0z2smm mf6SpN/SgzUU/.../POBo8j7 xWnM3c8b40ucnSDDuoFGMlvtmFpq0eMu8ZDJW3cuvQqo2lF4f6oLvygGmOvUy1D6tQMVc7s2pFyCq883B02liO6RIBo47M2169Kf5SFlzhVW61NdWU3W1FAawqZju1QcmLHmJ

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDu1E1v4Y9bB87pi/269qGx42dMHJU71Y/.../44JDlzR0kLHmJ

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GR7xcteQv c8/zOn/.../44JDlzR0kLHmJ

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhv4cp K4fE9tG//qmMxwdgEPwG PKn3fHm4ykZQO2uFCeLkErY90fk5kNSWRAaT9T3wD1T8 3G7geeH94WNg2gIq5cwiUcbEDP5X31oksc0/yrkW32aXukUndXqdD0GaLMge0FMc/OmHz89JNzFZREkhrO9VmN7Lcbg2q4/.../O3ons asXhBjhATvlM9PUCbmDB 0 sSwmEhmLHmJ

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GR7xcteQv E8/zq9sGMxwdwEPwC Nu jeDCuyxdSMWmeWLDzCr5uybhoz4WXBQaDu2vqBwX9uXGtiufa7dPbm3ES MEiiBZIVny1CT1nn4Aj/yvwSDfAA/wAmY6kdWsVY/o4KRIdauuyCC88asWNLBgonue9RjQuO4/22/89B2GzoFGMlvtmFsTkLJe8ZDJW3cG3D7Bg2kNArpX7iUX5b7R0iS 4VocI/.../jocTY2nViMqRIHI48PX0rtOSnHRhhhVW61NdWU3W1FAawqZju1QcmLHmJ

http://1800dcdn.blob.core.windows.net/dir195/wi/18/33/1/.../itunes-64-11.1.3.exe

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklU2NSr XF2sNZ/Os cr7GTgo3Zx1Y5GeFXsK7H/NWH8mQBKOSCGGeO1ELYlyPpqxsyPWE D9GzyC0zl/yLh36qW7cvT0mlKoZ8i1wwBFCr2Q3s3yNEivSH8UHHABPkCnYTzPHQNa7MgbEFbIaSuXHt3c43EIBEw2v64RnNnao6x2 4/.../VvDoDkKZa8ZDJW3cuvHuo2lF4f7oLvywGsfKE2nSisEcdU5s6pSDrjsZuC3mgybPVJRI4vOG0o8 ihFwg0xlbplYhWGHXrBwnxq53gxQ8jN3mJ

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhv4coWK4fE9rm/8qHpxyMkFbk3hYqmpdzPlggFKOTqGGu2lHrA/xrpmw83eDQqb7XmnUBKi mm0yP/.../k8k7uXKkDjzeA65Xi83gNz0VPOBxb0Reeuq1Cmh0O8TILAl7yOS6R2U3c8b40ucnTjDuoFGMlv1mFpq YsntZXJWzYfkSfsv3BcR55r1hFDxfKE2nS sEYwEutWwGnPou5rTkCgqdeAaGdEvMjwpsuKtD0Mly0jllMBCFzHgBxPyvZn6kkdwLHmJ

http://itunes.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv E8/.../j2PHmuhg0MIGjPEe2tCr0 y7Byz4WXBAaDpnasHk20snm1mfbSvNKbm2BBs9Zp10dJDXymAjU2nsUj7H2lBjfMAq5Xi83iPSUGbrogJFsFMKXlFiMrasWNLBkonqnnAC1mcoP4w7h9TjD450jExfVtAJC6ecqnZ3Zb1IK3HOkujUlMrsih3BG9LPZnnG sBcVPt4P HSyqoZrTkCgqdeAaGdEvMjwpsuKtD0Mly0jllMBCFzHgBxPyvZn6kkdwLHmJ

Remove itunes-64-11.1.3.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.