» itunes_setup.exe
Overview
Analysis
File Details
Downloads (3)

itunes_setup.exe

Start Playing

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application itunes_setup.exe by Start Playing has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from get.downward1208.info and multiple other hosts.

File name:

itunes_setup.exe

Publisher:

Start Playing (signed and verified)

MD5:

0fae02438869f015a0a97942f7158b35

SHA-1:

0a2f96e995c56b55a98a444cfb3649b69332c5f7

SHA-256:

ca1afc3f6a5eaffcf36724537351c17aa8adedf48ea50dc8859d24b8e9fe3587

Scanner detections:

26 / 68

Status:

Adware

Explanation:

Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

5/25/2024 10:55:23 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Dropped:Application.Bundler.Outbrowse.AA

6381064

Agnitum Outpost

PUA.OutBrowse

7.1.1

AhnLab V3 Security

PUP/Win32.OutBrowse

2015.01.22

Avira AntiVirus

APPL/Outbrowse.Gen

7.11.204.32

AVG

Potentially harmful program Downloader.CVE

2014.0.4257

Bitdefender

Dropped:Application.Bundler.Outbrowse.AA

1.0.20.105

Comodo Security

Application.Win32.OutBrowse.MQPC

20797

Dr.Web

Trojan.OutBrowse.58

9.0.1.05190

Emsisoft Anti-Malware

Dropped:Application.Bundler.Outbrowse.AA

9.0.0.4799

ESET NOD32

Win32/OutBrowse.BM potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/OutBrowse

1/21/2015

F-Secure

Riskware.Dropped:Application.Bundler.Outbrowse

5.13.68

G Data

Dropped:Application.Bundler.Outbrowse.AA

15.1.24

IKARUS anti.virus

PUA.OutBrowse

t3scan.1.8.6.0

K7 AntiVirus

Trojan

13.191.14711

Kaspersky

not-a-virus:Downloader.NSIS.OutBrowse

15.0.0.543

Malwarebytes

PUP.Optional.OutBrowse

v2015.01.21.09

McAfee

Adware-OutBrowse.d

5600.6878

MicroWorld eScan

Dropped:Application.Bundler.Outbrowse.AA

16.0.0.63

NANO AntiVirus

Trojan.Win32.OutBrowse.dluceg

0.30.0.64812

Norman

Dropped:Application.Bundler.Outbrowse.AA

02.01.2015 13:58:24

Reason Heuristics

PUP.Installer.Outbrowse

15.1.21.21

Sophos

Generic PUA NO

4.98

Trend Micro House Call

Suspici.6BC7E129

7.2.21

Vba32 AntiVirus

Downloader.OutBrowse

3.12.26.3

VIPRE Antivirus

Threat.4150696

36694

File size:

573.1 KB (586,872 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

OutBrowse Revenyou (using Nullsoft Install System)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\itunes_setup.exe

Digital Signature

Signed by:

Start Playing

Authority:

Starfield Technologies, Inc.

Valid from:

12/8/2014 8:12:48 AM

Valid to:

12/8/2015 8:12:48 AM

Subject:

CN=Start Playing, O=Start Playing, L=DUBLIN, C=IE

Issuer:

CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

4E956215A6BB61

File PE Metadata

Compilation timestamp:

12/5/2009 4:50:52 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:iFGt9NXVGaLvbdKi9cHY9Ls/qus4cWrf9:i4bGAvUmXo//sJWrf

Entry address:

0x30FA

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00... 
[+]

Entropy:

7.9731

Packer / compiler:

Nullsoft install system v2.x

Code size:

23.5 KB (24,064 bytes)

The file itunes_setup.exe has been seen being distributed by the following 3 URLs.

http://get.downward1208.info/1419045090/DownloadManager/getalgk5?p=1955&d=3073&l=2935&n=1&productname=itunes&d1=140973&exeurl=http://appldnld.apple.com/iTunes11/091-6059.20130605.205Rf/iTunesSetup.exe&filename=iTunes_Setup&dynamicname=iTunes_for_PC&tyurl=http://www.postdownload.net/.../redirect.php?id=booh6fv3en7bd5oiklqkssvut299rpbp1gftiv4ljnff2ri0e6a0-f5b594fc026a1738f2429731e35843df&d=downloadb.net&p=iTunes&pid=3&bex=1&countryid=265

http://get2.up1208.info/1419045090/get?p=1955&d=3073&l=2935&n=1&productname=itunes&d1=140973&exeurl=http://appldnld.apple.com/iTunes11/091-6059.20130605.205Rf/iTunesSetup.exe&filename=iTunes_Setup&dynamicname=iTunes_for_PC&tyurl=http://www.postdownload.net/.../redirect.php?id=booh6fv3en7bd5oiklqkssvut299rpbp1gftiv4ljnff2ri0e6a0-f5b594fc026a1738f2429731e35843df&d=downloadb.net&p=iTunes&pid=3&bex=1&countryid=265

http://download.downloadb.net/download/331/.../

Remove itunes_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.