» itunes_setup.exe
Overview
Analysis
File Details
Downloads (2)

itunes_setup.exe

Fast Downloads

The Adlogica setup manager, an installer that bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application itunes_setup.exe by Fast Downloads has been detected as adware by 15 anti-malware scanners. The program is a setup application that uses the Adlogica Downloader installer. The setup routine uses the RevenYou.Com Pay Per Install platform (OutBrowse) which bundles additional software offers inclduing toolbars, extensions, PC utilities as well as other PUPs. With this installer, users are expecting to download Apple's iTunes but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

itunes_setup.exe

Publisher:

Fast Downloads (signed and verified)

MD5:

09d87861631acce57ccb3419993224b9

SHA-1:

81ecd9d0895177b81cbf370d84a773cf41a19dea

SHA-256:

09337b7f84d3df1bfb873a04b6a595e8e9dcae5960ced2ab87dd1b056eeb34c0

Scanner detections:

15 / 68

Status:

Adware

Explanation:

Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/26/2024 6:55:17 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.OutBrowse

7.1.1

Avira AntiVirus

APPL/Downloader.Gen

7.11.169.144

AVG

InstallC

2015.0.3390

Dr.Web

infected with Trojan.Packed.28387

9.0.1.0218

ESET NOD32

Win32/OutBrowse.AB potentially unwanted application

8.7.0.302.0

Fortinet FortiGate

Riskware/OutBrowse

9/28/2014

F-Prot

W32/Outbrowse.B2.gen

v6.4.7.1.166

herdProtect (fuzzy)

variant of adobe_flash.exe (Adware)

2014.9.28.15

Malwarebytes

PUP.Optional.Bundle

v2014.09.28.11

McAfee

Adware-OutBrowse.a

5600.6994

NANO AntiVirus

Trojan.Win32.OutBrowse.ddvyee

0.28.2.61861

nProtect

Trojan-Clicker/W32.Inffinity.567368

14.08.27.01

Reason Heuristics

PUP.Installer.FastDownloads.M

14.8.6.20

Vba32 AntiVirus

Hoax.PornoAsset

3.12.26.3

VIPRE Antivirus

Threat.4786018

32210

File size:

554 KB (567,344 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Adlogica Downloader (using Nullsoft Install System)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\itunes_setup.exe

Digital Signature

Signed by:

Fast Downloads

Authority:

COMODO CA Limited

Valid from:

8/14/2013 1:00:00 AM

Valid to:

8/15/2014 12:59:59 AM

Subject:

CN=Fast Downloads, O=Fast Downloads, STREET=96 Jessie st 4th floor, L=San Francisco, S=CA, PostalCode=94105, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00D9726FD3E4B9094351093A3495F1FE97

File PE Metadata

Compilation timestamp:

12/5/2009 10:50:52 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:nZ6XADblfW7Dv1u35+qbxuQZbgG4hKTgJco9Oopy:nQyVW771ulxuQZbgGIdcoi

Entry address:

0x30FA

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00... 
[+]

Entropy:

7.9766

Packer / compiler:

Nullsoft install system v2.x

Code size:

23.5 KB (24,064 bytes)

The file itunes_setup.exe has been seen being distributed by the following 2 URLs.

http://dl1.app2desktop.com/DownloadManager/GetALGK2?p=1955&d=3073&l=2935&n=1&productname=itunes&d1=75919&exeurl=http://appldnld.apple.com/iTunes11/091-6059.20130605.205Rf/iTunesSetup.exe&filename=iTunes_Setup&dynamicname=iTunes_for_PC&tyurl=http://www.postdownload.net/.../redirect.php?id=v77pbveh3df2bq8eltbbknk3drtbn3u58vppunq1cv5303g45c80-b140a3e1a23f2ff61c4e08e39cddd819&d=windownload.net&p=iTunes&pid=3

http://itunes.download-file.windownload.net/download/93/.../?_u=v77pbveh3df2bq8eltbbknk3drtbn3u58vppunq1cv5303g45c80-b140a3e1a23f2ff61c4e08e39cddd819

Remove itunes_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.