iTunes64Setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
iTunes64Setup.exe
Size 193.4MB
Sample260920-1rtncsen9z
SHA256 25b28905a81406a5edbf482f7f3ee4831a8641d32d29dceda5d1eb3e8d534c08
MD5 42eb641b18ef0493a19f901a973b69cc
SHA1 db14cefd09acb78d1c0e8573308067acce9dfaf7
SHA512 0198c9c74e2681508d301012e939d2a73c8660cd85771f7bd813dfa6d5ecbc7dd0f0b9c17bd1fb64c154b9f9fb59ee0ad203ae43a8f534cb51c56d15a3e57bad
SSDEEP 3145728:mPRwI5YMdwrKNDKRjc/fTncHneoFhKGI9UhU/OCQXv/UwrcSwcKXahJryUM4:pk+roKRo/fTncH7FFU/OxU8cSw7aTyU
TLSH
T1FBA83384F1B05E57F6AF7230204E29A5FA19DC53293428FB7A63D7481E0B3821EB675D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

iTunes64Setup.exe

.exe 193.4MB

iTunes64Setup.exe

IMPHASH e4ec5defc5685a03588b81a9605a3385
SHA256 25b28905a81406a5edbf482f7f3ee4831a8641d32d29dceda5d1eb3e8d534c08
MD5 42eb641b18ef0493a19f901a973b69cc
SHA1 db14cefd09acb78d1c0e8573308067acce9dfaf7
SHA512 0198c9c74e2681508d301012e939d2a73c8660cd85771f7bd813dfa6d5ecbc7dd0f0b9c17bd1fb64c154b9f9fb59ee0ad203ae43a8f534cb51c56d15a3e57bad
SSDEEP 3145728:mPRwI5YMdwrKNDKRjc/fTncHneoFhKGI9UhU/OCQXv/UwrcSwcKXahJryUM4:pk+roKRo/fTncH7FFU/OxU8cSw7aTyU
TLSH
T1FBA83384F1B05E57F6AF7230204E29A5FA19DC53293428FB7A63D7481E0B3821EB675D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

5e:7a:e7:c3:fc:7d:2d:76:39:86:af:c8:c6:05:ad:35:2a:6f:26:d6:85:a5:eb:89:fb:62:6e:9a:6f:e6:99:35

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Chains

Sep 1, 2026

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

11:86:7e:d9:91:f1:62:ae:31:e5:cf:16:14:f8:7a:93:d6:58:7e:6d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Chains

Sep 1, 2026

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Serial Number

0d:a9:cd:96:be:78:f6:c1:cc:cb:f0:d3:15:6c:e4:d3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 16, 2026 - Mar 12, 2027

Minor OS version

Major OS version

Entry point

13560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\BWA\5DC9C98A-A477-0\iTunesWinPackageData_Final-121311.1\objroot\FileCache_iTunes64\setup\setup.pdb

kernel32

CreateDirectoryA CreateFileA DeleteFileA LocalFileTimeToFileTime RemoveDirectoryA SetFileAttributesA SetFileTime GetTempPathA CloseHandle GetLastError WaitForSingleObject CreateMutexA GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateProcessA GetTickCount GetSystemDirectoryA SetProcessWorkingSetSize FreeLibrary FreeResource GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource LocalAlloc LocalFree DosDateTimeToFileTime FindResourceA SetStdHandle HeapAlloc HeapFree GetProcessHeap GetLocalTime LoadLibraryExA LoadLibraryA HeapReAlloc HeapSize WriteConsoleW GetFileSizeEx GetStringTypeW FreeEnvironmentStringsW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader SetFilePointerEx ReadFile GetConsoleMode ReadConsoleW WriteFile GetConsoleOutputCP CreateFileW GetFileType GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW FlushFileBuffers MultiByteToWideChar WideCharToMultiByte SetEndOfFile FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW

user32

ShowWindow DestroyWindow CreateWindowExA SendMessageA GetSystemMetrics UpdateWindow

Name

.text

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

193.2MB

Virtual Size

193.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

iTunes64Setup.exe

kernel32

user32

generic