» bestcodecspacksetup.exe
Overview
Analysis
File Details
Downloads (1)
Network (3)

bestcodecspacksetup.exe

Installer

Performersoft LLC

This is the Performersoft setup installer. The application bestcodecspacksetup.exe by Performersoft has been detected as a potentially unwanted program by 68 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.softologicb.com. While running, it connects to the Internet address www.ibbalance.com on port 443.

File name:

Publisher:

Performersoft LLC (signed and verified)

Product:

Installer

Version:

14.12.8.9

MD5:

05b4b4daa19baadf02c2793a3932ff21

SHA-1:

03133c6fdfea4e834097018d110840f5eec0b33e

SHA-256:

d964215d95f51cd43456243a48b53a55207aff13f8cd78aa2e6599099b59b4af

Scanner detections:

68 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/20/2024 11:44:58 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Bundler.InstallBrain.A

991

AegisLab AV Signature

ADWARE-InstallBrain.Gen

2.1.4+

Agnitum Outpost

Adware.BrainInst

7.1.1

AhnLab V3 Security

Trojan/Win32.Brantall

14.05.19

Avira AntiVirus

Adware/InstallBrain.CE

7.11.121.36

avast!

Win32:InstallBrain-W [PUP]

140516-1

AVG

InstallCore.HT

2014.0.3950

Baidu Antivirus

Adware.Win32.Agent

4.0.3.14519

Bitdefender

Application.Bundler.InstallBrain.A

1.0.20.695

Bkav FE

W32.Clodb8d.Trojan

1.3.0.4613

Comodo Security

Application.Win32.InstallBrain.AF

17475

Dr.Web

Adware.Downware.1295

9.0.1.0139

Emsisoft Anti-Malware

Win32.Virtob.Gen.12

8.14.05.19.01

ESET NOD32

Win32/InstallBrain.AC (variant)

8.9190

Fortinet FortiGate

Adware/InstallBrain.OP

5/19/2014

F-Prot

W32/IBrain.B.gen

4.6.5.141

F-Secure

Trojan:W32/InstallBrain.A

11.2014-19-05_2

G Data

Win32.Application.InstallBrain

14.5.22

IKARUS anti.virus

AdInstaller

t3scan.2.2.29

K7 AntiVirus

Unwanted-Program

13.174.10588

Kaspersky

not-a-virus:AdWare.Win32.BrainInst

14.0.0.3842

Malwarebytes

Adware.InstallBrain

v2014.05.19.01

McAfee

RDN/Generic PUP.x!bpg

5600.7125

Microsoft Security Essentials

Threat.Undefined

1.173.2171.0

MicroWorld eScan

Application.Bundler.InstallBrain.A

15.0.0.417

NANO AntiVirus

Trojan.Win32.Downware.cqmhdj

0.28.0.57029

nProtect

Trojan-Clicker/W32.BrainInst.676192

14.03.21.01

Panda Antivirus

Adware/Ibups

14.05.19.01

Qihoo 360 Security

Malware.QVM10.Gen

1.0.0.1015

Quick Heal

TrojanDownloader.Brantall.b

5.14.12.00

Reason Heuristics

PUP.Installer.Performersoft.T

14.8.7.22

Rising Antivirus

PE:Malware.InstallBrain!6.10A6

23.00.65.14517

Sophos

InstallBrain

4.96

SUPERAntiSpyware

Trojan.Agent/Gen-Downware

10596

Total Defense

Win32/Tnega.BRRKCQ

37.0.10498

Trend Micro House Call

TROJ_GEN.F47V1122

7.2.139

Trend Micro

TROJ_SPNV.03KI13

10.465.19

Vba32 AntiVirus

AdWare.BrainInst

3.12.24.3

VIPRE Antivirus

Trojan.Win32.Generic!SB.0

24588

Zillya! Antivirus

Adware.BrainInst.Win32.63

2.0.0.1779

File size:

632.3 KB (647,456 bytes)

Product version:

14.12.8.9

Original file name:

installer.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

InstallBrain

Language:

English (United States)

Digital Signature

Signed by:

Performersoft LLC

Authority:

GoDaddy.com, Inc.

Valid from:

6/27/2012 4:28:03 PM

Valid to:

6/27/2015 4:28:03 PM

Subject:

CN=Performersoft LLC, O=Performersoft LLC, L=Beaverton, S=OR, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

07DAC5F73C6773

File PE Metadata

Compilation timestamp:

1/16/2013 5:10:15 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:mNqkncfpkb0OEUh34tzYexb+CpqgEB8ko1pt1aSElhI9NGj5n78zMdCCPYc7M+qg:n3FltkyDp42koPtgSE/V02Zqg

Entry address:

0x16B32

Entry point:

E8, E5, 53, 00, 00, E9, 89, FE, FF, FF, 6A, 0C, 68, 80, DE, 42, 00, E8, 18, 18, 00, 00, 6A, 0E, E8, E2, 55, 00, 00, 59, 83, 65, FC, 00, 8B, 75, 08, 8B, 4E, 04, 85, C9, 74, 2F, A1, 7C, 1F, 43, 00, BA, 78, 1F, 43, 00, 89, 45, E4, 85, C0, 74, 11, 39, 08, 75, 2C, 8B, 48, 04, 89, 4A, 04, 50, E8, D2, E3, FF, FF, 59, FF, 76, 04, E8, C9, E3, FF, FF, 59, 83, 66, 04, 00, C7, 45, FC, FE, FF, FF, FF, E8, 0A, 00, 00, 00, E8, 07, 18, 00, 00, C3, 8B, D0, EB, C5, 6A, 0E, E8, AE, 54, 00, 00, 59, C3, CC, CC, CC, CC, 8B, 54... 
[+]

Entropy:

7.6772

Code size:

152.5 KB (156,160 bytes)

The file bestcodecspacksetup.exe has been seen being distributed by the following URL.

http://www.softologicb.com/.../gk350?exename=BestCodecsPackSetup&cid=3932&clickid=0019407001994756242

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to www.softologic.com (174.37.181.31:80)

TCP (HTTP SSL):

Connects to www.ibbalance.com (173.192.190.227:443)

TCP (HTTP):

Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com (54.221.252.69:80)

Remove bestcodecspacksetup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.