» bestcodecspaclsetup.exe
Overview
Analysis
File Details
Downloads (1)
Network (2)

bestcodecspaclsetup.exe

Installer

Performersoft LLC

This is the Performersoft setup installer. The application bestcodecspaclsetup.exe by Performersoft has been detected as a potentially unwanted program by 31 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. The setup program bundles additional offers, mostly adware, using the InstallBrain installer, a pay-per-install monetization download manager. InstallBrain will also install a background updater service that will update any installed browser add-ons and plug-ins. The file has been seen being downloaded from www.softologicc.com. While running, it connects to the Internet address www.ibbalance.com on port 443.

File name:

Publisher:

Performersoft LLC (signed and verified)

Product:

Installer

Version:

14.12.8.9

MD5:

257139a4a74258016b92d6287f0f9d5e

SHA-1:

09c6d06014c02c1e1773c23646ecc369730a05ec

SHA-256:

b611f8a5055135a3bd6e68164e289dcd5074e8510be6bf53b949053ae5fc909c

Scanner detections:

31 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/25/2024 12:38:01 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Bundler.InstallBrain.A

6348409

Agnitum Outpost

Adware.BrainInst

7.1.1

Avira AntiVirus

APPL/InstallBrain.Gen7

7.11.198.252

avast!

Win32:InstallBrain-AC [PUP]

150101-1

AVG

Adware AdInstaller.InstallBrain

2014.0.4253

Bitdefender

Application.Bundler.InstallBrain.A

1.0.20.5

Bkav FE

W32.HfsAdware

1.3.0.6267

Clam AntiVirus

Win.Adware.Installbrain-461

0.98/19865

Comodo Security

Application.Win32.InstallBrain.BA

20547

Dr.Web

Adware.Downware.1295

9.0.1.05190

Emsisoft Anti-Malware

Application.Bundler.InstallBrain

9.0.0.4799

ESET NOD32

Win32/InstallBrain.O potentially unwanted application

7.0.302.0

Fortinet FortiGate

Adware/InstallBrain.OP

1/1/2015

F-Prot

W32/IBrain.C.gen

4.6.5.141

F-Secure

Trojan:W32/InstallBrain.A

5.13.68

G Data

Application.Bundler.InstallBrain

15.1.24

K7 AntiVirus

Unwanted-Program

13.188.14496

Kaspersky

not-a-virus:AdWare.Win32.BrainInst

15.0.0.543

Malwarebytes

Adware.InstallBrain

v2015.01.01.09

Microsoft Security Essentials

Threat.Undefined

1.191.1318.0

MicroWorld eScan

Application.Bundler.InstallBrain.A

16.0.0.3

NANO AntiVirus

Trojan.Win32.Downware.cquphu

0.30.0.64448

Norman

Application.Bundler.InstallBrain.A

29.12.2014 07:19:03

Panda Antivirus

PUP/Ibups

15.01.01.09

Quick Heal

TrojanDownloader.Brantall.A5

1.15.14.00

Reason Heuristics

PUP.Installer.Performersoft.T

15.1.1.21

Sophos

PUA 'InstallBrain'

5.09

SUPERAntiSpyware

Adware.InstallBrain/Variant

10141

Vba32 AntiVirus

Signed-AdWare.BrainInst.PerformersoftLLC

3.12.26.3

VIPRE Antivirus

Threat.4150696

35418

Zillya! Antivirus

Adware.BrainInst.Win32.31

2.0.0.2024

File size:

567.4 KB (580,992 bytes)

Product version:

14.12.8.9

Original file name:

installer.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

InstallBrain

Language:

English (United States)

Common path:

C:\users\{user}\downloads\bestcodecspaclsetup.exe

Digital Signature

Signed by:

Performersoft LLC

Authority:

GoDaddy.com, Inc.

Valid from:

6/27/2012 3:28:03 PM

Valid to:

6/27/2015 3:28:03 PM

Subject:

CN=Performersoft LLC, O=Performersoft LLC, L=Beaverton, S=OR, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

07DAC5F73C6773

File PE Metadata

Compilation timestamp:

11/23/2012 3:11:27 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:DUx7fKJCO7VJa/T+eYVKW6UsdJ8TNDvcOgAmk0s+z28xuc7oti/ENokKW0DA:DQfH0gdYV7gX8TNVyz28gcjENokJ0DA

Entry address:

0x134C9

Entry point:

E8, 21, 46, 00, 00, E9, 89, FE, FF, FF, 6A, 0C, 68, F0, 5C, 42, 00, E8, 21, 18, 00, 00, 6A, 0E, E8, 1E, 48, 00, 00, 59, 83, 65, FC, 00, 8B, 75, 08, 8B, 4E, 04, 85, C9, 74, 2F, A1, 78, 87, 42, 00, BA, 74, 87, 42, 00, 89, 45, E4, 85, C0, 74, 11, 39, 08, 75, 2C, 8B, 48, 04, 89, 4A, 04, 50, E8, DB, EA, FF, FF, 59, FF, 76, 04, E8, D2, EA, FF, FF, 59, 83, 66, 04, 00, C7, 45, FC, FE, FF, FF, FF, E8, 0A, 00, 00, 00, E8, 10, 18, 00, 00, C3, 8B, D0, EB, C5, 6A, 0E, E8, EA, 46, 00, 00, 59, C3, CC, CC, CC, CC, CC, CC... 
[+]

Entropy:

7.7310 (probably packed)

Code size:

125 KB (128,000 bytes)

The file bestcodecspaclsetup.exe has been seen being distributed by the following URL.

http://www.softologicc.com/.../gk90y?exename=BestCodecsPaclSetup&cid=3777&cid=3777&tid=11_132473941_ba87819c-8ac2-454e-aa29-a08bd4857db5&224390

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to www.softologic.com (174.37.181.31:80)

TCP (HTTP SSL):

Connects to www.ibbalance.com (173.192.190.227:443)

Remove bestcodecspaclsetup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.