home

driverperformersetup.exe

Installer

Performersoft LLC

This is the Performersoft setup installer. The application driverperformersetup.exe by Performersoft has been detected as a potentially unwanted program by 26 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. This is the uninstaller utility registered in the Windows Control Panel for the program Updater Service. The setup program bundles additional offers, mostly adware, using the InstallBrain installer, a pay-per-install monetization download manager. InstallBrain will also install a background updater service that will update any installed browser add-ons and plug-ins.
Publisher:
Performersoft LLC  (signed and verified)

Product:
Installer

Version:
14.12.8.9

MD5:
74859c4387dba6eeb468cce183a933b4

SHA-1:
37c633fe16fc76661a7b731c6954548cfcaffbf6

SHA-256:
ffbb22763040e84ac1ed4be1a574acb2bb0e4dc8f0581c41d3a581e2ee00db15

Scanner detections:
26 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/19/2024 8:12:02 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.InstallBrain.A
951

Agnitum Outpost
Adware.BrainInst
7.1.1

Avira AntiVirus
APPL/InstallBrain.Gen7
7.11.157.140

avast!
Win32:InstallBrain-V [PUP]
140617-1

AVG
InstallBrain
2015.0.3429

Bitdefender
Application.Bundler.InstallBrain.A
1.0.20.900

Comodo Security
Application.Win32.InstallBrain.BA
18707

Dr.Web
Adware.Downware.1295
9.0.1.05190

ESET NOD32
Win32/InstallBrain.P potentially unwanted application
7.0.302.0

Fortinet FortiGate
Adware/InstallBrain.OP
6/29/2014

F-Prot
W32/IBrain.C.gen
4.6.5.141

F-Secure
Trojan:W32/InstallBrain.A
11.2014-29-06_1

G Data
Application.Bundler.InstallBrain
14.6.24

IKARUS anti.virus
AdWare.InstallBrain
t3scan.1.6.1.0

Kaspersky
not-a-virus:AdWare.Win32.BrainInst
15.0.0.463

Malwarebytes
Adware.InstallBrain
v2014.06.29.06

Microsoft Security Essentials
Threat.Undefined
1.177.1092.0

MicroWorld eScan
Application.Bundler.InstallBrain.A
15.0.0.540

NANO AntiVirus
Trojan.Win32.Downware.cqhtrj
0.28.0.60475

Panda Antivirus
PUP/Ibups
14.06.29.06

Quick Heal
TrojanDownloader.Brantall.A5
6.14.14.00

Reason Heuristics
PUP.Installer.Performersoft.U
14.8.7.22

Sophos
InstallBrain
4.98

SUPERAntiSpyware
Adware.InstallBrain/Variant
10514

VIPRE Antivirus
Threat.4371328
29708

Zillya! Antivirus
Adware.BrainInst.Win32.16
2.0.0.1841

File size:
582.4 KB (596,408 bytes)

Product version:
14.12.8.9

Copyright:
Copyright 2012

Original file name:
installer.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
InstallBrain

Language:
English (United States)

Common path:
C:\users\{user}\downloads\driverperformersetup.exe

Digital Signature
Signed by:
Performersoft LLC

Authority:
GoDaddy.com, Inc.

Valid from:
6/27/2012 10:28:03 PM

Valid to:
6/27/2015 10:28:03 PM

Subject:
CN=Performersoft LLC, O=Performersoft LLC, L=Beaverton, S=OR, C=US

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
07DAC5F73C6773

File PE Metadata
Compilation timestamp:
12/12/2012 2:53:20 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:yb9W3CBwSdIztda6XwAyTzsrI5uIT9CWoo74wakNS4U/u+LUpHAT0Q1ynQh:FCUzt0r18muIoW77DBNS49pHAd6y

Entry address:
0xFBE2

Entry point:
E8, 06, 45, 00, 00, E9, 89, FE, FF, FF, 6A, 0C, 68, 38, 0C, 42, 00, E8, 18, 18, 00, 00, 6A, 0E, E8, 03, 47, 00, 00, 59, 83, 65, FC, 00, 8B, 75, 08, 8B, 4E, 04, 85, C9, 74, 2F, A1, 78, 36, 42, 00, BA, 74, 36, 42, 00, 89, 45, E4, 85, C0, 74, 11, 39, 08, 75, 2C, 8B, 48, 04, 89, 4A, 04, 50, E8, F2, E6, FF, FF, 59, FF, 76, 04, E8, E9, E6, FF, FF, 59, 83, 66, 04, 00, C7, 45, FC, FE, FF, FF, FF, E8, 0A, 00, 00, 00, E8, 07, 18, 00, 00, C3, 8B, D0, EB, C5, 6A, 0E, E8, CF, 45, 00, 00, 59, C3, CC, CC, CC, CC, 8B, 54...
 
[+]

Code size:
106 KB (108,544 bytes)

Program Uninstaller
Program name:
Updater Service

Display version:
14,12,8,9

Uninstall string:
"C:\ProgramData\IBUpdaterService\ibsvc.exe" /UNINSTALL


The file driverperformersetup.exe has been seen being distributed by the following URL.

http://www.softologicb.com/.../gkcqq?exename=DriverPerformerSetup&cid=218&clickid=0017280761799429606

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

TCP (HTTP):
Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com  (54.221.252.69:80)

Remove driverperformersetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.