home

ib_uninstall.exe

Installer

MediaTechSoft Inc.

This is the Performersoft setup installer. The application ib_uninstall.exe by MediaTechSoft has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the InstallBrain installer. This is the uninstaller utility registered in the Windows Control Panel for the program 77zip. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
MediaTechSoft Inc.  (signed and verified)

Product:
Installer

Version:
15.9.28.27

MD5:
27389ad53686fe4f98c3315d64d4f2d6

SHA-1:
1415156217c8312916a78f90dd3c56744ceaef7e

SHA-256:
ea15f45b315b39397bd12884736243abe79d0c44ea5271330067f2a344e4d298

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/27/2024 12:22:58 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Performersoft (M)
17.3.5.22

File size:
665.3 KB (681,248 bytes)

Product version:
15.9.28.27

Copyright:
Copyright 2012

Original file name:
installer.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
InstallBrain

Language:
English (United States)

Common path:
C:\Program Files\uninstall information\ib\97\3867\ib_uninstall.exe

Digital Signature
Signed by:
MediaTechSoft Inc.

Authority:
GoDaddy.com, Inc.

Valid from:
3/29/2013 2:18:00 PM

Valid to:
3/29/2016 2:18:00 PM

Subject:
CN=MediaTechSoft Inc., O=MediaTechSoft Inc., L=Beaverton, S=OR, C=US

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
4B870730DE21B9

File PE Metadata
Compilation timestamp:
4/3/2013 5:17:05 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

Entry address:
0xDD6E

Entry point:
E8, 69, 50, 00, 00, E9, 89, FE, FF, FF, 6A, 0C, 68, 90, 22, 42, 00, E8, 1C, 18, 00, 00, 6A, 0E, E8, 69, 52, 00, 00, 59, 83, 65, FC, 00, 8B, 75, 08, 8B, 4E, 04, 85, C9, 74, 2F, A1, 10, 67, 42, 00, BA, 0C, 67, 42, 00, 89, 45, E4, 85, C0, 74, 11, 39, 08, 75, 2C, 8B, 48, 04, 89, 4A, 04, 50, E8, 16, E8, FF, FF, 59, FF, 76, 04, E8, 0D, E8, FF, FF, 59, 83, 66, 04, 00, C7, 45, FC, FE, FF, FF, FF, E8, 0A, 00, 00, 00, E8, 0B, 18, 00, 00, C3, 8B, D0, EB, C5, 6A, 0E, E8, 32, 51, 00, 00, 59, C3, CC, CC, CC, CC, CC, CC...
 
[+]

Code size:
111 KB (113,664 bytes)

Program Uninstaller
Program name:
77zip

Uninstall string:
"C:\Program Files\Uninstall Information\Ib\97\3867\ib_uninstall.exe" /PUninstall="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\77zip" /reg=32


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

Remove ib_uninstall.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.