» jet.exe
Overview
Analysis
File Details
Behaviors (5)
Programs (1)
Network (19)

jet.exe

Jet

Performersoft LLC

This is part of a Performersoft product, a 'PC optimzation' application that provides minimal benifits and may have been bundled by a third party installer. The application jet.exe by Performersoft has been detected as a potentially unwanted program by 6 anti-malware scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘GoogleChromeAutoLaunch_E45D1D3BD1AEA1FE8AAF50294057F775’. This file is typically installed with the program Jet Browser version 0.2.0.7 by PerformerSoft LLC which is a potentially unwanted software program. It bundles additional offers, mostly adware, using the InstallBrain installer, a pay-per-install monetization download manager. InstallBrain will also install a background updater service that will update any installed browser add-ons and plug-ins.

File name:

jet.exe

Publisher:

Performersoft LLC (signed and verified)

Product:

Jet

Version:

24.0.1293.0

MD5:

72f4803cdd19f5d9e743d2d57716b7b1

SHA-1:

8d6b534d31f77bc745d4a90daff85eddbb4ee98d

SHA-256:

83893bca7f3cd5c113dd592fb7f5df0b55c3065336334f69bd924c75c5ea3547

Scanner detections:

6 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Analysis date:

4/26/2024 2:02:36 PM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

APPL/InstallBrain.BY

7.11.105.44

Boost by Reason

Optional.Startup.Performersoft.D

188838

Comodo Security

UnclassifiedMalware

17023

Reason Heuristics

PUP.Startup.Performersoft.D

14.8.7.22

Trend Micro House Call

TROJ_GEN.F47V0816

7.2.357

VIPRE Antivirus

InstallBrain

21948

File size:

1.2 MB (1,287,136 bytes)

Product version:

24.0.1293.0

Original file name:

jet.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\performersoft\application\jet.exe

Digital Signature

Signed by:

Performersoft LLC

Authority:

GoDaddy.com, Inc.

Valid from:

6/27/2012 10:28:03 PM

Valid to:

6/27/2015 10:28:03 PM

Subject:

CN=Performersoft LLC, O=Performersoft LLC, L=Beaverton, S=OR, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

07DAC5F73C6773

File PE Metadata

Compilation timestamp:

8/11/2013 5:46:00 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:1QuGT88rO8xPMk36gwwMWbwAG9bOq74vl6v0Ou/HG5gfJ:qlTJP/6IpsAkbP70lK0t/wgfJ

Entry address:

0x94C71

Entry point:

E8, 67, C7, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 56, 8B, 35, 54, 42, 4B, 00, 57, FF, 35, 74, 8B, 51, 00, FF, D6, FF, 35, 70, 8B, 51, 00, 8B, D8, 89, 5D, FC, FF, D6, 8B, F0, 3B, F3, 0F, 82, 81, 00, 00, 00, 8B, FE, 2B, FB, 8D, 47, 04, 83, F8, 04, 72, 75, 53, E8, BD, C7, 00, 00, 8B, D8, 8D, 47, 04, 59, 3B, D8, 73, 48, B8, 00, 08, 00, 00, 3B, D8, 73, 02, 8B, C3, 03, C3, 3B, C3, 72, 0F, 50, FF, 75, FC, E8, 1E, 61, 00, 00, 59, 59, 85, C0, 75, 16, 8D, 43, 10, 3B, C3, 72, 3E, 50, FF, 75, FC, E8... 
[+]

Entropy:

6.4793

Code size:

713 KB (730,112 bytes)

Scheduled Task

Task name:

{FE32197D-6825-4C58-8F38-82AE18D6E7BA}

Trigger:

Registration (Runs on registration)

3 Shell Open Commands

Open type:

ftp

Command:

"C:\users\{user}\appdata\local\performersoft\application\jet.exe" -- "%1"

Open type:

http

Command:

"C:\users\{user}\appdata\local\performersoft\application\jet.exe" -- "%1"

Open type:

https

Command:

"C:\users\{user}\appdata\local\performersoft\application\jet.exe" -- "%1"

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

GoogleChromeAutoLaunch

Command:

"C:\users\{user}\appdata\local\performersoft\application\jet.exe" --no-startup-window

The file jet.exe has been discovered within the following program.

Jet Browser version 0.2.0.7 by PerformerSoft LLC

From the Privacy Policy: "We receive and store any information you enter on jetbrowser.com or give us in any other way. You provide most such information when you use the jetbrowser or bundled plugins.

www.jetbrowser.com

67% remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP SSL):

Connects to xx-fbcdn-shv-01-tpe1.fbcdn.net (31.13.87.5:443)

TCP (HTTP SSL):

Connects to instagram-p3-shv-01-tpe1.fbcdn.net (31.13.87.52:443)

TCP (HTTP SSL):

Connects to edge-z-m-mini-shv-01-tpe1.facebook.com (31.13.87.37:443)

TCP (HTTP):

Connects to edge-star-mini-shv-01-tpe1.facebook.com (31.13.87.36:80)

TCP (HTTP):

Connects to 7b.39.36a9.ip4.static.sl-reverse.com (169.54.57.123:80)

TCP (HTTP SSL):

Connects to server-54-230-95-158.fra2.r.cloudfront.net (54.230.95.158:443)

TCP (HTTP SSL):

Connects to cache.google.com (92.53.32.234:443)

TCP (HTTP SSL):

Connects to xx-fbcdn-shv-01-hkg3.fbcdn.net (31.13.95.12:443)

TCP (HTTP SSL):

Connects to instagram-p3-shv-01-hkg3.fbcdn.net (31.13.95.48:443)

TCP (HTTP):

Connects to f3.31.6132.ip4.static.sl-reverse.com (50.97.49.243:80)

TCP (HTTP SSL):

Connects to edge-z-m-mini-shv-01-hkg3.facebook.com (31.13.95.37:443)

TCP (HTTP SSL):

Connects to edge-video-shv-01-hkg3.fbcdn.net (31.13.95.14:443)

TCP (HTTP SSL):

Connects to edge-star-shv-01-hkg3.facebook.com (31.13.95.8:443)

TCP (HTTP):

Connects to edge-star-mini-shv-01-hkg3.facebook.com (31.13.95.36:80)

TCP (HTTP):

Connects to ec2-52-59-55-183.eu-central-1.compute.amazonaws.com (52.59.55.183:80)

TCP (HTTP SSL):

Connects to server-54-192-94-173.fra2.r.cloudfront.net (54.192.94.173:443)

TCP (HTTP SSL):

Connects to edge-star-mini-shv-01-fra3.facebook.com (31.13.93.36:443)

Remove jet.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.