» сodec performer513770.exe
Overview
Analysis
File Details

сodec performer513770.exe

Giraffe Tech Software LLC

This is the Performersoft setup installer. The application сodec performer513770.exe by Giraffe Tech Software has been detected as adware by 16 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. The setup program bundles additional offers, mostly adware, using the InstallBrain installer, a pay-per-install monetization download manager. InstallBrain will also install a background updater service that will update any installed browser add-ons and plug-ins. It is also typically executed from the user's temporary directory.

File name:

Publisher:

BestCodecsPack (signed by Giraffe Tech Software LLC)

Product:

BestCodecsPack

Version:

14.8.19.10

MD5:

58a6027c9e2da70db53d942685d7715b

SHA-1:

68e14d7e9fc458df47dbb23e3c181030dd86a08c

SHA-256:

ecacedbc733842b4b605d1281ab1e17c5fac3f82c245d6ed56518d01c54509e8

Scanner detections:

16 / 68

Status:

Adware

Explanation:

Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/25/2024 11:58:54 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/InstallBrain.Gen8

7.11.168.126

AVG

Adware InstallBrain

2015.0.3348

Comodo Security

Application.Win32.InstallBrain.BF

19049

Dr.Web

Adware.Downware.8001

9.0.1.0260

ESET NOD32

Win32/InstallBrain.CO potentially unwanted application

8.7.0.302.0

Fortinet FortiGate

Riskware/Generic.AC.1774

11/22/2014

F-Prot

W32/A-3442f84d

v6.4.7.1.166

herdProtect (fuzzy)

variant of bestcodecspacksetup.exe (Adware)

2014.11.22.6

K7 AntiVirus

Unwanted-Program

13.185.13840

NANO AntiVirus

Riskware.Win32.Downware.ddwsjq

0.28.2.61721

Panda Antivirus

Trj/Genetic.gen

14.09.17.08

Reason Heuristics

PUP.Installer.GiraffeTechSoftware.V

14.9.17.18

Sophos

InstallBrain

4.98

Vba32 AntiVirus

AdWare.BrainInst

3.12.26.3

VIPRE Antivirus

Threat.4759033

32210

Zillya! Antivirus

Trojan.Black.Win32.17554

2.0.0.1897

File size:

1.2 MB (1,272,944 bytes)

Product version:

14.8.19.10

Original file name:

BestCodecsPackSetup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

InstallBrain

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\temp\?odec performer513770.exe

Digital Signature

Signed by:

Giraffe Tech Software LLC

Authority:

GoDaddy.com, Inc.

Valid from:

12/18/2013 9:14:32 PM

Valid to:

12/18/2016 9:14:32 PM

Subject:

CN=Giraffe Tech Software LLC, O=Giraffe Tech Software LLC, L=Beaverton, S=Oregon, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

27F9CD848ABDA8

File PE Metadata

Compilation timestamp:

8/7/2014 9:32:43 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:IOQKemOTbiJXi6kgaINVyohzRDOUrCRl+QLk/QypHcdaKmVsUQGOjbvD/+XbdeXa:CpmXJXiTcNUohzRDOXBLkbpHcda4XDmJ

Entry address:

0x8B46

Entry point:

E8, 58, 4D, 00, 00, E9, 89, FE, FF, FF, C7, 01, 78, B5, 41, 00, E9, 23, FA, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, 78, B5, 41, 00, E8, 10, FA, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, 94, EC, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08, 51, 52, E8, 51, 19, 00, 00, 59, 59, 85, C0, 74, 04, 33, C0, EB, 24, F6, 06, 02, 74, 05, F6, 07, 08, 74, F2, 8B, 45, 10... 
[+]

Entropy:

7.7104 (probably packed)

Code size:

103 KB (105,472 bytes)

Remove сodec performer513770.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.