home

сodec performer803975.exe

Forty Seven Tech Software LLC

This is the Performersoft setup installer. The application сodec performer803975.exe by Forty Seven Tech Software has been detected as adware by 22 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. The setup program bundles additional offers, mostly adware, using the InstallBrain installer, a pay-per-install monetization download manager. InstallBrain will also install a background updater service that will update any installed browser add-ons and plug-ins. It is also typically executed from the user's temporary directory.
Publisher:
CodecPerformer  (signed by Forty Seven Tech Software LLC)

Product:
CodecPerformer

Version:
14.10.1.20

MD5:
77999a81377670f3caea13c11d297513

SHA-1:
c853c65254907e0430c61286561a0f4494dcbe06

SHA-256:
04a52447b115ece5d2ec3bd5a24697f317be84f199f2de8dfd909f7f8ec7a5af

Scanner detections:
22 / 68

Status:
Adware

Explanation:
Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/19/2024 10:10:52 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.InstallBrain.E
834

AhnLab V3 Security
PUP/Win32.InstallBrain
2014.10.02

Avira AntiVirus
ADWARE/InstallBrain.Gen
7.11.175.234

AVG
Adware InstallBrain.BA
2014.0.4040

Bitdefender
Application.Bundler.InstallBrain.E
1.0.20.1485

Dr.Web
Adware.Downware.8543
9.0.1.05190

ESET NOD32
Win32/InstallBrain.CP potentially unwanted application
7.0.302.0

F-Prot
W32/A-3442f84d
v6.4.7.1.166

F-Secure
Application.Bundler.InstallBrain
11.2014-24-10_6

G Data
Application.Bundler.InstallBrain
14.10.24

IKARUS anti.virus
PUA.InstallBrain
t3scan.1.7.8.0

K7 AntiVirus
Unwanted-Program
13.185.13789

Kaspersky
not-a-virus:AdWare.Win32.BrainInst
15.0.0.494

Malwarebytes
PUP.Optional.InstallBrain
v2014.10.24.06

MicroWorld eScan
Application.Bundler.InstallBrain.E
15.0.0.891

Panda Antivirus
Trj/Genetic.gen
14.10.24.06

Qihoo 360 Security
Malware.QVM06.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.FortySevenTechSoftware.V
14.10.24.6

Sophos
InstallBrain
4.98

Vba32 AntiVirus
AdWare.BrainInst
3.12.26.3

VIPRE Antivirus
Threat.4759033
33520

Zillya! Antivirus
Adware.BrainInst.Win32.122
2.0.0.1939

File size:
1.2 MB (1,273,856 bytes)

Product version:
14.10.1.20

Copyright:
Copyright 2014

Original file name:
CodecPerformerSetup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
InstallBrain

Common path:
C:\users\{user}\appdata\local\temp\?odec performer803975.exe

Digital Signature
Signed by:
Forty Seven Tech Software LLC

Authority:
GoDaddy.com, Inc.

Valid from:
12/18/2013 11:13:53 PM

Valid to:
12/18/2016 11:13:53 PM

Subject:
CN=Forty Seven Tech Software LLC, O=Forty Seven Tech Software LLC, L=Beaverton, S=Oregon, C=US

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
27C178FAD33D6A

File PE Metadata
Compilation timestamp:
9/10/2014 5:13:39 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:LEfCvka3Nobi3Xi6kgaINVRX/diX2n0e435qkLeI+t2r48WmEGOjbvD/+XbdeXcV:ofCL9d3XiTcNjPdiGnT65qkYt2r48Wmn

Entry address:
0x115F3

Entry point:
E8, D5, 70, 00, 00, E9, DA, 48, 00, 00, C7, 01, 80, B5, 41, 00, E9, 59, 4A, 00, 00, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, 80, B5, 41, 00, E8, 46, 4A, 00, 00, F6, 45, 08, 01, 74, 07, 56, E8, 3F, 92, 00, 00, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 56, 68, 00, 00, 03, 00, 68, 00, 00, 01, 00, 33, F6, 56, E8, A0, 5D, 00, 00, 83, C4, 0C, 85, C0, 74, 0A, 56, 56, 56, 56, 56, E8, 22, 75, 00, 00, 5E, C3, E9, 0C, 95, FF, FF, CC, CC, CC, 8B, FF, 55, 8B, EC, 51, 56, 8B, F1, 83, 3E, 00, 75, 24, 6A, 00, 8D, 4D, FC, E8...
 
[+]

Code size:
102.5 KB (104,960 bytes)

Remove сodec performer803975.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.