» сodec performer803975.exe
Overview
Analysis
File Details

сodec performer803975.exe

Klingon Tech Software LLC

This is the Performersoft setup installer. The application сodec performer803975.exe by Klingon Tech Software has been detected as adware by 9 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. The setup program bundles additional offers, mostly adware, using the InstallBrain installer, a pay-per-install monetization download manager. InstallBrain will also install a background updater service that will update any installed browser add-ons and plug-ins. It is also typically executed from the user's temporary directory.

File name:

Publisher:

CodecPerformer (signed by Klingon Tech Software LLC)

Product:

CodecPerformer

Version:

14.7.22.12

MD5:

5d58d4c971fe435c50cd69fad4100d3d

SHA-1:

e5add14ce9468c53bc92c8bb66892a6e412a0213

SHA-256:

4f8e3a2ad32b08d1c6e88c712f416643d261ad6d8c0b99d5595fa530870f218f

Scanner detections:

9 / 68

Status:

Adware

Explanation:

Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/25/2024 6:48:47 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/InstallBrain.Gen8

7.11.163.164

AVG

Generic

2015.0.3404

Comodo Security

Application.Win32.InstallBrain.BF

18948

Dr.Web

Adware.Downware.6211

9.0.1.05190

ESET NOD32

Win32/InstallBrain.CH (variant)

8.10142

Malwarebytes

PUP.Optional.CodecPerformer.A

v2014.07.23.12

Panda Antivirus

Trj/Genetic.gen

14.07.23.12

Reason Heuristics

PUP.Installer.KlingonTechSoftware.V

14.8.1.0

VIPRE Antivirus

Threat.4759033

31208

File size:

1.2 MB (1,300,824 bytes)

Product version:

14.7.22.12

Original file name:

CodecPerformerSetup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

InstallBrain

Language:

Inglise (Ameerika Ühendriigid)

Common path:

C:\users\{user}\appdata\local\temp\?odec performer803975.exe

Digital Signature

Signed by:

Klingon Tech Software LLC

Authority:

GoDaddy.com, Inc.

Valid from:

12/18/2013 11:13:41 PM

Valid to:

12/18/2016 11:13:41 PM

Subject:

CN=Klingon Tech Software LLC, O=Klingon Tech Software LLC, L=Beaverton, S=Oregon, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

2B712628C920AA

File PE Metadata

Compilation timestamp:

7/16/2014 2:20:36 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:vJ7zTtp/d35Xi6kgaINVL1/ZtDYe01reA8rrE7uJYsU3MQL9Mbu6E0OAig:VvTV35XiTcNFtvYe01iAYE7ClU3M0ibr

Entry address:

0x9B56

Entry point:

E8, 58, 4D, 00, 00, E9, 89, FE, FF, FF, C7, 01, 70, C5, 41, 00, E9, 23, FA, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, 70, C5, 41, 00, E8, 10, FA, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, 9F, EC, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08, 51, 52, E8, 51, 19, 00, 00, 59, 59, 85, C0, 74, 04, 33, C0, EB, 24, F6, 06, 02, 74, 05, F6, 07, 08, 74, F2, 8B, 45, 10... 
[+]

Code size:

108 KB (110,592 bytes)

Remove сodec performer803975.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.