home

сodec performer803975.exe

Codec Pack

R2D2 Tech Software LLC

This is the Performersoft setup installer. The application сodec performer803975.exe by R2D2 Tech Software has been detected as adware by 23 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. According to AVG, this software downloads additional adware offers during setup. It is also typically executed from the user's temporary directory.
Publisher:
R2D2 Tech Software LLC  (signed and verified)

Product:
Codec Pack

Version:
1.4.1.14

MD5:
485c0828a3f5e70c2d31f7f209403152

SHA-1:
edbbaaf6889bd291671edd2a990811e1160384ab

SHA-256:
e493ce234572477f1a9f9c3c9ea209fc3eb27bcc31e8221c7abdd7ba7b053c16

Scanner detections:
23 / 68

Status:
Adware

Explanation:
Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/16/2024 8:31:15 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.InstallBrain.D
918

Agnitum Outpost
PUA.InstallBrain
7.1.1

Avira AntiVirus
APPL/InstallBrain.Gen
7.11.125.192

avast!
Win32:PUP-gen [PUP]
2014.9-140910

AVG
Skodna.Downloader
2015.0.3397

Bitdefender
Application.Bundler.InstallBrain.D
1.0.20.1060

Comodo Security
Application.Win32.InstallBrain.BF
17640

Dr.Web
Adware.Downware.1988
9.0.1.0212

ESET NOD32
Win32/InstallBrain.BH (variant)
8.9310

F-Secure
Application.Bundler.InstallBrain
11.2014-31-07_5

G Data
Application.Bundler.InstallBrain
14.7.24

herdProtect (fuzzy)
variant of сodec performer804225.exe (Adware)
2014.9.10.16

IKARUS anti.virus
AdWare.InstallBrain
t3scan.1.6.1.0

K7 AntiVirus
Unwanted-Program
13.176.11888

Malwarebytes
PUP.Optional.InstallBrain.A
v2014.07.31.11

MicroWorld eScan
Application.Bundler.InstallBrain.D
15.0.0.636

NANO AntiVirus
Trojan.Win32.Downware.cstqny
0.28.0.57630

Panda Antivirus
Trj/Genetic.gen
14.07.31.11

Qihoo 360 Security
Malware.QVM06.Gen
1.0.0.1015

Reason Heuristics
PUP.R2D2TechSoftware.V
14.8.8.0

Rising Antivirus
PE:PUF.SmartInstaller!1.9EA6
23.00.65.14729

Sophos
InstallBrain
4.98

VIPRE Antivirus
InstallBrain
25584

File size:
1.9 MB (2,024,672 bytes)

Product version:
1.4.1.14

Copyright:
Copyright 2013

Original file name:
Codec Pack.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
InstallBrain

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\?odec performer803975.exe

Digital Signature
Signed by:
R2D2 Tech Software LLC

Authority:
GoDaddy.com, Inc.

Valid from:
12/18/2013 10:13:12 PM

Valid to:
12/18/2016 10:13:12 PM

Subject:
CN=R2D2 Tech Software LLC, O=R2D2 Tech Software LLC, L=Beaverton, S=Oregon, C=US

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
7287089BC80B

File PE Metadata
Compilation timestamp:
1/3/2014 3:40:40 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
49152:BEEkglN/MOBAFEJo5EKEHhTStBkG1oMxI3G/G4I3:dVMO2FEkSwt5oN2w

Entry address:
0xED955

Entry point:
E8, 4E, B4, 00, 00, E9, 89, FE, FF, FF, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, 60, C0, 58, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 2D, 5B, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, D0, DA, 4E, 00, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83, E0, 03, 03, C8, FF, 24, 85, E4...
 
[+]

Code size:
1.2 MB (1,240,576 bytes)

Remove сodec performer803975.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.