home

сodec performer804499.exe

Codec Pack

Green Tech Software LLC

This is the Performersoft setup installer. The application сodec performer804499.exe by Green Tech Software has been detected as adware by 27 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. According to AVG, this software downloads additional adware offers during setup. It is also typically executed from the user's temporary directory.
Publisher:
Green Tech Software LLC  (signed and verified)

Product:
Codec Pack

Version:
1.18.2.14

MD5:
6cf8ff27aa091b18cdcc15d33c2f35ea

SHA-1:
4fd989a440e34f385a2f043949e66c7a8aedb372

SHA-256:
c8b3fa4ebe0d514073f6ab2c66cd5000a86287ca841de7483bbe06f4931a6335

Scanner detections:
27 / 68

Status:
Adware

Explanation:
Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
5/9/2024 5:31:43 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.InstallBrain.D
354

Agnitum Outpost
PUA.InstallBrain
7.1.1

Avira AntiVirus
APPL/InstallBrain.Gen
7.11.125.192

avast!
Win32:Malware-gen
2014.9-160215

AVG
Skodna.Downloader
2017.0.2832

Bitdefender
Application.Bundler.InstallBrain.D
1.0.20.230

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Trojan.Installbrain-235
0.98/19980

Comodo Security
Application.Win32.InstallBrain.BF
17640

Dr.Web
Adware.Downware.1988
9.0.1.046

Emsisoft Anti-Malware
Application.Bundler.InstallBrain
8.16.02.15.04

ESET NOD32
Win32/InstallBrain.BH (variant)
10.9310

F-Prot
W32/A-8e1f0c9d
v6.4.7.1.166

F-Secure
Riskware.Application.Bundler.InstallBrain
11.2016-15-02_2

G Data
Application.Bundler.InstallBrain
16.2.24

IKARUS anti.virus
Win32.Malware
t3scan.2.2.29

K7 AntiVirus
Unwanted-Program
13.176.11873

Malwarebytes
PUP.Optional.InstallBrain.A
v2016.02.15.04

MicroWorld eScan
Application.Bundler.InstallBrain.D
17.0.0.138

NANO AntiVirus
Trojan.Win32.Downware.cstqny
0.28.0.58101

Norman
Application.Bundler.InstallBrain.D
11.20160215

Panda Antivirus
Trj/Genetic.gen
16.02.15.04

Reason Heuristics
PUP.Performersoft.GreenTechSoftware.Bundler (M)
16.2.15.16

Rising Antivirus
PE:PUF.SmartInstaller!1.9EA6
23.00.65.16213

Sophos
InstallBrain
4.98

VIPRE Antivirus
InstallBrain
25584

Zillya! Antivirus
Trojan.Black.Win32.17104
2.0.0.1907

File size:
2.1 MB (2,152,168 bytes)

Product version:
1.18.2.14

Copyright:
Copyright 2013

Original file name:
Codec Pack.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
InstallBrain

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\сodec performer804499.exe

Digital Signature
Signed by:
Green Tech Software LLC

Authority:
GoDaddy.com, Inc.

Valid from:
12/18/2013 6:15:01 PM

Valid to:
12/18/2016 6:15:01 PM

Subject:
CN=Green Tech Software LLC, O=Green Tech Software LLC, L=Beaverton, S=Oregon, C=US

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
2B856416CAA762

File PE Metadata
Compilation timestamp:
12/25/2013 12:21:41 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
49152:e7VBk+u09t/W0Gif4cNRaTmyWKYpkfbXsI3kL29Gbi60:IBqoW0Gy4cNyWKYa0C

Entry address:
0xED725

Entry point:
E8, 4E, B4, 00, 00, E9, 89, FE, FF, FF, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, 60, C0, 58, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 2D, 5B, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, A0, D8, 4E, 00, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83, E0, 03, 03, C8, FF, 24, 85, B4...
 
[+]

Code size:
1.2 MB (1,239,552 bytes)

Remove сodec performer804499.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.