» pcperformersetup_vf79b29.exe
Overview
Analysis
File Details
Downloads (2)

pcperformersetup_vf79b29.exe

Red Balloons Software, LLC

This is the Performersoft setup installer. The application pcperformersetup_vf79b29.exe by Red Balloons Software has been detected as adware by 17 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. The setup program bundles additional offers, mostly adware, using the InstallBrain installer, a pay-per-install monetization download manager. InstallBrain will also install a background updater service that will update any installed browser add-ons and plug-ins. The file has been seen being downloaded from www.humipapp.com and multiple other hosts.

File name:

Publisher:

Red Balloons Software, LLC (signed and verified)

MD5:

9af6d769d7d437f2230323c2a247f832

SHA-1:

fbce87383c3108e8a389ffa05374e419d355cf40

SHA-256:

12d20c48dce57af5a0b3e4dd5243cf9f71280d8969e8d01a000104f5ac620766

Scanner detections:

17 / 68

Status:

Adware

Explanation:

Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

4/27/2024 12:50:04 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

PFS/PCPerformer.casd

7.11.125.116

avast!

Win32:Dropper-gen [Drp]

2014.9-140110

AVG

MalSign.Generic

2015.0.3598

Comodo Security

Application.Win32.TinyExeGun.~A

17620

Dr.Web

Trojan.DownLoader9.5231

9.0.1.010

ESET NOD32

Win32/TinyExeGun (variant)

8.9296

Fortinet FortiGate

Riskware/TinyExeGun

1/17/2014

K7 AntiVirus

Unwanted-Program

13.175.10852

Kaspersky

HEUR:Trojan-Downloader.Win32.Generic

14.0.0.4487

Malwarebytes

PUP.Optional.InstallBrain.A

v2014.01.26.03

McAfee

Artemis!4A16D417C4D7

5600.7247

Norman

DLoader.ATLZP

11.20140117

Reason Heuristics

PUP.Installer.RedBalloonsSoftware.Y

14.8.8.0

Sophos

Generic PUA NG

4.96

Total Defense

Win32/Tnega.PTFMNQB

37.0.10498

Trend Micro House Call

TROJ_GEN.F47V1220

7.2.10

VIPRE Antivirus

Adware.Win32.InstallBrain.a

25468

File size:

181.2 KB (185,584 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

InstallBrain

Common path:

C:\users\{user}\downloads\pcperformersetup_vf79b29.exe

Digital Signature

Signed by:

Red Balloons Software, LLC

Authority:

GoDaddy.com, Inc.

Valid from:

11/19/2013 7:13:54 PM

Valid to:

11/19/2014 7:13:54 PM

Subject:

CN="Red Balloons Software, LLC", O="Red Balloons Software, LLC", L=San Francisco, S=California, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

2B41EF13399233

File PE Metadata

Compilation timestamp:

12/14/2013 5:47:26 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

3072:0s7HXJ2Jmv0NFFuUmiwJJlJldp5DWTBfSJnx0UmSS1Ge71wfSXy/oKKnRF:0sXJ2m4FFuEwJtldHWTBKhx0PSQT71oU

Entry address:

0x88C2

Entry point:

E8, 18, 65, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, 80, ED, 41, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 66, 65, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, 40, 8A, 40, 00, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83, E0, 03, 03, C8, FF... 
[+]

Code size:

82.5 KB (84,480 bytes)

The file pcperformersetup_vf79b29.exe has been seen being distributed by the following 2 URLs.

http://www.humipapp.com/tinydownload/.../VideoPerformerSetup_vf83336.exe

http://www.humipapp.com/tinydownload/.../PCPerformerSetup_vf79b29.exe

Remove pcperformersetup_vf79b29.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.