» pmph.dll
Overview
Analysis
File Details
Programs (1)

pmph.dll

PremierOpinion

VoiceFive, Inc.

The component is part of the TMRG platform which will track various behaviors of web browsing habits including tracking sites and domains visited as well as ads clicked. The module pmph.dll by VoiceFive has been detected as adware by 8 anti-malware scanners. This file is typically installed with the program PremierOpinion by VoiceFive, Inc. which is a potentially unwanted software program. Part of RelevantKnowledge, a program typically installed via a software bundle (with the user's knowledge should they read the EULA) and will run in the background collecting and monitoring information about the user's behavior in order to build an extensive profile.

File name:

pmph.dll

Publisher:

VoiceFive, Inc. (signed and verified)

Product:

PremierOpinion

Version:

1.0.1.8

MD5:

188c525fb5eab2bf6978d747096ecae5

SHA-1:

63c9e19de0d53159ebea4115f35e8ee77197a4a0

SHA-256:

30e47031bc88de6eed8bb8ee739d1b8a8259b8b15779abdf96c4ae7c9a89a9e9

Scanner detections:

8 / 68

Status:

Adware

Analysis date:

4/23/2024 9:00:23 AM UTC (today)

Scan engine

Detection

Engine version

avast!

Win32:Relevant-AB [PUP]

2014.9-160104

F-Prot

W32/Relevant.B.gen

v6.4.7.1.166

Malwarebytes

Adware.PremierOpinion

v2016.01.04.10

Reason Heuristics

PUP.TMRG.VoiceFive (M)

16.1.4.10

Sophos

Generic Proxy-OSS Application

4.98

SUPERAntiSpyware

PUP.RelevantKnowledge

9406

Trend Micro House Call

TROJ_GEN.F47V1126

7.2.4

VIPRE Antivirus

Marketscore.RelevantKnowledge

32852

File size:

801.1 KB (820,288 bytes)

Product version:

1.0.1.8

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\premieropinion\pmph.dll

Digital Signature

Signed by:

VoiceFive, Inc.

Authority:

Thawte, Inc.

Valid from:

9/27/2011 5:00:00 PM

Valid to:

9/27/2013 4:59:59 PM

Subject:

CN="VoiceFive, Inc.", O="VoiceFive, Inc.", L=Reston, S=Virginia, C=US

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

3EDFC5EA7AAD2A20B9C31AE68DC1005C

File PE Metadata

Compilation timestamp:

9/12/2011 2:41:00 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

12288:g9VZRG3DDOEM3/auz7iMpAxHeoHVMSe60z/eEq:aVZRODGhZa1eoHVMSbEq

Entry address:

0x5C23C

Entry point:

83, 7C, 24, 08, 01, 75, 05, E8, DE, E0, 00, 00, FF, 74, 24, 04, 8B, 4C, 24, 10, 8B, 54, 24, 0C, E8, ED, FE, FF, FF, 59, C2, 0C, 00, 8B, 44, 24, 04, 85, C0, 74, 12, 83, E8, 08, 81, 38, DD, DD, 00, 00, 75, 07, 50, E8, F6, B5, FF, FF, 59, C3, 55, 8B, EC, 83, EC, 14, A1, C0, 7D, 0B, 10, 33, C5, 89, 45, FC, 53, 56, 33, DB, 39, 1D, 3C, 9D, 0B, 10, 57, 8B, F1, 75, 38, 53, 53, 33, FF, 47, 57, 68, AC, 7C, 08, 10, 68, 00, 01, 00, 00, 53, FF, 15, 8C, B0, 07, 10, 85, C0, 74, 08, 89, 3D, 3C, 9D, 0B, 10, EB, 15, FF, 15... 
[+]

Entropy:

6.4037

Code size:

488 KB (499,712 bytes)

The file pmph.dll has been discovered within the following programs.

PremierOpinion by VoiceFive, Inc.

Publisher's description - “VoiceFive, a comScore, Inc. company, is a leading global market research company that studies and reports on Internet trends and behavior.”

73% remove it

Remove pmph.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.