» pmph.dll
Overview
Analysis
File Details
Programs (1)

pmph.dll

PremierOpinion

VoiceFive, Inc.

The component is part of the TMRG platform which will track various behaviors of web browsing habits including tracking sites and domains visited as well as ads clicked. The module pmph.dll by VoiceFive has been detected as adware by 8 anti-malware scanners. This file is typically installed with the program PremierOpinion by VoiceFive, Inc. which is a potentially unwanted software program. Part of RelevantKnowledge, a program typically installed via a software bundle (with the user's knowledge should they read the EULA) and will run in the background collecting and monitoring information about the user's behavior in order to build an extensive profile.

File name:

pmph.dll

Publisher:

VoiceFive, Inc. (signed and verified)

Product:

PremierOpinion

Version:

1.0.1.10

MD5:

f880a80618f6931dbd0297d35cd373e0

SHA-1:

fc945eb8b104a384814694bcb7ac15d205da477d

SHA-256:

22c5f5cbde831bf1b9db7f0b379c4f5f8cfb1e6389f591368702af24b1bb5778

Scanner detections:

8 / 68

Status:

Adware

Analysis date:

4/19/2024 10:25:28 PM UTC (today)

Scan engine

Detection

Engine version

avast!

Win32:Relevant-AB [PUP]

2014.9-151208

F-Prot

W32/Relevant.B.gen

v6.4.7.1.166

Malwarebytes

Adware.PremierOpinion

v2015.12.08.12

Reason Heuristics

PUP.TMRG.VoiceFive (M)

15.12.8.12

Sophos

Generic Proxy-OSS Application

4.98

SUPERAntiSpyware

PUP.RelevantKnowledge

9460

Trend Micro House Call

TROJ_GEN.F47V1126

7.2.342

VIPRE Antivirus

Marketscore.RelevantKnowledge

32852

File size:

802.6 KB (821,824 bytes)

Product version:

1.0.1.10

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\premieropinion\pmph.dll

Digital Signature

Signed by:

VoiceFive, Inc.

Authority:

Thawte, Inc.

Valid from:

9/27/2011 6:00:00 PM

Valid to:

9/27/2013 5:59:59 PM

Subject:

CN="VoiceFive, Inc.", O="VoiceFive, Inc.", L=Reston, S=Virginia, C=US

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

3EDFC5EA7AAD2A20B9C31AE68DC1005C

File PE Metadata

Compilation timestamp:

9/12/2011 3:41:00 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

12288:A9VZRG3DDOEM3/auz7iMpAxHeoHVMSe60zFeEN:6VZRODGhZa1eoHVMS1EN

Entry address:

0x5C23C

Entry point:

83, 7C, 24, 08, 01, 75, 05, E8, DE, E0, 00, 00, FF, 74, 24, 04, 8B, 4C, 24, 10, 8B, 54, 24, 0C, E8, ED, FE, FF, FF, 59, C2, 0C, 00, 8B, 44, 24, 04, 85, C0, 74, 12, 83, E8, 08, 81, 38, DD, DD, 00, 00, 75, 07, 50, E8, F6, B5, FF, FF, 59, C3, 55, 8B, EC, 83, EC, 14, A1, C0, 7D, 0B, 10, 33, C5, 89, 45, FC, 53, 56, 33, DB, 39, 1D, 3C, 9D, 0B, 10, 57, 8B, F1, 75, 38, 53, 53, 33, FF, 47, 57, 68, AC, 7C, 08, 10, 68, 00, 01, 00, 00, 53, FF, 15, 8C, B0, 07, 10, 85, C0, 74, 08, 89, 3D, 3C, 9D, 0B, 10, EB, 15, FF, 15... 
[+]

Entropy:

6.4069

Code size:

488 KB (499,712 bytes)

The file pmph.dll has been discovered within the following program.

PremierOpinion by VoiceFive, Inc.

Publisher's description - “VoiceFive, a comScore, Inc. company, is a leading global market research company that studies and reports on Internet trends and behavior.”

73% remove it

Remove pmph.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.