home

popdeals4.exe

Installmatic, LLC

This is part of the Installmatic installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The file popdeals4.exe, “Windows BRDeals Application” by Installmatic has been detected as adware by 14 anti-malware scanners. The program is a setup application that uses the Installmatic Setup installer. This file is typically installed with the program Windows BRDeals Application. The file has been seen being downloaded from download.popcrew.info. While running, it connects to the Internet address unallocated.barefruit.co.uk on port 8888.
Publisher:
BRDeals  (signed by Installmatic, LLC)

Product:
BRDeals

Description:
Windows BRDeals Application

Version:
1.0.3.2

MD5:
cfcca16364c5c2058a1556adcc223fd8

SHA-1:
1f54be4b2c82077e0fc3c60a6245659789baa2e8

SHA-256:
03205b511d754a3c00b0cad27298319fb492418b86542ba902de2713778c1ef4

Scanner detections:
14 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/17/2024 3:49:11 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/PopDeals.A.245
8.3.2.2

AVG
Installmatic
2016.0.2912

Bkav FE
W32.HfsAdware
1.3.0.7237

Comodo Security
ApplicUnwnt
23394

Dr.Web
Adware.Shopper.979
9.0.1.0331

ESET NOD32
MSIL/Adware.Popdeals (variant)
9.12389

Fortinet FortiGate
Adware/Popdeals
11/27/2015

IKARUS anti.virus
AdWare.MSIL.Popdeals
t3scan.1.9.5.0

K7 AntiVirus
Adware
13.210.17497

Malwarebytes
PUP.Optional.Installmatic
v2015.11.27.02

McAfee
Artemis!CFCCA16364C5
5600.6568

Reason Heuristics
PUP.Installmatic.BRDeals (M)
15.11.27.14

Rising Antivirus
PE:Malware.RDM.37!5.2B[F1]
23.00.65.151125

VIPRE Antivirus
MSIL.Adware.Popdeals
44458

File size:
105.6 KB (108,096 bytes)

Product version:
1.0.3.2

Copyright:
Copyright © 2014 - BRDeals

Original file name:
popdeals4.exe

Bundler/Installer:
Installmatic Setup

Common path:
C:\windows\temp\tmpb9cf.tmp

Digital Signature
Signed by:
Installmatic, LLC

Authority:
COMODO CA Limited

Valid from:
7/23/2015 1:00:00 AM

Valid to:
7/23/2016 12:59:59 AM

Subject:
CN="Installmatic, LLC", O="Installmatic, LLC", STREET="80 SW 8th St #2000", L=Miami, S=FL, PostalCode=33130, C=US

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
2D13291AEE51B2226F83396FCD33C1F1

File PE Metadata
Compilation timestamp:
9/30/2015 9:50:53 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:w9N0rcviWhto7aEvivhtn9s9p6DrX1ub4iF1KRHptIr:w9N0Ahto7aEvivhtn9s9p6DrX1ub4im0

Entry address:
0x1A16E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
96.5 KB (98,816 bytes)

The file popdeals4.exe has been discovered within the following program.

Windows BRDeals Application  by Windows BRDeals Application
About 4% of users remove it
 
Powered by Should I Remove It?

The file popdeals4.exe has been seen being distributed by the following URL.

http://download.popcrew.info/popdeals4.exe

The executing file has been seen to make the following network communications in live environments.

TCP:
Connects to sage.parklogic.com  (69.39.236.56:8888)

TCP:
Connects to unallocated.barefruit.co.uk  (92.242.140.20:8888)

Remove popdeals4.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.