» VideoPerformerSetup.exe
Overview
Analysis
File Details
Downloads (1)

VideoPerformerSetup.exe

Forty Seven Tech Software LLC

This is the Performersoft setup installer. The application VideoPerformerSetup.exe by Forty Seven Tech Software has been detected as adware by 31 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. The setup program bundles additional offers, mostly adware, using the InstallBrain installer, a pay-per-install monetization download manager. InstallBrain will also install a background updater service that will update any installed browser add-ons and plug-ins. The file has been seen being downloaded from www.appkama.com.

File name:

Publisher:

VideoPerformer (signed by Forty Seven Tech Software LLC)

Product:

VideoPerformer

Version:

14.6.12.20

MD5:

afb9b3777148fc019da2aa9eafe86c9b

SHA-1:

425cd08da4e55a7eec9437b336e0277d259199d2

SHA-256:

304e4a243874d8f479c993613a256da72c44da059adb8fe7630d5d939cc6d233

Scanner detections:

31 / 68

Status:

Adware

Explanation:

Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/26/2024 5:03:44 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Jaik.1231

450

Agnitum Outpost

PUA.InstallBrain

7.1.1

AhnLab V3 Security

PUP/Win32.InstallBrain

15.11.12

Avira AntiVirus

APPL/InstallBrain.Gen

7.11.140.76

avast!

Win32:Adware-gen [Adw]

2014.9-151112

AVG

Adware InstallBrain

2016.0.2928

Baidu Antivirus

Adware.Win32.InstallBrain

4.0.3.151112

Bitdefender

Gen:Variant.Jaik.1231

1.0.20.1580

Comodo Security

Application.Win32.Installbrain.BM

18135

Dr.Web

Trojan.DownLoader11.15987

9.0.1.0316

Emsisoft Anti-Malware

Gen:Variant.Jaik.1231

8.15.11.12.08

ESET NOD32

Win32/InstallBrain.CE potentially unwanted application

9.7.0.302.0

Fortinet FortiGate

W32/Skintrim.B!tr

11/12/2015

F-Prot

W32/IBrain.B2.gen

v6.4.7.1.166

F-Secure

Gen:Variant.Adware.Graftor.139208

11.2015-12-11_5

G Data

Gen:Variant.Jaik.1231

15.11.24

IKARUS anti.virus

Trojan.Win32.Spy

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.176.11896

Kaspersky

not-a-virus:AdWare.Win32.BrainInst

14.0.0.1133

Malwarebytes

PUP.Optional.InstallBrain.A

v2015.11.12.08

MicroWorld eScan

Gen:Variant.Jaik.1231

16.0.0.948

NANO AntiVirus

Trojan.Win32.Badur.cwagzh

0.28.0.58873

Panda Antivirus

Trj/Genetic.gen

15.11.12.08

Quick Heal

TrojanDownloader.Brantall.A5

11.15.14.00

Reason Heuristics

PUP.Performersoft.FortySevenTechSoftware.Bundler (M)

15.11.12.8

Rising Antivirus

PE:Malware.Obscure!1.9C59

23.00.65.151110

Sophos

InstallBrain

4.98

SUPERAntiSpyware

Questionable.Resource

9512

Vba32 AntiVirus

AdWare.BrainInst

3.12.26.0

VIPRE Antivirus

Threat.4759033

29418

Zillya! Antivirus

Trojan.Black.Win32.17016

2.0.0.1949

File size:

1.3 MB (1,312,376 bytes)

Product version:

14.6.12.20

Original file name:

VideoPerformerSetup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

InstallBrain

Language:

English (United States)

Common path:

C:\users\{user}\downloads\videoperformersetup.exe

Digital Signature

Signed by:

Forty Seven Tech Software LLC

Authority:

GoDaddy.com, Inc.

Valid from:

12/18/2013 4:13:53 PM

Valid to:

12/18/2016 4:13:53 PM

Subject:

CN=Forty Seven Tech Software LLC, O=Forty Seven Tech Software LLC, L=Beaverton, S=Oregon, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

27C178FAD33D6A

File PE Metadata

Compilation timestamp:

5/27/2014 10:15:11 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:w94iblGTTX1wXi6kgaINVIgSJg2L0q3xM9ulZ+oheDCI9oJ0OA3s:t04TX1wXiTcNSgWbLXBM0+oKXoiOA8

Entry address:

0xA9A6

Entry point:

E8, 58, 4D, 00, 00, E9, 89, FE, FF, FF, C7, 01, 90, E5, 41, 00, E9, 23, FA, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, 90, E5, 41, 00, E8, 10, FA, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, 9F, EC, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08, 51, 52, E8, 51, 19, 00, 00, 59, 59, 85, C0, 74, 04, 33, C0, EB, 24, F6, 06, 02, 74, 05, F6, 07, 08, 74, F2, 8B, 45, 10... 
[+]

Entropy:

7.5539

Code size:

112.5 KB (115,200 bytes)

The file VideoPerformerSetup.exe has been seen being distributed by the following URL.

http://www.appkama.com/download3/.../swU2?v=17&cid=4740&tid=ZZf2615105Za1975601Zg172Zw44Zm31Zc2019000446,2019000446Zs384Zi0ZZ&cert=fsts&installer=tt&resources=tt&maker=pth

Remove VideoPerformerSetup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.