» betterbrain-setup.exe
Overview
Analysis
File Details

betterbrain-setup.exe

BETTERBRAIN

This is part of the InfoAtoms browser extension which will display variopus forms of advertising in the web browser by injecting new ads such as banner, text-links and search results. The application betterbrain-setup.exe, “Better Brain Setup” by BETTERBRAIN has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is also typically executed from the user's temporary directory.

File name:

Publisher:

Better Brain (signed by BETTERBRAIN)

Product:

Better Brain

Description:

Better Brain Setup

Version:

1.10.0.2

MD5:

beca7b82350b1648fe6567dcbc10b15a

SHA-1:

7fda318c7f2d4e123738bfc5e9a788ecdd35921b

SHA-256:

3db9b25609c7c49220dd8d5cc660417a10d4e41e02c12c3208dce4a74af6a3d1

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

12/25/2024 1:31:37 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Installer.BETTERBRAIN.R

14.11.20.9

File size:

308.6 KB (315,960 bytes)

Product version:

1.10.0.2

Original file name:

betterbrain-setup.exe

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\temp\{random}.tmp\au_.exe

Digital Signature

Signed by:

BETTERBRAIN

Authority:

GlobalSign nv-sa

Valid from:

9/3/2014 1:15:03 PM

Valid to:

9/3/2016 1:15:03 PM

Subject:

E=support@betterbrainapp.com, CN=BETTERBRAIN, O=BETTERBRAIN, L=Dover, S=DE, C=US

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

11217924DDD48F0F11FE570A7383DB34E9EF

File PE Metadata

Compilation timestamp:

12/5/2009 3:52:06 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

6144:3SNLQlMDn7TkFAZLtKJ1m7H+aDeB2Viup+6R:I8MDEF8B0YEY

Entry address:

0x323C

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 6F, 44, 00, E8, 09, 2C, 00, 00, A3, A4, 6E, 44, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, 9C, 42, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 2E, 44, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, F0, 46, 00, 50, 57, E8, AA, 28, 00, 00... 
[+]

Entropy:

7.1302

Packer / compiler:

Nullsoft install system v2.x

Code size:

23 KB (23,552 bytes)

Remove betterbrain-setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.