» popservice.exe
Overview
Analysis
File Details
Behaviors (1)
Network (2)

popservice.exe

PopService

Installmatic, LLC

This is part of the Installmatic installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application popservice.exe by Installmatic has been detected as adware by 27 anti-malware scanners. The program is a setup application that uses the Installmatic Setup installer. It runs as a separate (within the context of its own process) windows Service named “PopDeals Service Watcher”. While running, it connects to the Internet address sage.parklogic.com on port 8888.

File name:

popservice.exe

Publisher:

Installmatic, LLC (signed and verified)

Product:

PopService

Version:

1.0.3.2

MD5:

4c5d4c21fe135ca2dbf5613ae9f27a92

SHA-1:

e4df881219110ba4607babeca62f9ae7dfa79612

SHA-256:

eb538695a0a463c7a51822d13019acbaa57506ca8b8559b56b9708f3c8790300

Scanner detections:

27 / 68

Status:

Adware

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

11/23/2024 6:13:41 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.Agent.POV

434

Avira AntiVirus

ADWARE/PopDeals.84032.1

8.3.2.2

avast!

MSIL:Adware-O [Adw]

2014.9-151127

AVG

Installmatic

2016.0.2912

Baidu Antivirus

Adware.MSIL.Popdeals

4.0.3.151127

Bitdefender

Adware.Agent.POV

1.0.20.1655

Bkav FE

W32.HfsAdware

1.3.0.6979

Comodo Security

ApplicUnwnt

23579

Dr.Web

Adware.Shopper.930

9.0.1.0331

Emsisoft Anti-Malware

Adware.Agent.POV

8.15.11.27.02

ESET NOD32

MSIL/Adware.Popdeals (variant)

9.12558

Fortinet FortiGate

Adware/Popdeals

11/27/2015

F-Secure

Adware.Agent.POV

11.2015-27-11_6

G Data

Adware.Agent.POV

15.11.25

IKARUS anti.virus

AdWare.MSIL.Popdeals

t3scan.1.9.5.0

K7 AntiVirus

Adware

13.212.17839

Malwarebytes

PUP.Optional.PopDeals

v2015.11.27.02

McAfee

Artemis!4C5D4C21FE13

5600.6568

MicroWorld eScan

Adware.Agent.POV

16.0.0.993

Qihoo 360 Security

HEUR/QVM03.0.Malware.Gen

1.0.0.1077

Reason Heuristics

PUP.Installmatic (M)

15.11.27.14

Rising Antivirus

PE:Malware.Generic/QRS!1.9E2D [F]

23.00.65.151125

Sophos

Virus 'Mal/MSIL-LL'

5.14

SUPERAntiSpyware

PUP.PopDeals/Variant

9482

Trend Micro House Call

Suspicious_GEN.F47V0608

7.2.331

VIPRE Antivirus

MSIL.Adware.Popdeals

45186

ViRobot

Adware.Popdeals.84032[h]

2014.3.20.0

File size:

82.1 KB (84,032 bytes)

Product version:

1.0.3.2

Original file name:

popservice4.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Installmatic Setup

Common path:

C:\Program Files\popservice\popservice.exe

Digital Signature

Signed by:

Installmatic, LLC

Authority:

COMODO CA Limited

Valid from:

7/23/2015 1:00:00 AM

Valid to:

7/23/2016 12:59:59 AM

Subject:

CN="Installmatic, LLC", O="Installmatic, LLC", STREET="80 SW 8th St #2000", L=Miami, S=FL, PostalCode=33130, C=US

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

2D13291AEE51B2226F83396FCD33C1F1

File PE Metadata

Compilation timestamp:

9/30/2015 9:38:28 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

1536:5ZYwZj6n4rSjEHGoBDMlq8bl33wVyK4a92lUtUriZr:5ZRZjNSjI/dMlq8bl33wVyKt4k

Entry address:

0x142CE

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

73 KB (74,752 bytes)

Service

Display name:

PopDeals Service Watcher

Service name:

PopService

Description:

Watchdog service for PopDeals

Type:

Win32OwnProcess

The executing file has been seen to make the following network communications in live environments.

TCP:

Connects to sage.parklogic.com (69.39.236.56:8888)

TCP (HTTP):

Connects to ocsp.comodoca.com (178.255.83.1:80)

Remove popservice.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.