» aafs.ezdownloadpro.info
Overview
Analysis
IPs Addresses (3)
Downloads (10)
Network (3)
Website Detail

aafs.ezdownloadpro.info

Rafael Leviev (via a Proxy Registrant)

Domain Information

The domain aafs.ezdownloadpro.info is registered by proxy through Active Registrar, Inc. (R469-LRMS). This domain has been known to host and distribute potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter. The domain is associated with the publisher Rafael Leviev who is located in Shfela, Israel.

Registrant:

Whois Proof LLP on behalf of Rafael Leviev

Registrar:

Active Registrar, Inc. (R469-LRMS)

Server location:

Oregon, United States (US)

ASN:

AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:

ezdownloadpro.info

Whois:

1 ezdownloadpro.info record

Google Safe Browsing:

unwanted

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

Threat.Win.Reputation.IMP

100.00%

ESET NOD32

Win32/Adware.MultiPlug.FC application, Win32/Adware.MultiPlug.FK application

100.00%

F-Secure

Gen:Variant.Adware.Mikey

80.00%

Dr.Web

Trojan.DownLoader12.35786, Trojan.DownLoader12.35867, Trojan.DownLoader12.35697

80.00%

Lavasoft Ad-Aware

Gen:Variant.Adware.Mikey.8516

80.00%

Emsisoft Anti-Malware

Gen:Variant.Adware.Mikey.8516

80.00%

avast!

Win32:MultiPlug-WR [PUP]

80.00%

McAfee

Trojan.PWS-Zbot.gen.ep

80.00%

Sophos

PUA 'MultiPlug' (of type Adware)

80.00%

MicroWorld eScan

Gen:Variant.Adware.Mikey.8516

80.00%

Malwarebytes

PUP.Optional.Unizeto

80.00%

Zillya! Antivirus

Adware.MultiPlug.Win32.225867, Adware.MultiPlug.Win32.225850, Adware.MultiPlug.Win32.225862

80.00%

K7 AntiVirus

Unwanted-Program

80.00%

Bitdefender

Gen:Variant.Adware.Mikey.8516

80.00%

F-Prot

W32/MultiPlug.H.gen

80.00%

The domain aafs.ezdownloadpro.info has been seen to resolve to the following 3 IP addresses.

185.53.177.6

September 15, 2016

54.69.228.231

ec2-54-69-228-231.us-west-2.compute.amazonaws.com

May 2, 2015

54.149.241.47

ec2-54-149-241-47.us-west-2.compute.amazonaws.com

May 2, 2015

File downloads found at URLs served by aafs.ezdownloadpro.info.

1 / 68 (Malware)

http://aafs.ezdownloadpro.info/hp/?q=P0Koj8QyJl0sX56789MfWjcINhjvno4cGX2NpKHpPq1A7I9Ux6agRW75BUD6IUfM 6oCouDkXb94SsHusRb9ZzKFWA0GlKt2HO3TCJ5GzvC1jrRXklVqvFSzNWYOBlOI1vwJ21W0wqC/k7Sv9e08SnkMZUGPrXKIEgFssD6dM1Yky6yEwOMLUCAZvWG w/21UB3AF6XkyAUyjrTtfhG/EsrMDolXbTKNAF7YHeh6 sIb7sb0cXwWhuS3uZrVVX2TAIqf9jDqC9zYS/BgQRjUaG2SAVOB3YxbWWvHnu3cRWSCD55UE r LTthY0fvHal/UkYHCOE76SiqQ8KqwO5Snwhvvjy8rKoEkMq4fahz4FWC2Gd0PZ EwIcd1vtrYNrwe43F0MorkiPdKTOfyqL7xJTLnxnN0Ix14sVZQrsOmnMWiiDeiedj9fyCieKRFwhXg6EByidG6TNeb5 PLAW0SDe9GsBloJwp0Eatdb7eAMNlrI2n5y4AiylO3zi1GaAYG94NabSW2kH1noaaTvTiLKcD9SsTjkTu3K4KVtL1t0q3 AdWzgiaVFgMXGeQuIZC6J EY059Kasi/XTh7A3OsJs4ihe1fhMbT9/.../mvA4 wetTQypGbg532nsFewPZPTYMIeFYikzg1P&external_id=1425350029663171310&uuid=MitjPr87fB5eZd9EtR2p1C8yaBqY998b3a5sjXDr7WlK5M63KyPKbrEih1WSwDuATHXuE3XexEStrk2SZSmX7bHWtPGEahePetrQqPrKQJYVYiUsedTK2I3t7yEbD5BUDqjribYpIbJYR0W5IhxSY9dDhHuG4QGmT05auxHX9f8nqq8nGDOgU8uOJhPa6oi4GyT5zCvsbMxP21Yw7uO0JKMSeEObw1yHUl5cjJeXw05BeYKMhCFy8MojXmj7Jg5tt1XU (kitchen-draw.exe)

24 / 68 (PUP)

http://aafs.ezdownloadpro.info/hp/?q=FevcEmj0lTM1YihQIK5lLFyQRFxvkY0NHrbzcLnXBmD1LngGeF7WUHQOaANDmbTFXfMI1jCluBii3VquPhpr5RYPc18b7 Z0mWH4JqOvxT2yEC3nZaSTAEnnp/ETg1rz2DDHd4pzTyZ5WBPg2PoshaBFQ4Lj8b/Dnge7m9aPAG5XKdBOeA8WQKBxPXLj7IOJ/Fie697u1ElLb3RTSwJRS3qIpGZCfJcwOVXqtrulisYnACV5QUn8De/.../dYBWhhQ&uuid=2rb8QNbOxt3mWLA5UTm3JP7Sb6qSoeaKHDlBAvvGGwUkKE9hzjmN9dvBqxKUeMbF1srnKNG3dOfXSEF3FWBY4yOzSgy6xrCyBu1SgPa8krTzNXtDO7XiL38KAn9E3mnhYhNox0b5WLTiaerqy2oOmcymiuH4hbf0H5Vd8XwVgNr8YMlmfZnsUfl9qx86oJhrPtSV8QMipWAb9jKKmNSVJFDysjsk3pOP8Hijkx5nCS33kkLwewB9fffgK2p21xhVZtvr4T6ud9kIA63abCKmEUUiDSksyKgGscKCpToGnZdlplnXZuULocQDRmp0TWL8vCtBcpOUWXUbWcjzoJuWyToEglIqLSFyZPUcmAbDwGzeLnquwB5iGKVvg7m5xdL4AySo0fNYCqbLP28iyi3GtAnFqA5tEzMdpSDa6CiUwLlsWx0N4PveuJpNA0uzMUZPtbb8BPTA38psuGvGowOs6NUmaWrcID6tPNzovfUIOistelBDcuE2I0IA (nova_launcher_3.3.zip.exe)

24 / 68 (PUP)

http://aafs.ezdownloadpro.info/hp/?q=Ss7P2qqmQb ZBFHwysjdAt2uJ6Vvb3Jxtr1H MSAPB9Hpu3ncRAwz9/pPFrlFaNUHGeBTFKqayWjMASL07Jse5sX gilhRHG7p/hXiUU5LeNuHtNghrf90uoUe0MH oLGNpYN8OvMYHSZQ74Xo5rTmSrdzerz4NMRAM8MD51sq2xN2sEi43m7ZWim3uXI0FuWT8WlKsHhhZHakmDbjoIV0Nda/3hRlKaRWmkklKwpJa5e2F0eS3mndABVYndeULMM7TWFb2fND9lmBSv7vC10fDKzadA871eh3Suqy6JIAZSMriK7i3fPpaI 5rlctiv09r4gjYxdXsZlDdIlIOHGnD6Md3Uxb77tkWF4MQu6fkg9OM8XKrbnL6Hz0/ 1T4YzE6 p9/dE8O/KxZgfSgmVF1CSv 3JYcz1JvAEK14efAf8osB6Y2ckGM4tsOiEgLL0LU8JZZLGMO 43fIbsO ulVrtEA6mPK3SlCoEvfrgEDykPFa4QyZUE0RguCrT47n6E3LmHFMQyXiysPdz 6CScgqPUiqOR wOdwPpZOtTulsJD/t7Ilz9cRXMQ3Qns2R9pZRub2fhk5LTfX4fggyyWl/U9J 15LXGq8aDQpiKYVuJ6 kNFfE/.../cZ6Zs2 0S1UKgH1Gd1ot2w8reOESWm ALqix3YX6GlcbyH gwb9XUeyBYtR3VHyhfcl8Q2u&external_id=1425347746428314190&uuid=sU7DnQFV44Qskzr24N6kF8sjym7iSMaNhOcGqCFdhXFuXILfUQG694Ng68x6Fj0g7AH9A5VUySMmb9kOKqgBlx9MqFSR8iuRgzGFqh0HjeiFbodjUizJlMhsfejL99n4rQ6NRNTPqXMsUaTwiGrRq21Pdi7SzlmSOSUIwyPlx (nova_launcher_3.3.zip.exe)

27 / 68 (PUP)

http://aafs.ezdownloadpro.info/hp/?q=Ir5VNsuj/FttHtlztvFQ68oUHK GENcc6krwHkaQ1FhjJqt4auNwJkD/R7ys/OQVZaUS7rPIkstKpHzfFANE49DXnp6oM1O3vRmOjvQAHd9/XWIDKUZa LNC401bJ1ueWDxeeBvucV1Ao72yxVAQlrIc3BPrARDGDCwnuuE1qpY5/.../1k7gSLMapLNOcqWqvUUW9822TLCg72yQD4Jc2staDdGnEXGPC8Q6tlErPmZlj86bsQVKpTdQEEiqgVYQYNsbtu4Lb NrzqWsXV1I2hHdoi1UhwAphbSnx8y Jryzg4n0hi4TDPjL6GMXagUSSasr9tEwoNcwE61VE sk9bDTBBDwIRocJ3R8KF58&uuid=7Gri6fo2U8JnV6hGpsyDhAtxFhkvrefZKPeFnQfHrd4dl4U5K5tAO5lMrBwqkVbbRWiYb4EENcNgBCYhht9cYQrLf9Y2P5EHWD5PwY4TDFFXYKYGooFe2Z3Jq6OK7VRx9DGtRABALQlQA3GNEe99jOZfuZpUxSRoXrhY2mGkhuHw2on2VBXH6Yym3Q5RF3YQOturLqGC1qHUQ7h1NKn9kaldUk82CV9YgHKyP0NJEKvaXDJlacrEp4vn03rLGw94BEPNDekXCGRFqvxr6tyOWQfPhB0jhGYvy83RndIxqOM6FthZAZRyI4ZAILTTQ1fdtgyQD8Ek9hLHztPJu58qCoiPHBIxMODfYGHdrm2jBqvOZki8Tgzlv0EJUanhPvMFZ6AtqnZYy1zJ6HRuokMDzlq5sgpjBpP6Int8jVAtfkymrYZlE9JnlqnKfjtpghPdukfTAkj3I9ttJZ (download intrusion 2 v1.024 torrent - kickasstorrents proxy.exe)

27 / 68 (PUP)

http://aafs.ezdownloadpro.info/hp/?q=gn/L55fZaMP9QIKEG pl6F/QoyrGR3xKc6VCETeaAOwWEaoOS0SVhv35P1anQP0EgJJclz3pCY4XhoXvPRdNz/JbokwOv CipTA/oVOu8xVthaeZOCzGgnZ1vCzHgzSUtiCv0f/YmG4GL6UvwmzYxr7HxL9kC3dyCbwiPoutQWzwWoX2gyWaBqBw/pAOIsBGsxzCZzUSZj1w0A20q1nCkw0jftC/ovR3 2EvvnXpT66ayPqOgRCmS8UF/tz7gtH/IPHRlMs9QIzlrzT67AQ8vWGfXj50Ki9efC4MnHZ1kGIURcF/hvfU0zUS YbuT/r f9FAas/L1JZGZubHKrcRYzdu/nRkwMNmZ50k zNmksPc4iBzQskaeOHRKWvTF95Tryj0MHwWm ObA4pkc0JacKqEFTF4WMDPfNiGIYjB9dnr1LEts0t20d26nE4NaIYbOb7n2tBj1K0N/od/2xP71JTVp3MHR8Fse8HipAx2nyQvdRmPALzCHZNHCLL yVXlkJb1OjFLvUg3xiVHT6WOviEOnOol20PaAOAMWkF7fxeWwrjLCaAYFTEAi12 hEaGrivkqKe/.../6kmNAxbpXsKqZoIxMFMaBGPqTsxiqidGAUA7My6iKdljAfg1b5QgSlyO39ydRma94s3VWBPbR9JEFRMSqb (download intrusion 2 v1.024 torrent - kickasstorrents proxy.exe)

25 / 68 (PUP)

http://aafs.ezdownloadpro.info/hp/?q=aUMztbKqXPBsgEKYSU8NblYTGYMfoWEqklq/9uY4T4OLiGDArczVEhYUKLOF7T1bPcNhVCJKJNxCOvW4ot6a3iDDqva EnKivRmPb2EbRXuWrxQh7 FaKiBz881ZeDz9WDwRuxBR2T0GDT2Sc8k8orIc3I0zQ/vz6D9M4uPjpgp82EWosgs6apUxHU3pgq5u2dWEBp0olOIhw6NWFdtiE0UYBKF19wooLiVvLbhpjCx59j6cLrKGD6ng/.../MXb8bMGVOTdKTOVHDaZjzqVOmpNm 7GLqVXRJKjBN50Zdc0Qs22GCqKtP9SOWqfkDuK3 DghnGWKwtEfAEYbIsLG6FhHbJFh403yJ5MAQdsi&uuid=A9Pxe7jhxEVLM5A7ljKfflvIgkJppnI5bjgcRz8c3HtmakrE1Rb5vHJlYf9x0Qt88EQGC0k8m4jbP1AK88eMg60EFKjhAkPBdgxrOHDKYj0UJfBTJaakXj6dLmmnWOxfYtkpSH9LYUWibLFHzB13YEVoBv5WGJLAabIUw48LwrAOfW6mKJ75nUozL5NpVHrifMWqRcLkayslzXiaIaS241h4ReTba1701wdtQPAKPJccIJq3ptBkiGydaY4sG5JfxcZFoFXmVahxb7lsUOvYNHL0uvigU5WTnYDwXDLxcjokBiTr8Sqt5fYzcfO00YYM5bbteoXbnc3pXpvk4BCt1VUcW9NgQSanMrRkcL9qwP75HxpYGMkmw0XdsSh7P7TeKhTWFPE3ledgzUtz0XEg5DjiUaruAuuTnbyMIjQfrOmR83qnqr5fahawaU3PsGLRsMCUOzq4gd5TbOO5YveJk9IZ (download intrusion 2 v1.024 torrent - kickasstorrents proxy.exe)

25 / 68 (PUP)

24 / 68 (PUP)

http://aafs.ezdownloadpro.info/hp/?q=M1k79wDT4Pkm5mjlha6GWm51 /DGGDfJal4Vq5LOzkRK4MnZOvY/3FIb7qqEy8Ihw9P62KvVj3nMeZOK/5eOxO96rNVZIfcTx/LYr5T ou1xLSsCQsMTOnMgRUmENf36 0UOT8OPtX2oYp 2rmRjsJHC6Frgu6mhGUuYNihBlStMUvfTxDOJ0F0QBOipqRIrgbntgXxYGUy2BwWFvWrxVbcNeU1elyLGGWvXz1Nu7C16zb9cvmKAokOfAhuybSoE5FKYL/KwzYOV8lsGLL0wFMV10vf/cjgUX/RQf1JaquxYFTt5IyLAxPhgOnOMJai4bNMw4rJXndn5wNKTNRutV7Q5rEa8oGFE2laMdZDgchEQfqvP/tiyNADVswnuKMV/boYj5kBEidc6mC8xgIXWqM00TMVSp8oD4nCm8zcdiEaGxom/0ThIJHkVabySnu/I96AgrRCZPF7ACn6/WMiJjl5/JYdV9rdoJd35LZoWiZ ldYYPPrkrrKvNAMeMUu2JsQhPSWAKaoa8pFUP4IQdt7p6jNz2Fss8Til NUNBeM5UDX2SDTro9fiv53FHGU2AyZKTt/9RBiJttvdIzgrVd7PmO wWlzb2/gNcOA9oQUu3VKu4nEg3jR6AbAxOA/Ny79BQfrwHI7LP seOFTKdggvI4i627LO 1FrVZhguHUtlx7IZN/rpTkfPVjUvSlUvUWvoppbLLwQQ3d9icYbAPDeQrKeTsmtDLwM7qt /wmu6X7/wDPIRBdWjVGjfKV7LAP0PSo073nfhCtJ3dmZaxuMDpqMtyC8Xl/y1MO82rI4wKtkGgBCSztCsrXGjHLJXwS71ukms59VndoiLMGbCbMVP0nsEpE6TOhAZMVWQfrxlEdEJxTFP4B4SNT4NcEUKCFRbtuqoIo8J/.../9rhfM9YkYejDNje5K8o (nick woodmans journey_ dead end to gopro _ american express.exe)

25 / 68 (PUP)

http://aafs.ezdownloadpro.info/hp/?q=gn/L55fZaMP9QIKEG pl6F/QoyrGR3xKc6VCETeaAOwWEaoOS0SVhv35P1anQP0EgJJclz3pCY4XhoXvPRdNz/JbokwOv CipTA/oVOu8xVthaeZOCzGgnZ1vCzHgzSUtiCv0f/YmG4GL6UvwmzYxr7HxL9kC3dyCbwiPoutQWzwWoX2gyWaBqBw/pAOIsBGsxzCZzUSZj1w0A20q1nCkw0jftC/ovR3 2EvvnXpT66ayPqOgRCmS8UF/tz7gtH/IPHRlMs9QIzlrzT67AQ8vWGfXj50Ki9efC4MnHZ1kGIURcF/hvfU0zUS YbuT/r f9FAas/L1JZGZubHKrcRYzdu/nRkwMNmZ50k zNmksPc4iBzQskaeOHRKWvTF95Tryj0MHwWm ObA4pkc0JacKqEFTF4WMDPfNiGIYjB9dnr1LEts0t20d26nE4NaIYbOb7n2tBj1K0N/od/2xP71JTVp3MHR8Fse8HipAx2nyQvdRmPALzCHZNHCLL yVXlkJb1OjFLvUg3xiVHT6WOviEOnOol20PaAOAMWkF7fxeWwrjLCaAYFTEAi12 hEaGrivkqKe/h qjfcOnKM8FmLcpBi4t OmDTJuH10qNATQuGp4f8y236uzwSfE5NKwQC5G7aZ6Nau4cYZIb9qlsS8GB1xd6h8u4qqWwnKSN6kdDLIQ7jtM9f mU3SqOl57aj v4ifMalmvuJcsfWBwi7edRvH7EDdok9rDEXGfjqEWZ v9v1t8cJ XHKXnlhhjv7ALGx1VRR90PgrUrjQEQqog42G0qmEDdR06CGNm1siToFlOT/.../LoEGLeCePUj2 V9Cxit7gyTpfeLaQryGtE04RY52zYhE2fh7UkhK (download intrusion 2 v1.024 torrent - kickasstorrents proxy.exe)

The following 3 files have been seen to comunicate with aafs.ezdownloadpro.info in live environments.

TCP » 54.149.241.47:80

papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80

installer_game develop.exe

TCP » 54.69.228.231:80

download.exe

URL:

http://aafs.ezdownloadpro.info/

Network:

Amazon Web Services (AWS), running an EC2 instance

Web server:

openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.