home

assets.openoffice.fm

Domain Information

Server location:
Washington, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
openoffice.fm

Scanner detections:
Detections  (75% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.DownloadSpeedMedia.Installer (M), PUP.ClickSta.Installer (M)
75.00%

Microsoft Security Essentials
Worm:Win32/NeksMiner.A
25.00%

F-Secure
Application:W32/Generic.70053c248f!Online
25.00%

The domain assets.openoffice.fm has been seen to resolve to the following 32 IP addresses.

52.85.131.137
server-52-85-131-137.iad53.r.cloudfront.net
June 27, 2016

52.85.131.130
server-52-85-131-130.iad53.r.cloudfront.net
June 27, 2016

52.85.131.110
server-52-85-131-110.iad53.r.cloudfront.net
June 27, 2016

52.85.131.105
server-52-85-131-105.iad53.r.cloudfront.net
June 27, 2016

52.85.131.60
server-52-85-131-60.iad53.r.cloudfront.net
June 27, 2016

52.85.131.40
server-52-85-131-40.iad53.r.cloudfront.net
June 27, 2016

52.85.131.4
server-52-85-131-4.iad53.r.cloudfront.net
June 27, 2016

52.85.131.172
server-52-85-131-172.iad53.r.cloudfront.net
June 27, 2016

54.230.102.196
server-54-230-102-196.iad2.r.cloudfront.net
April 13, 2016

54.230.102.184
server-54-230-102-184.iad2.r.cloudfront.net
April 13, 2016

54.230.102.179
server-54-230-102-179.iad2.r.cloudfront.net
April 13, 2016

54.230.102.175
server-54-230-102-175.iad2.r.cloudfront.net
April 13, 2016

54.230.102.92
server-54-230-102-92.iad2.r.cloudfront.net
April 13, 2016

54.230.102.75
server-54-230-102-75.iad2.r.cloudfront.net
April 13, 2016

54.230.102.37
server-54-230-102-37.iad2.r.cloudfront.net
April 13, 2016

54.230.102.31
server-54-230-102-31.iad2.r.cloudfront.net
April 13, 2016

54.192.195.211
server-54-192-195-211.iad53.r.cloudfront.net
February 10, 2016

54.192.195.145
server-54-192-195-145.iad53.r.cloudfront.net
February 10, 2016

54.192.195.135
server-54-192-195-135.iad53.r.cloudfront.net
February 10, 2016

54.192.195.97
server-54-192-195-97.iad53.r.cloudfront.net
February 10, 2016

54.192.195.75
server-54-192-195-75.iad53.r.cloudfront.net
February 10, 2016

54.192.195.26
server-54-192-195-26.iad53.r.cloudfront.net
February 10, 2016

54.192.195.8
server-54-192-195-8.iad53.r.cloudfront.net
February 10, 2016

54.192.195.236
server-54-192-195-236.iad53.r.cloudfront.net
February 10, 2016

54.192.195.201
server-54-192-195-201.iad53.r.cloudfront.net
January 4, 2016

54.192.195.198
server-54-192-195-198.iad53.r.cloudfront.net
January 4, 2016

54.192.195.183
server-54-192-195-183.iad53.r.cloudfront.net
January 4, 2016

54.192.195.61
server-54-192-195-61.iad53.r.cloudfront.net
January 4, 2016

54.192.195.46
server-54-192-195-46.iad53.r.cloudfront.net
January 4, 2016

54.192.195.39
server-54-192-195-39.iad53.r.cloudfront.net
January 4, 2016

 
Showing 30 of 32 IP Addresses

File downloads found at URLs served by assets.openoffice.fm.

1 / 68      (PUP)
http://assets.openoffice.fm/.../openofficesuite-setup.exe  (3860c2b6399a769bc393deec1d4c23ce)

1 / 68      (PUP)
http://assets.openoffice.fm/.../openofficesuite-setup.exe  (c99555f0e3b9d8c1f4517c14e934fd93)

2 / 68      (false positives)
http://assets.openoffice.fm/.../openofficesuite-setup.exe  (wrar420.exe)

1 / 68      (PUP)
http://assets.openoffice.fm/.../openofficesuite-setup.exe  (e7ff2f8dbd0345919870cc265f51e28b)

The following 3 files have been seen to comunicate with assets.openoffice.fm in live environments.

TCP » 54.192.195.26:443
onlineguardian-v2.exe

TCP » 54.192.195.26:443
online-guardian-v2.exe

TCP » 54.192.195.183:443
vosteran.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.