home

bubblyapps.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain bubblyapps.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in August of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Virginia, United States (US)

Create date:
Thursday, August 14, 2014

Expires date:
Sunday, August 14, 2016

Updated date:
Tuesday, July 28, 2015

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
2 bubblyapps.com records

Scanner detections:
Detections  (91% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore.Internet.Installer.Meta (M), PUP.NewMedia.Installer.NewMediaHoldings.Installer (M), PUP.installCore (M), PUP.NewMedia.Installer.installCore.Installer (M), PUP.FileOpener.Setup.Installer.Meta (M), PUP.NewMedia.NMH.Bundler (M), PUP.InstallCore.RE48 (M), PUP.NewMedia.NMH.installCore.Installer (M), PUP.InstallCore.RES (M)
90.48%

G Data
Win32.Application.InstallCore.CZ, Win32.Application.InstallCore.EG
14.29%

ESET NOD32
Win32/InstallCore.XB potentially unwanted application, Win32/InstallCore.ACZ potentially unwanted application
9.52%

VIPRE Antivirus
Threat.4788237, Threat.4786018
9.52%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
9.52%

Malwarebytes
PUP.Optional.InstallCore, PUP.Optional.InstallCore.A
9.52%

avast!
Malware-gen
4.76%

NANO AntiVirus
Riskware.Win32.InstallCore.dqheub
4.76%

Avira AntiVirus
PUA/InstallCore.A.2387
4.76%

Dr.Web
Trojan.InstallCore.152
4.76%

Bkav FE
W32.HfsAdware
4.76%

K7 AntiVirus
Unwanted-Program
4.76%

Sophos
InstallCore
4.76%

AVG
Generic
4.76%

Panda Antivirus
PUP/Multitoolbar
4.76%

The domain bubblyapps.com has been seen to resolve to the following 4 IP addresses.

209.99.40.223
209-99-40-223.fwd.datafoundry.com
August 14, 2016

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
July 7, 2015

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
July 7, 2015

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
July 7, 2015

File downloads found at URLs served by bubblyapps.com.

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pipi=Ajg4NzcyAj7yAM==&osos=VdluDrW3cw==&dr=cHaWck10 d10 d0tIrWtDSD0 T1z2dVl2Zamc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhL2kvmNBDz1l QDjhTnmDZ0wvmNpDZ1fOZadNZnzATiRvm5EIKiWXzLzOTaFAZARAZA=&pd=2323UmxJ2dFB d5C KW0ISFj d0=&campaignId=9jn0Aj7FNTAdAZMq  (tomtomhomesetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=NjCdNjnzNzM3&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1Q HVlc3xP7dtzvExthXN3DKV0NkDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWKCnm7dREhKVuvmAWASDChTMm7dlChV83ATL4NzgwOTnm7K2pDZ1fAz7dOTa4ATa0Ag==&pd=2323Um5wcHAt mV3UmNJ i==&campaignId=9jn0AzaFOZL0AZMq  (bluestackssetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=ATC0NTn4OZa3Ni==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1PDH2j rVP mVyvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWSL4m7dREhKVuvmAWASDChTMm7dlChV80OTLFOZCwOTnm7K2pDZ1fOZLRATnzAjnyAw==&pd=2323Um5wcHNGIKFCUmNJ i==&campaignId=9jn0AzizAzCwAZMq  (adwcleanersetup.exe)

0 / 68
http://bubblyapps.com/?dl=1&pipi=Ajg4NzcRNZi1OM==&osos=VdluDrW3cw==&dr=cHaWck10DK5t2mll2dVyvExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWxVAm7dREhKVuvmAWASDChTMm7dlChV8RATg0OTgwOTnm7K2pDZ1fAZAFOZgyAza0Ag==&pd=2323UmDyDKVBDK2l mxPcECu7dWt&campaignId=9jn0Aj73NTLdAZMq  (teamviewersetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=AT7dAZ7dNji0Ni==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1E2r5fSVDfcd5uXd5uDHvl7XAm2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXz7yAZcFOTMFASDPDdlChV84NZgwATnzATaz&pd=2323Umtp2dCtc3VuUmNJ i==&campaignId=9jn0AzAdNTn0AZMq  (gtaivsanandreassetup.exe)

0 / 68
http://bubblyapps.com/?dl=1&pi=ATidNjCyNT7zAM==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=c3aW7mcm2r0Wc32lDXimcHaWck1E dWE rLtDK5y2rgmIT1zvm2yIKiWvmREhKVzvmNjhLVTvmNBDz1lcyDjhTnmDZ0wvmNpDZ1fNzCROZC4AZCRvm5EIKiWXzndAZndNzAyNZa=&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0AziFAZiyAZMq  (googleearthsetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=ATayNziFNjiFOi==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck11 ml0eS13DKatcrRPeKVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXz7FNZM3OTMFASDPDdlChV83AjAwNzL4AZaz&pd=2323UEsJck1p EN07KRBUmNJ i==&campaignId=9jn0Azi3NZC0AZMq  (unitywebplayersetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=ATa4NjgzAzCyOM==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0OSDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8RAjazNjMROTnm7K2pDZ1fOT71AjM4OTnyAw==&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0AziFATAyAZMq  (windowsmoviemakersetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=ATLdAjc1AzMROM==&osos=VdluDrW3cw==&dr=cHaWck13IKF6IXMm2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1p2kDj7z1vVkDj rcWIXim7z0RvmiWAkDjIKiWXzayAZCzAZnFASDPDdlChV8RNZM0OZi3ATaz&pd=2323UEsJcrluc3xP rwu7dWt&campaignId=9jn0AznwAjLyAZMq  (winzipsetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=ATA3OTn0AjLROM==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1z2rVP SDphXAmD3vpDZ0m rcWDK4m7dAWSVim7dREhKVuvmAWASDChTMm7dlChV8yOTLdNjCwOTnm7K2pDZ1fAj7yNjadNzMyAw==&pd=2323UmxJ2d4t7XswcyFj d0=&campaignId=9jn0AjC0NjidAZMq  (steamsetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pipi=Ajg4NzcyAzi3Ai==&osos=VdluDrW3cw==&dr=cHaWck1o 3xzcrW0UXNoIKVBDkD0 T1z2dVl2kDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8RAjM0NzaRNZnm7K2pDZ1fNznzATMyNTi4Ag==&pd=2323UmDyDKLtDdWP HAu7dWt&campaignId=9jn0AjcRATCyAZMq  (hotspotshieldsetup.exe)

1 / 68      (Adware)
http://bubblyapps.com/?dl=1&pi=Ajg4NzcyAj7yAM==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1iTkDj rcWDK4m7z0RvmiWAkDjIKiWXznwAzAzOZMFASDPDdlChV83NTLyNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AjgRAzadAZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=AzMRNZCRNjMRNM==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWcHim7dAWilam7dREhXs0vmAWASDChTMm7dlChV8yAZAFAZMROTnm7K2pDZ1fNzaFOTazNTnyAw==&pd=2323Um2l2k1oDXvlUmNJ i==&campaignId=9jn0AzAwOZC4AZMq  (openofficesetup.exe)

1 / 68      (Adware)
http://bubblyapps.com/?dl=1&pi=ATCzAz70NzA=&osos=VdluDrW3cw==&dr=cHaWck1C2mit7dit7EVy mVyvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWSL4m7dREhKVuvmAWASDChTMm7dlChV8RNZgROTCwOTnm7K2pDZ1fNTLROZn1AjnyAw==&pd=2323Um2yDK50UXsjUmNJ i==&campaignId=9jn0AznRNjA4AZMq  (pdvdcdburnersetup.exe)

1 / 68      (Adware)
http://bubblyapps.com/?dl=1&pi=ATAwOZAyNzaROM==&osos=VdluDrW3cw==&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhLFAvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNj7zNjC4AZCRvm5EIKiWXzn4AzCzNTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0AzM0OTa0AZMq  (popcorntimesetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=Ajg4NzcRNzA4Ni==&osos=VdluDrW3cw==&dr=cHaWck1mIKRlUKWwDKFlcQD0 T1z2dVl2kDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWSL4m7dREhKVuvmAWASDChTMm7dlChV84OZA1NzCwOTnm7K2pDZ1fAZidNTc0OTMyAw==&pd=2323Um5C KlyDS1PcHMu7dWt&campaignId=9jn0Ajc3ATgdAZMq  (fileopenersetup.exe)

1 / 68      (Adware)
http://bubblyapps.com/?dl=1&pi=Azn0OTcwAjgyAM==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1NKkDj rcWDK4m7z0RvmiWAkDjIKiWXzAwAzAzOZMFASDPDdlChV8yATcyNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AznRAj7wAZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=ATadAzn1NTiwNw==&osos=VdluDrW3cw==&dr=cHaWck1E2r5fSVDfcd5uXd5uDHvl7XAm2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXz7yAZcFOTMFASDPDdlChV8yNTgwATnzATaz&pd=2323Umtp2dCtc3VuUmNJ i==&campaignId=9jn0AznwAzCdAZMq  (gtaivsanandreassetup.exe)

10 / 68    (Adware)
http://bubblyapps.com/?dl=1&pi=AzM1NzcFNZMzNw==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck1jIHvJ KLm2r0Wc32lDXi1vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzLyAzgFOZMFASDPDdlChV8wAzL0AZgzAjiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AziwNZc0AZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=Ajg4NzcyAzi3Ai==&osos=VdluDrW3cw==&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWcHim7dAWilam7dREhXs0vmAWASDChTMm7dlChV8yAZAFAZMROTnm7K2pDZ1fAjaFOZazNTnyAw==&pd=2323Um2l2k1oDXvlUmNJ i==&campaignId=9jn0Ajg4AzgyAZMq  (openofficesetup.exe)

4 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=Ajc1OZM1NZ70Ag==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1EIK1wvExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWSL4m7dREhKVuvmAWASDChTMm7dlChV8FNTgzNzCwOTnm7K2pDZ1fNTc0AjA0OTMyAw==&pd=2323Um5j2rlJ m5C KlyDSFj d0=&campaignId=9jn0AzaROTcwAZMq  (gimpsetup.exe)

1 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=AT7RAji1AT74Ai==&osos=VdluDrW3cw==&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzMROZ7dOTMFASDPDdlChV81NTMdOT73AZaz&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0AznRATndAZMq  (windowsmoviemakersetup.exe)

7 / 68      (PUP)
http://bubblyapps.com/?dl=1&pi=Ajg4NzcyAji0Aw==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1wIKNPcdnmIT1zvm2yIKiWvmREhKVuvmNjhLFAvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNzLyNT7FAZCRvm5EIKiWXzayNTnyNTcwAjA=&pd=2323UEVwUK2J diu7dWt&campaignId=9jn0AjczNzg0AZMq  (picasa_setup.exe)

The following 29 files have been seen to comunicate with bubblyapps.com in live environments.

TCP » 209.99.40.223:80
UCBrowser.exe (by UCWeb)

TCP » 209.99.40.223:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.223:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.223:80
jingling.exe

TCP » 209.99.40.223:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.223:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.223:80
hkcmd.exe (Intel Common User Interface by Intel)

TCP » 209.99.40.223:80
online-guardian-v2.0.9.exe

TCP » 209.99.40.223:80
svcspwin.exe (WinsPop Enterprise Super V 2.0 by agir)

TCP » 209.99.40.223:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 209.99.40.223:80
ContentFinder.exe (ContentFinder by DigitalSoftware Group)

TCP » 209.99.40.223:80
ContentSinder.exe (ContentSinder by ContentSinder Company)

TCP » 209.99.40.223:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

TCP » 209.99.40.223:80
apptrailers.exe

TCP » 209.99.40.223:80
kmspico10.2.1__8174_il3.exe

TCP » 209.99.40.223:80
kmspico10.2.1__8174_il17.exe

TCP » 209.99.40.223:443
online-guardian.exe

TCP » 209.99.40.223:56666
emuletorrent.exe

TCP » 209.99.40.223:25
init.exe

TCP » 209.99.40.223:80
DTSRVC.exe (DTSRVC by Portrait Displays)

 
Latest 20 of 33 files

URL:
http://bubblyapps.com/

Title:
“File-Extractor”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.