home

cdn.completeappswindow.com

Communigal Communication Ltd

Domain Information

The domain cdn.completeappswindow.com registered by Communigal Communication Ltd was initially registered in April of 2015 through GAL COMMUNICATION (COMMUNIGAL) LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Hollywood, Florida within the United States which resides on the Prolexic Technologies, Inc. network.
Registrar:
GAL COMMUNICATION (COMMUNIGAL) LTD.

Server location:
Florida, United States (US)

Create date:
Wednesday, April 22, 2015

Expires date:
Friday, April 22, 2016

Updated date:
Wednesday, April 22, 2015

ASN:
AS32787 PROLEXIC-TECHNOLOGIES-DDOS-MITIGATION-NETWORK - Prolexic Technologies, Inc.,US

Root domain:
completeappswindow.com

Whois:
1 completeappswindow.com record

Scanner detections:
Detections  (83% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.AnchorFree.Installer.Meta (L), PUP.Installer.InstallCore.Installer, PUP.InstallCore.FC.Installer (M)
100.00%

avast!
Malware-gen
40.00%

Dr.Web
Trojan.InstallCore.554
40.00%

VIPRE Antivirus
Threat.4786018
40.00%

Comodo Security
Application.Win32.InstallCore.KT, Application.Win32.InstallCore.AKG
40.00%

G Data
Win32.Application.InstallCore.DI
40.00%

ESET NOD32
Win32/InstallCore.ZC potentially unwanted application
40.00%

herdProtect (fuzzy)
a variant of 7cb0cbbd4d3a6933f93d5524b39392acc118431d, a variant of 3961aa13f6d88f4e74d2aaf0afecc1e87a4eafaa
40.00%

Malwarebytes
PUP.Optional.InstallCore.SID.C
40.00%

K7 AntiVirus
Adware
20.00%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
20.00%

AVG
Generic
20.00%

The domain cdn.completeappswindow.com has been seen to resolve to the following 3 IP addresses.

72.52.4.91
unknown.prolexic.com
May 20, 2016

54.213.22.74
ec2-54-213-22-74.us-west-2.compute.amazonaws.com
May 15, 2015

54.194.116.148
ec2-54-194-116-148.eu-west-1.compute.amazonaws.com
May 6, 2015

File downloads found at URLs served by cdn.completeappswindow.com.

1 / 68      (PUP)
http://cdn.completeappswindow.com/c?x=KBOgeiT 3Lq7R2vVis fFDp1IN/zX5svBCSJqdfBGzs=&c=ao322Z0SnS8U0UUUd5oGqMlkLTFHHHloHQfUAOGb8q7slTBnunngoGjfBuNGceY2vkLEqhzoKe850kK/EMa4hw==&downloadAs=hotspot-shield-3.42.exe&fallback_url=http://pf.phpnuke.org/s/1430097605/en/8/.../84579-1801425-hotspot-shield.exe  (hss-3.42-install-e-550-plain.exe)

1 / 68      (Adware)
http://cdn.completeappswindow.com/c?x=/jcI6g9/1cjYZvJxf6rvYsEw17sz/7rixRJMgkLBJnM=&c=WcZrmgLYXkbOab0Xaex48A8Zjht8YGk0KT3StTCTHmWisNJ JoZuRxCqMRlqYprw1vNweflryUnZ8cSkdTKjDw==&downloadAs=php-32-bits.exe&fallback_url=http://windows.php.net/downloads/.../php-5.6.8-nts-Win32-VC11-x86.zip  (9b57c27f7d914ef00a90da977df14e7b)

0 / 68
http://cdn.completeappswindow.com/c?x=OvhKQYaxdTI7WrV/6s33RQYIAv19Yu0c2l9QscLbFCM=&c=uddqncyqGi EEYnhu8R71wiQ3r0864Qt1fvNe51COQOJanhtKJHo/VIyn QgF/OOjlYxD BIeCs8DOi8LkTTDw==&downloadAs=microsoft-office-2010.exe&fallback_url=http://pf.phpnuke.org/s/1430105297/en/8/.../83929-92631-microsoft-office-2010.exe  (professionalplus.exe)

1 / 68      (Adware)
http://cdn.completeappswindow.com/c?x=LGweZNIuP47gONvAfWflhguDq2C NPpJfYNFjIepWME=&c=BTxAuTW5Eq27VjCCnzwUvISWaWHLJ6yQR1c861KQWrdpe09TC HQKg1vTb71LFu1LPhBQdEIiUW5b K3/KYeQ==&downloadAs=media-player-classic-32-bits.exe&fallback_url=http://sourceforge.net/projects/guliverkli/files/Media Player Classic/MPC 6.4.9.0/.../download  (ab3de807c16c93f38b87b47b5d2e173f)

9 / 68      (Adware)
http://cdn.completeappswindow.com/c?x=TzatlgXbekhHOy58EEhMElkx1QmLtYsIoUvUzlaVraw=&c=/qRKSmbulqHXyAqTvIQto6xSV5CttQMNsxG7vf76VzJnkUTFW30P9JvFMtDoboeXSfv3bdc9rXya6wHdmb04bw==&downloadAs=microsoft-outlook-2007-32-bits.exe&fallback_url=http://msft-dnl.digitalrivercontent.net/01/68428020-3121404-O12PROTR-LAT//msoffice/pub/.../X12-46701.exe  (178cb5f1040d5f129961059a491e8858)

12 / 68    (Adware)
http://cdn.completeappswindow.com/c?x=qqm2UJS2C8RV3LTUYB//dDGa0NRygwY9mg5s7tsLutE=&c= KosXcJoM4GJ53D2jU1V6uFPjF DDln0sLkV2O8uuzo2hZKB4OdUIjFl8lcMk76Bo3SPk0UNdsGkDTygdwBn Q==&downloadAs=ares-galaxy-32-bits.exe&fallback_url=http://sourceforge.net/projects/aresgalaxy/files/aresgalaxy/AresRegular230_081714/.../download  (95453a92aafbeb74547518bedecf2d37)

The following 17 files have been seen to comunicate with cdn.completeappswindow.com in live environments.

TCP » 72.52.4.91:80
jingling.exe

TCP » 72.52.4.91:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 72.52.4.91:80
crossbrowse.exe (Crossbrowse)

TCP » 72.52.4.91:80
hbpzabffmyx.exe

TCP » 72.52.4.91:80
pbiiuvda.exe

TCP » 72.52.4.91:80
ContentFinder.exe (ContentFinder by DigitalSoftware Group)

TCP » 72.52.4.91:80
winsysapp.exe

TCP » 72.52.4.91:80
chromeplugin.crx

TCP » 72.52.4.91:80
winalert.exe

TCP » 72.52.4.91:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 72.52.4.91:80
autoDENGI.exe (autoDENGI by autodengi.com)

TCP » 72.52.4.91:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 72.52.4.91:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 72.52.4.91:80
emuletorrent.exe

TCP » 72.52.4.91:8080
smu.exe (W by Search Module)

TCP » 72.52.4.91:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

TCP » 72.52.4.91:80
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.