home

cdn.directbuildworld.com

Communigal Communication Ltd

Domain Information

The domain cdn.directbuildworld.com registered by Communigal Communication Ltd was initially registered in July of 2015 through GAL COMMUNICATION (COMMUNIGAL) LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
GAL COMMUNICATION (COMMUNIGAL) LTD.

Server location:
Oregon, United States (US)

Create date:
Monday, July 27, 2015

Expires date:
Wednesday, July 27, 2016

Updated date:
Monday, July 27, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
directbuildworld.com

Whois:
1 directbuildworld.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore.Installer.Installer (M), PUP.InstallCore.Internet.Installer.Meta (M), PUP.InstallCore.FC.Installer (M)
100.00%

The domain cdn.directbuildworld.com has been seen to resolve to the following 4 IP addresses.

185.53.178.11
August 3, 2016

54.186.192.212
ec2-54-186-192-212.us-west-2.compute.amazonaws.com
May 23, 2016

52.36.96.168
ec2-52-36-96-168.us-west-2.compute.amazonaws.com
April 10, 2016

52.10.77.11
ec2-52-10-77-11.us-west-2.compute.amazonaws.com
February 11, 2016

File downloads found at URLs served by cdn.directbuildworld.com.

1 / 68      (Adware)
http://cdn.directbuildworld.com/c?x=ZeqpcMNMsRkN lZvgjn3rnUPZJkdhHAz7Q9bF71t45I=&c=OSIWoyvhhkclojFHXlVbZvVkjO9M/XYOql0WqrreG2aAF3ighq7x59ASYeCXdKECJWmVLydCQ0oRhydFoeGNW/iWvix8QwkEbDNbpEyriVCh vBE8Gj4CUz2ahomFJ2r5ToZCUPG2aYYsPXpFM3wfRAghtHaVAK gbGL7VFKh1Q=&downloadAs=zipinstall.exe&fallback_url=http://.../7z938.exe  (0f1768430c97be59ea36bbd0096db1ea)

1 / 68      (Adware)
http://cdn.directbuildworld.com/c?x=V 3b/a3ll0gUezcoRWPgu8cdpYnb5tlkidxL2QQO8Xo=&c=K0ZJZB6noRpe03NEid8zxZvXwrAyGBOmHLSR9NA70gEEUmCGy9BnyUufEfhv1/b545Od77 HOaDekXhGF sDTOzW2woZDixqadkUd72uQxCo0bETmz6R8asSXaGx7u/ItuxX2xHqpPT1DTpjm30TJKT hLvSlEWhgK1AUztto6o=&downloadAs=zipinstall.exe&fallback_url=http://.../7z938.exe  (52aba353e35abaa59386fd465e0503d4)

1 / 68      (PUP)
http://cdn.directbuildworld.com/c?x=ExgK9t72p5iY2F j/FnPy 5hYj2xElPwlvFnTCPKQ0A=&c=wmAxihQjm6xcdeWgE5O2yBarzZzcoXMZbraywGNfxTxz9lyTrW22 K1kpNJA4psS8pjAapB9rPoe44eoK2DNuTOEPaTKNCbvC58BkIjLaBW4cARE7upoPy64aF3rWmIEL8D0RuMisNFNDZDzwLSFEqaTT brlk9qN4j7cK01Tjo=&downloadAs=zipinstall.exe&fallback_url=http://.../7z938.exe  (1454aafdaf71508cca8c117e669c217b)

1 / 68      (Adware)
http://cdn.directbuildworld.com/c?x=yQF6mq/76BGCB2M2k6gCi1bATsjIL9l2CL38Y47an08=&c=CedqNoM1u19HI9vAS lzEhE 55SZeG9Z8cP2S6km4Vtw8a0cZSqO6crYzErHr51j2Z5psETfWIV1xk3 029ojkPiqPyhKOJeNjmcQ7dzM6qQri JcSlBEr TfTxIPETBCeLD7vbuxsL2jY/kpymYIeLlLrg XiQS/y0CchLDsuk=&downloadAs=zipinstall.exe&fallback_url=http://.../7z938.exe  (ae8b9240b5efacd90748f0aa071a7ba9)

The following file have been seen to comunicate with cdn.directbuildworld.com in live environments.

TCP » 185.53.178.11:443
translategenius.crx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.