home

cdn.mediafhclearbundles.com

Communigal Communication Ltd

Domain Information

The domain cdn.mediafhclearbundles.com registered by Communigal Communication Ltd was initially registered in July of 2015 through GAL COMMUNICATION (COMMUNIGAL) LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
GAL COMMUNICATION (COMMUNIGAL) LTD.

Server location:
Oregon, United States (US)

Create date:
Saturday, July 25, 2015

Expires date:
Monday, July 25, 2016

Updated date:
Saturday, July 25, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
mediafhclearbundles.com

Whois:
1 mediafhclearbundles.com record

Scanner detections:
Detections  (92% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.NewMedia.Installer.Installer (M), PUP.NewMedia.NMH.Bundler (M)
100.00%

Bkav FE
W32.HfsAdware
9.09%

Malwarebytes
PUP.Optional.InstallCore
9.09%

K7 AntiVirus
Unwanted-Program
9.09%

ESET NOD32
Win32/InstallCore.ACP.gen potentially unwanted (variant)
9.09%

avast!
Win32:Malware-gen
9.09%

Sophos
Generic PUA NP (PUA)
9.09%

Comodo Security
Application.Win32.InstallCore.DQR
9.09%

Dr.Web
Trojan.InstallCore.576
9.09%

VIPRE Antivirus
InstallCore
9.09%

G Data
Win32.Application.InstallCore.EG
9.09%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
9.09%

AVG
InstallCore
9.09%

Avira AntiVirus
PUA/InstallCore.diur
9.09%

The domain cdn.mediafhclearbundles.com has been seen to resolve to the following 15 IP addresses.

185.53.178.8
August 28, 2016

52.38.209.219
ec2-52-38-209-219.us-west-2.compute.amazonaws.com
June 8, 2016

52.33.165.25
ec2-52-33-165-25.us-west-2.compute.amazonaws.com
June 8, 2016

52.32.12.104
ec2-52-32-12-104.us-west-2.compute.amazonaws.com
June 8, 2016

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 26, 2016

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 26, 2016

52.26.95.11
ec2-52-26-95-11.us-west-2.compute.amazonaws.com
April 21, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
April 21, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
April 21, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
February 11, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
February 11, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
February 11, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
February 11, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
February 11, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
February 11, 2016

File downloads found at URLs served by cdn.mediafhclearbundles.com.

1 / 68      (Adware)
http://cdn.mediafhclearbundles.com/c?x=n43DI2Pss02KjWoGisZJtI/9sq6r3dHy6lkvaLYzjcc=&c=h0V2RxFRoCplTRxHdQXyqVmW1SmHeO1S8/jVhFZVAQ/zMK8BBddtnxs4J5QPUBZuexnKN4q0a GlCuMJHuykmSwrsrFR8q7ElaBn2Oq2di0BAxZxbbPxjfRc9xq Opt9DsioTByOlhtas9nH0830Jb6kfGuT6fYxGyNWCBAmMyU=&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (icreinstall_c.exe)

1 / 68      (Adware)
http://cdn.mediafhclearbundles.com/c?x=DtMCuUfLMACe/7fzK ekeHEIODXXw1z4J335znAJ8bA=&c=ltjpu5emSexoILBC7nleV 9ceNBBZQMbqzrUorKvuYzL V0nqd4LRyeyl09Cjchp2afot3WTQsChLE1xgUrc/0FYB8HkOmiwGe5N9Tea/LmRRnbb28YVM19GAZecpuVCn8VJCaBtRm/Xe7Opzw6GBqYoyxDQgLHQn8X/IEArGp4=&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (a7dafe85937bd924e291cd372e3ca084)

0 / 68
http://cdn.mediafhclearbundles.com/c?x=iYuJkConuV zYFLAJkq2iC5blT9okAfjR1rTvidgxUk=&c=uk3qvXTlXAHtqXiUcq6gRC T/e2STaqXvG8f/VTybgnro34/5UpZmuBVFDfP9/xApw1n4/KtA7bURR7QadX1ASc/m1XA6QbIuSSAF1S7bpj8KJxKfKbCiij0RSjlP52CKyPCxNdguUm9pEOnsaLAqlWDH57WBZs0uJrLg6mLqjQ=&downloadAs=HorizonSetup.exe&fallback_url=http://allmyapps.com/binary/6294/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (setup _791ba3bb.exe)

1 / 68      (Adware)
http://cdn.mediafhclearbundles.com/c?x= s/rg3/uX4jB1/BDF5DxxDsImGX6GFWzKYHlOVHCBuU=&c=FFP RyJvfgs2Y4XVp04v925mgyqg0f8O8i0r5Rzypza hAKEJI5CyKbmPdIA2wXA3sIQFUEb WdU7NFxzBy6BMpHZgyP6uofJ0qpe/ifqZINThqMveNy76ISppB3TGEM2rirKJd9lG/8sLNw15WnpWFbwgsVD7MuZOesPXdbw3o=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe  (8d12a6ff16c94a2f4b760fc059eac820)

1 / 68      (Adware)
http://cdn.mediafhclearbundles.com/c?x=KcY8u/bYAZAK6hjBFM1ojyLR6bENxJi/Yi5i45uF1ak=&c=Jtd6 9i/y5ggK0xC7zBu960tYh0fkM 11w3kI5J1iJRu66x7VoGxD0OluAYhkIGYuRLu5LRK01yugILJaWdhlGWaOvbKXqbm2wnSPhRLbm3gUm4aJu2XpQ2LQWEafoGRiY2vu0UJ8SmD/C/tfxf7vfCXo0RPc6pu5WIyOt0p3AU=&downloadAs=OpenOfficeSetup.exe&fallback_url=http://allmyapps.com/binary/562/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (e26cc982723b26290d7446403a2cc024)

1 / 68      (Adware)
http://cdn.mediafhclearbundles.com/c?x= y42N zklr3GaFZSbyPO5Cnyb 3NQED07VOqtai2JA8=&c=iBX/4T51sVsdVGPYaGH0LrbCxzYMQpihi0 Ocf9hunul lTcUor32cVxW hDtUy6fGU0R1trNkcogE1QbKitrmNQlGDTAdQZwEXUrpk5ALIXMK0d3CSorGuKBlvrHdt4wLprJGxQDlfMkBHg739oqsf/1uS1Em/pIYqOmnSZIOQ=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe  (f9fd5176228a1e26d61febf6431c151e)

1 / 68      (Adware)
http://cdn.mediafhclearbundles.com/c?x=Cm1oRfeh6losZOBxRumFm5ufqSVZ1fC9XJrfsqqXd/I=&c=0sthIpX6ohhx0bQzhh9ab6NgxlHWEu51gPlWSJ Xej ecqRQWilW2Ez7lFbxQIqZF5Q0poOZR/3XpmRYodPTsy2A8j7TIfxIl9e7sRCSOBAmMEYgMLgBpIIoFNbp8baAaxV3CK9I4UZcsJe6G6XE7wsp5yEgD5S5SGzyCFEXvhI=&downloadAs=CCleanerSetup.exe&fallback_url=http://allmyapps.com/binary/582/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (2b6c7eedbf78d11b49e9d96f4d910cd8)

1 / 68      (Adware)
http://cdn.mediafhclearbundles.com/c?x=hxgqjh05zXVMC9fnwgMfNtaMOiDi5J3gBKKdMtlNnHo=&c=KTgn92Qcj57e6wBScMs6DsQzWTtWD8 Ao8Mid7Oh2LQc18vIs2vS4ZqzsV6 wqgpYSBklKKsEM64hFo8MRjajxlzAdqQhX10dosmbhu4hRZEh2bemc3ZGkcFLVPL6tU0onryMFfeGyUwLw5gkGKUw9RsdY/BIrVtXha6Z4rMF/U=&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (fecd7f961fe02fa44e173ef33f16f13c)

1 / 68      (Adware)
http://cdn.mediafhclearbundles.com/c?x=plZZ4RwlOdp76DhUNwyzrKAuhztAe7eZIObpU4LGqSk=&c=jdYXWXtl GiF1RKoGOaS2RsWlzlrFwNnsTZQijEvCvdQbg4pODt/6HFtErBjn72m4vhCYSod5jEgRRwuxig5wVCkppiS4uBPcPHKKnwgC/EGxgTBQgg22ymkITZNUbmFzvVMt9iPZJa5J3IOAJvIjTQrUsliEo54IdLnmC3KBY=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe  (8ac3d845861bd3aeed2e3b336de41ad2)

1 / 68      (Adware)
http://cdn.mediafhclearbundles.com/c?x=HvNxBIhQW6o7XFNjhNi9WMbJqTc5GRfXqzf3G1HnYC0=&c=kbDCKc7QCRAJl5LFh3vfew41T2r/6OX9svouCpbDT2A2yN4KtTGRZRFxPYEYEeQ8GVVKaIWMWjztUbdXCunjovT6NO/TiWAvaJfr MzHF/oL1vx9MFI0PGX4RQGqnlojNNDlHiYu3sNUyrZGucDBbxrHjkE7o7Zhtr2QIhfzSp4=&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (14372222999814a598be6120c3d58304)

1 / 68      (Adware)
http://cdn.mediafhclearbundles.com/c?x=EzoE4dAJh/zIcaBXE3T1bQP6OnCrkMZ12RS5gzf064Q=&c=qWHbrj vwRBDfmlBSnqweNDX7txGUgr2inR VwTIIv0KKwAGnNRO/jOJVCpjZdfcZgFB3nWuVW8KG2 LZo4r6EHxH54VF0k86x58/CW/ixPZUdzuKiyrNzB2e4yGMtLfyokXd47DmsHMMkRDuQTdL /2SPmiW4C3TaJD3EPphXo=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe  (415fa1cea4bfb9bcb700359154cdc256)

14 / 68    (Adware)
http://cdn.mediafhclearbundles.com/c?x=6jekxy11Yc6EIs1TPz1fyPap FBxjD8K8QbUfqFp3f4=&c=u2TIC4OS zDN4ZPh qipKCMv7xqsh1xav2WAWJIrkwpQ4WfwL9VSUkUqU5o1AoY57rmF bDSVaEedMzmDI1iK8ZuQZ4/DVtLeM8 UJZWJu7CBaHjYfJKBwwZOmh1xbwVpj3450vjgwNwdMD81yMF s2ZF yTe3I/leHxQntjP7U=&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (7fc60c03df4c6fe4c00578b8c918765c)

The following 18 files have been seen to comunicate with cdn.mediafhclearbundles.com in live environments.

TCP » 52.38.209.219:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.38.209.219:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.38.209.219:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.38.209.219:80
browser.exe (Browser)

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.38.209.219:80
3.9.0.128_20140916045038.exe (The KMPlayer by PandoraTV)

TCP » 52.38.209.219:80
e5be.tmp

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

TCP » 52.38.209.219:80
client.exe

TCP » 52.38.209.219:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.38.209.219:80
kmplayer 3.8.0.117 -[www.patoghu.com].exe (The KMPlayer by PandoraTV)

TCP » 52.38.209.219:80
KMPlayer_3.9.0.126.exe (The KMPlayer by PandoraTV)

TCP » 52.38.209.219:80
3.9.0.125_20140702035547.exe (The KMPlayer by PandoraTV)

TCP » 52.38.209.219:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.38.209.219:80
online-guardian-v2.0.9.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.