home

cdn.mediafhsignslaboratory.com

Communigal Communication Ltd

Domain Information

The domain cdn.mediafhsignslaboratory.com registered by Communigal Communication Ltd was initially registered in September of 2015 through GAL COMMUNICATION (COMMUNIGAL) LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
GAL COMMUNICATION (COMMUNIGAL) LTD.

Server location:
Oregon, United States (US)

Create date:
Tuesday, September 8, 2015

Expires date:
Thursday, September 8, 2016

Updated date:
Tuesday, September 8, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
mediafhsignslaboratory.com

Whois:
1 mediafhsignslaboratory.com record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.NewMedia.Installer.Installer (M), PUP.NewMedia.NMH.Bundler (M)
100.00%

Bkav FE
W32.HfsAdware
12.50%

Malwarebytes
PUP.Optional.InstallCore
12.50%

K7 AntiVirus
Unwanted-Program
12.50%

ESET NOD32
Win32/InstallCore.ACP.gen potentially unwanted (variant)
12.50%

avast!
Win32:Malware-gen
12.50%

Sophos
Generic PUA NP (PUA)
12.50%

Comodo Security
Application.Win32.InstallCore.DQR
12.50%

Dr.Web
Trojan.InstallCore.576
12.50%

VIPRE Antivirus
InstallCore
12.50%

G Data
Win32.Application.InstallCore.EG
12.50%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
12.50%

AVG
InstallCore
12.50%

Avira AntiVirus
PUA/InstallCore.diur
12.50%

The domain cdn.mediafhsignslaboratory.com has been seen to resolve to the following 11 IP addresses.

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 16, 2016

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 16, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
April 18, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
April 18, 2016

52.26.95.11
ec2-52-26-95-11.us-west-2.compute.amazonaws.com
April 18, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
February 24, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
February 24, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
February 24, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
January 27, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
January 27, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
January 27, 2016

File downloads found at URLs served by cdn.mediafhsignslaboratory.com.

1 / 68      (Adware)
http://cdn.mediafhsignslaboratory.com/c?x=UGL/s0zyRGjpmJGfZnvQx5nvpJJHJc7rKCbPiDP5exI=&c=w yioyEdoz179KOQH9Z3gp7kmu9Hjc7gXIDePM61jbs 7SjTdBVxH7/0JeJu4o3TuyXt0/s 0KyHZaIe1iXWojc6t907PXz2QZyrpradJONQIJBUNHtYHddFyS55X/ZtRpzL4zGmQTYBq2adjoV4NBvsi/a4INbBak9NgYBj/Q8=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe  (icreinstall_c.exe)

1 / 68      (Adware)
http://cdn.mediafhsignslaboratory.com/c?x=Bm0bGbrTaBFwV43ShtV9h7Sjorqi0eBMi8P72v9rD Q=&c=pp XwjXtdXCi PGqGuQi2bO5S1zsOrmfZGBewbseCFMMZKnyLBF946/k/SomBom1MvId9P 1Tr5HyRy5lGfdAzExYvbYVp1WjiGCX3rSJNvzjJj/wI QSSYZ9S4l75Tl4AZYCILM1jcPa2kIPGLBInAfaU28gpjAnirNBM/1vb0=&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (23f041db989eabac89d4c3e0e4d8bb13)

1 / 68      (Adware)
http://cdn.mediafhsignslaboratory.com/c?x=x2eEkA8ah9z uJUsNmJNhcfbTi3AL3AvjjlG NKrkvA=&c=Te6fQZEmgvB9eI1amA8kXKNNyq5FBhSviPIk6puXKDYi4Gy1yBGDcOLq13CeTJv4wBJB7CX PPLvqyuUaggDSjcnw/No0951xkOHdKYCDKeIH0Og0GBkklvJ9DSLtEDZc/ GBU7MRx1ayfuFRlCJYWD/t6bhVfUVdOJglSQ Ho0=&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (icreinstall_googlechromesetup.exe)

14 / 68    (Adware)
http://cdn.mediafhsignslaboratory.com/c?x=YyJnDIWS25BYny1LoG2x0ya/CvkyxGGUvgW ntqAkNA=&c=r8LtAwTRxaYdVjGbqluHPsXEjDBAi7QOqr8QrF6UwWFLmyaHxfXcyZDQk93BMHcYg4DeLcxp/D1AeuuJ eyiz/ 0wS k4AkrOGO9f4yPwRMJI88s683S9SUJysQgtoc1gl9jo3JikV8fiPT7JAPm818kbRhJUNQ7VqqBZg3x Lc=&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (1a910217c116bb246867d5b245b24ab9)

1 / 68      (Adware)
http://cdn.mediafhsignslaboratory.com/c?x=/P1zB8OoFqtpOUXYM82R3fuL0bXcHXCh8Jw0IYB1 9E=&c=75viQxH/Qb/JAdkrbr oZjr5WX4MfSwlf678AObj1rcz8fZncwW1U6l3cz2SyyiR3iZVkfkQO9i8ahXTlcO1M I7wglG cnveZTghZMO6YKWuGZTGFuxLw1/tGhjGoNu H1MMTUd0hguCkkocJQCLAnujiKJ2BCDpqxQJPnlDK4=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe  (9baa1961d43944ca468a5125ca03c6b6)

1 / 68      (Adware)
http://cdn.mediafhsignslaboratory.com/c?x=xWTSuhSWzU2kfH9Rr0Prh7hwkOF27kE6cgzXOkcpo4c=&c=gwU3ZCr2rNLl8JOIYUmVk8gt73To7YqAGbjWkVr9OFS/H3dMn25dwAtEyjSPRx9NUCFvF8dzRtbymmvX25LBl3NSlUZvLx9OHUG9UPjwJVTLf5n8SuW29FzV5vn UBwX70SkSflSXEBpTm6nAQNC9RmYBC98Oh 19zkvK52hpAw=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe  (6a6f5026403908a16dcb2e52ae5a8b82)

1 / 68      (Adware)
http://cdn.mediafhsignslaboratory.com/c?x=pWLwfPpUhw/AdA1w9IhziaCi5w6XSBaLXslWq6686cg=&c=9LDPn kEr66bw99pDFIzwx4SbzUgJKsrAydKU2o1EADeesSLNuJoKMMEeLmUmzjZSFCGvqD0/nH1WIaRIYXx/wTQrBVcUxFL2EoHxuOIDOlRRvfewSutWmKgRV8TdmnKvqid7fkXFtiN8xbeyF3OcaNTjHAwuT3 6Tn3cJJSipc=&downloadAs=BlueStacksSetup.exe&fallback_url=http://allmyapps.com/binary/17529/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (icreinstall_bluestackssetup.exe)

1 / 68      (Adware)
http://cdn.mediafhsignslaboratory.com/c?x=ofJ Ijbla069MnBLoXawUirhk01c4xjO7MvDB67MUiE=&c=SAdU70CVlLuRTHS5PKlwwhkOG86FQkSXNpH6JsAkHXWgw4j9O2 8nlYJf2mGJs16JcZy958dutPDX1fTOdMlF3VJu8kVI39/0znvc8qWUqbjgTWupqGRrgWw6xZIRXys5nyG55Ut76KHBMsxm2UHstdJOdVGFu79cqYHVecE2DE=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe  (9baa1961d43944ca468a5125ca03c6b6)

1 / 68      (Adware)
http://cdn.mediafhsignslaboratory.com/c?x=gm/iayyXx00XRHuRHqPsb k8L8lB4yydFzT X2sOG3c=&c=SAizZmWcA73DxuzZKq4 M9GLQel7ikAF4W0DQeAM7US8m0GLsQFJpe4ruF5WIOiz FqGk2RYKfuP8hURtA iuLPJfFBM4W1Lby/rCIOUtgJo6jM vqicmAiRaoLR4rtIhF1BOCxOP9S4LNqdFDj5zOuqaWl5ttRLj14wST8VJ/Q=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe  (9baa1961d43944ca468a5125ca03c6b6)

1 / 68      (Adware)
http://cdn.mediafhsignslaboratory.com/c?x=N/KnHaBAjFXrlwY2b4HjvvdClF2lWIz13RBkV1Q0Q3c=&c=Z o2Q4CGNHv8h6F0hvoJKu4yC0BGzyBPlUpDe3 0uwNvGD6DUACWfoHgdxw3Po7NSkduxgxRW7TDzVr7X6StRPjubFepbY0Lp OKRWCd9sWZZXLpF9oALvieG4O1FUDxO6Rm9rdv5JThqUk28HPGwxAmqLCK1lq7Gmg48GQSpYM=&downloadAs=TeamViewerSetup.exe&fallback_url=http://allmyapps.com/binary/653/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (1669ec03fb7557cda4e9013c0d83774b)

14 / 68    (Adware)
http://cdn.mediafhsignslaboratory.com/c?x=hPg7qmL f h9N1vegWV3uL1kstuVXjiUUlw/vJ7LNYI=&c=kQ/qlhhUucKLw9SarSmgUMD8ZiFUzpuHA3Ixc7XzmbtULexF8V0qsCG9m1Z9tG33FAIiPyrLjWuHiWK1L1zJKHJ4pAsW 8UQPU2WsLA14hE9FI2MJlI3xRoQSUIgRFBN7t 5wbVNMIiDap1vhDXaR5z36/Q8O3 L8trd8u zfhM=&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b  (1a910217c116bb246867d5b245b24ab9)

The following 6 files have been seen to comunicate with cdn.mediafhsignslaboratory.com in live environments.

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.