» d3d6wi7c7pa6m0.cloudfront.net
Overview
Analysis
IPs Addresses (8)
Downloads (81)
Network (14)

d3d6wi7c7pa6m0.cloudfront.net

Amazon.com, Inc

Domain Information

The domain d3d6wi7c7pa6m0.cloudfront.net registered by Amazon.com, Inc was initially registered in April of 2008 through MARKMONITOR INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).

Registrant:

Amazon.com, Inc

Registrar:

MARKMONITOR INC.

Server location:

Virginia, United States (US)

Create date:

Friday, April 25, 2008

Expires date:

Tuesday, April 25, 2017

Updated date:

Tuesday, February 25, 2014

Root domain:

cloudfront.net

Whois:

2 cloudfront.net records

Scanner detections:

Detections (77% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.VisualTools.H, Threat.Win.Reputation.IMP, PUP.DealPly.C, PUP.Optional.Installer.JDIBACKUPLIMITED.AA, PUP.Installer.SearchResults.H, PUP.Optional.VisualSoftwareSystems.P, PUP.QuickShare.L, PUP.Uniblue.Optional.Installer.Meta (L), PUP.WinThruster.SolvusoftCorporation.Installer.Meta (L), PUP.SavepathDeals.Installer (M), PUP.ELEX.SkytouchTechnologyCo (M), PUP.BanyanTreeTechnology (M), PUP.50OnRed.SmartApp.Installer (M), PUP.Linkular.Installer (M)

78.57%

Dr.Web

Adware.Babylon.10, Adware.Downware.1292, Adware.Shopper.348, Adware.Plugin.48, Adware.Downware.1460, Adware.Searcher.2593, Adware.Downware.1254, Adware.Downware.1605

50.00%

VIPRE Antivirus

Amonetize, Adware.DealPly, Iminent, Wajam, Trojan.Win32.Generic, SearchDonkey, Trojan.Win32.Generic!SB.0, Adware.Linkury

45.24%

Trend Micro House Call

TROJ_GEN.R0C1H0AHS13, ADW_DEALPLY, TROJ_GEN.R047H01HF13, TROJ_GEN.R0C1H0AIC13, TROJ_GEN.F47V1104, TROJ_GEN.R0CBB04KP13, TROJ_GEN.F47V1213, TROJ_GEN.F47V0819, TROJ_GEN.R0CCH01GR13, TROJ_GEN.F47V1017

40.48%

Malwarebytes

PUP.Optional.Babylon.A, PUP.Optional.DealPly.A, PUP.Optional.DefaultTab.A, PUP.Optional.Iminent.A, Trojan.Downloader.Agent, PUP.Optional.SpringSmart.A, PUP.Optional.Linkury.A

38.10%

ESET NOD32

Win32/Toolbar.Babylon (variant), Win32/Amonetize (variant), Win32/Toolbar.DefaultTab (variant), Win32/Wajam, Win32/AdWare.Vitruvian (variant), Win32/SlowPCfighter (variant)

35.71%

Bkav FE

W32.Clod96b.Trojan, W32.Clod69d.Trojan, W32.Clod091.Trojan, W32.Clod19d.Trojan, W32.Clodb15.Trojan, W32.Clod5a6.Trojan, W32.Clod8e9.Trojan, W32.Clod958.Trojan, W32.Clod420.Trojan, HW32.Packed, W32.Clod9d9.Trojan

33.33%

McAfee

RDN/Generic.bfr!ey, Artemis!F9CD7F14B752, Artemis!B2D361D6CCFC, Generic Downloader.z, Artemis!6FF831FB695D, RDN/Generic Downloader.x!iu, RDN/Generic.dx!czh

30.95%

NANO AntiVirus

Trojan.Win32.Babylon.csuksh, Trojan.Win32.Downware.buwuxz, Trojan.Win32.Plugin.crfhgu, Trojan.Win32.Searcher.cjaztx, Trojan.Win32.Plugin.csnynj

23.81%

Baidu Antivirus

Adware.Win32.Bbylon, Trojan.Win32.Agent, HackTool.Win32.Conduit, Adware.Win32.Toolbar, Adware.Win32.Agent, HackTool.Win32.Downloader

23.81%

G Data

Trojan.Generic.9951306, Adware.DealPly, Trojan.GenericKD.1202862, Win32.Trojan.Agent.0KYIWF, Adware.AdPage, Trojan.Generic.9887550

23.81%

Comodo Security

Application.Win32.Babylon.ac, UnclassifiedMalware, Application.Win32.DealPly.~BHU, ApplicUnwnt, Heur.Suspicious

21.43%

MicroWorld eScan

Trojan.Generic.9951306, Adware.DealPly.G, Trojan.GenericKD.1202862, Adware.AdPage.A, Trojan.Generic.9887550, Trojan.Generic.9244014

21.43%

Bitdefender

Trojan.Generic.9951306, Adware.DealPly.G, Trojan.GenericKD.1202862, Adware.AdPage.A, Trojan.Generic.9887550, Trojan.Generic.9244014

21.43%

K7 AntiVirus

Trojan , Unwanted-Program , Riskware , Adware

21.43%

The domain d3d6wi7c7pa6m0.cloudfront.net has been seen to resolve to the following 8 IP addresses.

205.251.251.61

server-205-251-251-61.jfk5.r.cloudfront.net

August 9, 2013

205.251.251.198

server-205-251-251-198.jfk5.r.cloudfront.net

August 9, 2013

54.230.51.53

server-54-230-51-53.jfk5.r.cloudfront.net

August 9, 2013

54.230.48.53

server-54-230-48-53.jfk5.r.cloudfront.net

August 9, 2013

54.230.48.126

server-54-230-48-126.jfk5.r.cloudfront.net

August 9, 2013

54.230.50.11

server-54-230-50-11.jfk5.r.cloudfront.net

August 9, 2013

54.230.51.113

server-54-230-51-113.jfk5.r.cloudfront.net

August 9, 2013

54.230.48.75

server-54-230-48-75.jfk5.r.cloudfront.net

August 9, 2013

File downloads found at URLs served by d3d6wi7c7pa6m0.cloudfront.net.

1 / 68 (Malware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../checker_346742.exe (8cbe3fc9789b3cb0fce1f05c1cfa644d)

1 / 68

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../SMS.widget.exe (c7d94a975191597eece9dd7ed8641c08)

14 / 68 (PUP)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../SocPriv_adk6.exe (c0b6d3806767bcad4d912375ee2319dc)

10 / 68 (Adware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../DefaultTabSetup_20130731.exe (air18e9.exe)

1 / 68

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../zsnesw151.exe (f0546f6f291f4acca91b54ff6eb7f442)

4 / 68 (Adware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../WunderWeb_ad.exe (1b6cd7b6d5a46421ec82c48a404ec9cb)

1 / 68 (Adware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../Adknowledge.DoNotTrackMe.exe (811cfaff7cda61775bba21bc593f7f2c)

30 / 68 (PUP)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../AmonetizeCheckV3.exe (a1cefb4afd0344054c304c34f5b8ed6c)

30 / 68 (PUP)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../AmonetizeCheckV2.exe (b3ed2465833ee27c8de2399c654e05d1)

1 / 68 (Adware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../couponlocker_20131029.exe (347093cf6b2d90506246e88f0fa41c0c)

2 / 68 (PUP)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../forcause-ak.exe (browseforthecause.exe)

1 / 68 (Malware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../adks_ar_qone8_20131022.exe (0a66c1a490b4021c02e99f42ccedfb96)

9 / 68 (Adware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../Setup_20131030.exe (setup_us.exe)

0 / 68

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../InstagramDownloader_setup.exe (dbb7d14b1dc1b5a28b8bc6753ece7241)

1 / 68 (Adware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../adk_ar_2013613141719_qvo6.exe (624ea8df123a18a6ee13ecf0f819b66a)

0 / 68

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../monocalendar-0.7.2.win32.installer.exe (5d17e830728272fb30be4e6405538f10)

1 / 68 (PUP)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../Cloud_Backup_Setup_euro.exe (abf922e6338d1a7153829571d06311e1)

5 / 68 (PUP)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../ChromeSpeedUp_Installer.exe (e3a48b7af63c28ff7cc12f97686c5eb1)

9 / 68 (Adware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../ShoppingHelperToolbar1.exe (shoppinghelpertoolbar.exe)

5 / 68 (inconclusive)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../checker.exe (387404c481dd7a25060f8598f7e7eadb)

8 / 68 (PUP)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../IminentSetup_test_20132406.exe (IminentSetup.exe)

5 / 68 (Adware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../QuickShare1.exe (d8d8c7dd87477ceb13c7615e15fba6be)

0 / 68

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../AbiWord.exe (5d04d875f415062f8babd49656ff7d3a)

5 / 68 (Adware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../Installer_20131015.exe (25e4a25bd1ddb4409c429e760ce1013f)

1 / 68 (PUP)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../winthrustersetup_badkg.exe (580722b0fed85801c783fbc7c9173fc2)

8 / 68 (PUP)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../IminentSetup_test_20132406.exe (IminentSetup.exe)

1 / 68 (inconclusive)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../PC-FixSetup_partner1001701_1.6.76Full.exe (11f32488fb4973408d28ebfe097dcb37)

23 / 68 (Adware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../dp_20130624_test.exe (dp.exe)

22 / 68 (Adware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../sweetimsetup_20130620.exe (bundlesweetimsetup.exe)

1 / 68 (Adware)

http://d3d6wi7c7pa6m0.cloudfront.net/bundles/.../adks_do-search.exe (31f109f1d97697150f4247bbc55e4f6f)

Latest 30 of 81 download URLs

The following 14 files have been seen to comunicate with d3d6wi7c7pa6m0.cloudfront.net in live environments.

TCP » 54.230.51.113:80

UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.230.51.113:80

mine-craft-setup.exe

TCP » 54.230.51.113:80

yacqq.exe

TCP » 54.230.51.53:80

launcher.exe (by Launcher)

TCP » 54.230.51.113:80

yacqq.exe

TCP » 54.230.51.113:80

rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 54.230.51.53:80

WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.230.51.53:80

Trezaa.Service.exe (Trezaa.Service by Microsoft)

TCP » 54.230.51.113:80

Client.exe

TCP » 54.230.51.113:80

free_music_setup.exe

TCP » 54.230.51.113:80

yacqq.exe

TCP » 54.230.51.113:80

lbpcntatapole.exe

TCP » 54.230.51.113:80

apptrailers.exe

TCP » 54.230.51.53:80

gubepy.exe (Glary Utilities by Glarysoft)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.