» dl.ke8u.com
Overview
Analysis
IPs Addresses (7)
Downloads (30)
Network (32)
Website Detail
Related Domains (17)

dl.ke8u.com

xiao jie

Domain Information

The domain dl.ke8u.com registered by xiao jie was initially registered in July of 2014 through DOMAIN NAME NETWORK PTY LTD. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dongguan, Guangdong within China which resides on the Asia Pacific Network Information Centre network.

Registrant:

xiao jie

Registrar:

DOMAIN NAME NETWORK PTY LTD

Server location:

Guangdong, China (CN)

Create date:

Thursday, July 31, 2014

Expires date:

Monday, July 31, 2017

Updated date:

Thursday, January 8, 2015

ASN:

AS58543 CHINATELECOM-GUANGDONG-IDC Guangdong,CN

Root domain:

ke8u.com

Whois:

2 ke8u.com records

Google Safe Browsing:

unwanted

Scanner detections:

Detections (66% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Yantai (L), Adware.Downloader.YantaiZh.Installer.Meta (M), PUP.BeijingYuJinChengTechnologyCo.Installer (M)

47.83%

Clam AntiVirus

Win.Trojan.691128

39.13%

Fortinet FortiGate

Riskware/Generic.AC.18053, W32/Generic.AC.18053

34.78%

Dr.Web

Program.Unwanted.432, riskware program Program.Unwanted.1229, Adware.ShouQu.5, riskware program Program.Unwanted.432, Adware.ShouQu.5, Adware.ShouQu.22

34.78%

McAfee

Artemis!75CCA7BDF42A, Artemis!B0DCCCFBF21E, Artemis!DF3F315228C2, Artemis!4852A8AD1FB1, Artemis!A6AA6519CD72, Artemis!39353B5292EB

26.09%

avast!

Win32:Rootkit-gen [Rtk], Win32:Malware-gen, Win32:Evo-gen [Susp], Win32:Adware-gen [Adw]

26.09%

ESET NOD32

Win32/RiskWare.Yantai (variant), Win32/Baidu.C potentially unwanted, Win32/Packed.NSISmod.E suspicious (variant)

26.09%

IKARUS anti.virus

Win32.SuspectCrc, PUA.Generic

21.74%

AVG

Win32/DH, Generic

21.74%

ESET NOD32

Win32/Packed.NSISmod.E suspicious application, Win32/Adware.Xiaoxiong.A application, Win32/RiskWare.Yantai.A application

17.39%

Trend Micro House Call

Suspicious_GEN.F47V1115, Suspicious_GEN.F47V0123, Suspicious_GEN.F47V0603

13.04%

NANO AntiVirus

Riskware.Win32.ShouQu.dmnfjx

13.04%

Rising Antivirus

PE:Malware.Generic(Thunder)!1.A1C4 [F], PE:Malware.Generic/QRS!1.9E2D [F], Adware.NSISmod!1.A1E0

13.04%

F-Prot

W32/Yantai.A.gen, W32/Linkury.C.gen

8.70%

Zillya! Antivirus

Adware.Linkury.Win32.51430, Adware.ShouQuCRTD.Win32.150

8.70%

The domain dl.ke8u.com has been seen to resolve to the following 7 IP addresses.

May 16, 2016

May 16, 2016

May 16, 2016

July 1, 2015

May 3, 2015

November 10, 2014

November 10, 2014

File downloads found at URLs served by dl.ke8u.com.

4 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=358 (game_358wpr6.exe)

0 / 68

http://dl.ke8u.com/down.php?sid=358 (setup_196yqar.exe)

0 / 68

http://dl.ke8u.com/down.php?sid=358 (browser_v5.6.13381.207_r_4018_(build1606201920).exe)

5 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=358 (game_358e9y6.exe)

8 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=332 (â¸ãã§ã¥â°ã¦_417.exe)

0 / 68

http://dl.ke8u.com/down.php?sid=358 (setup_3787iw1.exe)

5 / 68 (inconclusive)

http://dl.ke8u.com/down.php?sid=358 (setup_493b8n1.exe)

1 / 68 (inconclusive)

http://dl.ke8u.com/down.php?sid=502 (setup_502.exe)

1 / 68 (inconclusive)

http://dl.ke8u.com/down.php?sid=358 (5590b2ba_1202000051.exe)

1 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=358 (game_358xcwd.exe)

1 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=358 (setup_52685sw.exe)

0 / 68

http://dl.ke8u.com/down.php?sid=358 (game_358vhy4.exe)

7 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=358 (setup_524xyvf.exe)

1 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=333 (setup_333.exe)

3 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=332 (setup_332.exe)

3 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=358 (game_358.exe)

0 / 68

http://dl.ke8u.com/down.php?sid=358 (game_358rayh.exe)

3 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=358 (setup_541g8n0.exe)

1 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=358 (setup_547gpw2.exe)

2 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=562 (setup_5626u7q.exe)

5 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=358 (game_358mcnd.exe)

13 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=371 (setup_341.exe)

5 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=333 (game_358.exe)

3 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=332 (setup_332.exe)

0 / 68

http://dl.ke8u.com/down.php?sid=333 (browser_v3.2.2766.0_r_4018_(build14112117).exe)

6 / 68 (Malware)

http://dl.ke8u.com/down.php?sid=333 (f_004c44)

6 / 68 (Malware)

http://dl.ke8u.com/down.php?sid=332 (f_004c44)

6 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=331 (setup_331.exe)

3 / 68 (PUP)

http://dl.ke8u.com/down.php?sid=358 (高清版_412.exe)

4 / 68 (inconclusive)

http://dl.ke8u.com/down.php?sid=357 (setup_357.exe)

Latest 30 of 30 download URLs

The following 32 files have been seen to comunicate with dl.ke8u.com in live environments.

TCP » 113.105.146.91:80

jaojfpnikjjobngdfbgbhflfooidihmg.crx

TCP » 125.88.65.249:80

piao_5.2.0.50.crx

TCP » 125.88.65.249:80

piao.crx

TCP » 183.56.172.10:80

life_assistant.crx

TCP » 183.56.172.10:80

leidian.crx

TCP » 183.56.172.10:80

music.crx

TCP » 183.56.172.10:80

novel.crx

TCP » 183.56.172.10:80

life_assistant.crx

TCP » 183.56.172.10:80

leidian.crx

TCP » 183.56.172.10:80

shipin.crx

TCP » 183.56.172.10:80

music.crx

TCP » 183.56.172.10:80

novel.crx

TCP » 183.56.172.10:80

leidian.crx

TCP » 183.56.172.10:80

ejmoceoaphoacojefmkhmfbgkidaefdl.crx

TCP » 183.56.172.10:80

live_assist.crx

TCP » 183.56.172.229:80

piao_5.2.0.32.crx

TCP » 183.56.172.229:80

piao.crx

TCP » 183.56.172.229:80

piao.crx

TCP » 183.56.172.229:80

fqb.crx

TCP » 183.56.172.229:80

fvddownloader_2.1.1.crx

Latest 20 of 32 files

URL:

http://dl.ke8u.com/

Title:

“dl”

Web server:

nginx

Related Domains

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.