home

files.download1click.ws

Domain Information

Server location:
California, United States (US)

ASN:
AS3561 SAVVIS - Savvis,US

Root domain:
download1click.ws

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Downloadnow.K, PUP.TerraFirmaInternetConsulting.O, PUP.OneClickDownloader (M)
100.00%

avast!
Win32:Oneclickdown-A [PUP], Win32:Downloader-UHI [PUP]
75.00%

Dr.Web
Adware.Downware.384, Adware.Downware.627
75.00%

Bkav FE
W32.Clod0ca.Trojan
25.00%

McAfee
Artemis!EF0855D8C18C
25.00%

NANO AntiVirus
Trojan.Win32.1ClickDownload.yqbuj
25.00%

ESET NOD32
Win32/Adware.1ClickDownload
25.00%

Fortinet FortiGate
Riskware/1ClickDownload
25.00%

AVG
AdInstaller.OneClickDownload
25.00%

Comodo Security
Application.Win32.Downware.G
25.00%

The domain files.download1click.ws has been seen to resolve to the following IP address.

64.70.19.202
mailrelay.202.website.ws
March 3, 2016

File downloads found at URLs served by files.download1click.ws.

9 / 68      (Adware)
http://files.download1click.ws/MainPackFA_2702.exe  (ocmainpack.exe)

3 / 68      (Adware)
http://files.download1click.ws/MainPackFA2703.exe  (b5cce86656f585c470bec347f6b9d782)

1 / 68      (PUP)
http://files.download1click.ws/MainPackFA2703.exe  (1clextsetup.exe)

4 / 68      (Adware)
http://files.download1click.ws/MainPackFA2703.exe  (116255f0adb5077a39fc5ee3f7d889b4)

The following file have been seen to comunicate with files.download1click.ws in live environments.

TCP » 64.70.19.202:80
dllhost.exe (COM Surrogate by Microsoft)

arabeam.ws

keygen-0day.ws

tradestore.ws

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.