home

get.file23desktop.com

OutBrowse

Domain Information

The domain get.file23desktop.com registered by OutBrowse was initially registered in May of 2014 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
GODADDY.COM, LLC

Server location:
Virginia, United States (US)

Create date:
Sunday, May 25, 2014

Expires date:
Wednesday, May 25, 2016

Updated date:
Tuesday, June 16, 2015

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:
file23desktop.com

Whois:
2 file23desktop.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.BonDonJOV, PUP.Outbrowse, PUP.Bundler.Outbrowse, Threat.Outbrowse.Bundler, PUP.Outbrowse.SafeDownloadGTL.Bundler (M), PUP.Outbrowse.AppsmarketABC.Bundler (M), PUP.Outbrowse.TrustedDownloadTyy.Bundler (M), PUP.Outbrowse.GlobalAp.Bundler (M), PUP.Outbrowse.safeclic.Bundler (M), PUP.Outbrowse.Bundler (M), PUP.Outbrowse.SafeDown.Bundler (M), PUP.Outbrowse.Appsmark.Bundler (M), PUP.Outbrowse (M)
100.00%

ESET NOD32
Win32/OutBrowse.BR potentially unwanted application, Win32/OutBrowse.BS potentially unwanted application, Win32/OutBrowse.BU potentially unwanted application
31.58%

K7 AntiVirus
Trojan , DoS-Trojan
31.58%

Fortinet FortiGate
Riskware/OutBrowse
31.58%

AVG
Downloader, Potentially harmful program Downloader.DIT, Potentially harmful program Downloader.DJD
31.58%

Dr.Web
infected with Trojan.OutBrowse.60, infected with Trojan.OutBrowse.89, infected with Trojan.OutBrowse.100, Trojan.OutBrowse.312
26.32%

Malwarebytes
PUP.Optional.OutBrowse, PUP.Optional.OutBrowse.gen
26.32%

NANO AntiVirus
Trojan.Win32.OutBrowse.dmihux, Trojan.Win32.OutBrowse.dmikim, Riskware.Win32.OutBrowse.dorbak
26.32%

Agnitum Outpost
PUA.OutBrowse
26.32%

Avira AntiVirus
APPL/Downloader.Gen
26.32%

Trend Micro House Call
Suspici.2AB55E13, Suspici.B4D1CBB0
26.32%

VIPRE Antivirus
Threat.4657539, Threat.4150696, Threat.5085447
21.05%

avast!
OutBrowse-AY [PUP], Rootkit-gen [Rtk], OutBrowse-GM [PUP], OutBrowse-IR [PUP]
21.05%

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.Outbrowse, Application.Bundler.Outbrowse.BA
21.05%

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.Outbrowse.1
21.05%

The domain get.file23desktop.com has been seen to resolve to the following 11 IP addresses.

54.175.102.143
ec2-54-175-102-143.compute-1.amazonaws.com
May 18, 2016

204.236.219.53
ec2-204-236-219-53.compute-1.amazonaws.com
April 4, 2016

23.21.196.192
ec2-23-21-196-192.compute-1.amazonaws.com
January 27, 2016

50.17.254.254
ec2-50-17-254-254.compute-1.amazonaws.com
January 27, 2016

50.17.193.226
ec2-50-17-193-226.compute-1.amazonaws.com
December 23, 2015

184.73.196.210
ec2-184-73-196-210.compute-1.amazonaws.com
December 23, 2015

54.221.222.214
ec2-54-221-222-214.compute-1.amazonaws.com
December 23, 2015

23.21.52.184
ec2-23-21-52-184.compute-1.amazonaws.com
May 15, 2015

54.243.193.107
ec2-54-243-193-107.compute-1.amazonaws.com
May 6, 2015

23.23.223.111
ec2-23-23-223-111.compute-1.amazonaws.com
May 4, 2015

54.196.192.2
ec2-54-196-192-2.compute-1.amazonaws.com
February 16, 2015

File downloads found at URLs served by get.file23desktop.com.

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=Downloader&dynamicname=Downloader&filename=Downloader&d1=3310000&d2=3&d3=1&  (downloader.exe)

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=cities xl 2012 tpb&dynamicname=cities xl 2012 tpb&filename=cities xl 2012 tpb&d1=1405000&d2=0&d3=1&  (cities xl 2012 tpb.exe)

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=fosroc crack filler&dynamicname=fosroc crack filler&filename=fosroc crack filler&d1=1405000&d2=1&d3=1&  (fosroc crack filler.exe)

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?baidusign=14911413&baidurand=14570  (installation.exe)

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=the sims 3 into the future crack&dynamicname=the sims 3 into the future crack&filename=the sims 3 into the future crack&d1=1405000&d2=4&d3=1&  (the sims 3 into the future crack.exe)

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=gta san andreas extreme for pc&dynamicname=gta san andreas extreme for pc&filename=gta san andreas extreme for pc&d1=1405000&d2=0&d3=1&  (gta san andreas extreme for pc.exe)

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=ufc undisputed 3 keygen razor1911&dynamicname=ufc undisputed 3 keygen razor1911&filename=ufc undisputed 3 keygen razor1911&d1=1405000&d2=0&d3=1&  (ufc undisputed 3 keygen razor1911.exe)

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=excel 2010 password recovery&dynamicname=excel 2010 password recovery&filename=excel 2010 password recovery&d1=1405000&d2=1&d3=1&  (excel 2010 password recovery.exe)

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=IDM.rar&dynamicname=IDM.rar&filename=IDM.rar&d1=1900000&d2=0&d3=1&  (idm.rar.exe)

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=fix.rar&dynamicname=fix.rar&filename=fix.rar&d1=1900000&d2=0&d3=1&  (fix.rar.exe)

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=marvel super heroes pc&dynamicname=marvel super heroes pc&filename=marvel super heroes pc&d1=1405000&d2=1&d3=1&  (marvel super heroes pc.exe)

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=multiman eboot fix 3.55&dynamicname=multiman eboot fix 3.55&filename=multiman eboot fix 3.55&d1=1405000&d2=0&d3=1&  (multiman eboot fix 3.55.exe)

1 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=united healthcare prior authorizati ...&dynamicname=united healthcare prior authorizati ...&filename=united healthcare prior authorizati ...&d1=1405000&d2=4&d3=1&  (united healthcare prior authorizati....exe)

25 / 68    (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=Xbox 360 firmware upgrade xtreme 5. ...&dynamicname=Xbox 360 firmware upgrade xtreme 5. ...&d1=3180000&d2=1&d3=1&filename=Xbox 360 firmware upgrade xtreme 5. ...  (xbox 360 firmware upgrade xtreme 5....icon=2.exe)

27 / 68    (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=chronicles of albian game&dynamicname=chronicles of albian game&filename=chronicles of albian game&d1=1405000&d2=1&d3=1&  (chronicles of albian game.exe)

13 / 68    (Adware)
http://get.file23desktop.com/.../Get?p=13265&d=18970&l=18129&n=1&productname=Fire Red V1.0 Usa For Pokemmo&dynamicname=Fire Red V1.0 Usa For Pokemmo&filename=Fire Red V1.0 Usa For Pokemmo&d1=22  (fire red v1.0 usa for pokemmo.exe)

23 / 68    (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=motorola razr xt910 mode&dynamicname=motorola razr xt910 mode&filename=motorola razr xt910 mode&d1=1405000&d2=4&d3=1&  (motorola razr xt910 mode.exe)

18 / 68    (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=keyword researcher 6.0 crack&dynamicname=keyword researcher 6.0 crack&filename=keyword researcher 6.0 crack&d1=1405000&d2=4&d3=1&  (keyword researcher 6.0 crack.exe)

9 / 68      (Adware)
http://get.file23desktop.com/.../Get?p=5654&d=8701&l=8181&n=1&productname=MiniGetSmartDownloader&d1=1405000&d2=0&d3=1&filename=elite proxy switcher pro crack  (elite proxy switcher pro crackicon=2.exe)

The following file have been seen to comunicate with get.file23desktop.com in live environments.

TCP » 54.196.192.2:80
ContentExplorer.exe (ContentExplorer)

URL:
http://get.file23desktop.com/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
Microsoft-IIS/8.0 (ASP.NET) (Version: 4.0.30319)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.