home

pfs.ezdownloadpro.info

Rafael Leviev  (via a Proxy Registrant)

Domain Information

The domain pfs.ezdownloadpro.info is registered by proxy through Active Registrar, Inc. (R469-LRMS). Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter. The domain is associated with the publisher Rafael Leviev who is located in Shfela, Israel.
Registrar:
Active Registrar, Inc. (R469-LRMS)

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
ezdownloadpro.info

Whois:
1 ezdownloadpro.info record

Google Safe Browsing:
unwanted

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Bundler.WebPick, Threat.Win.Reputation.IMP
100.00%

Dr.Web
Trojan.DownLoader12.34388
50.00%

Emsisoft Anti-Malware
Gen:Variant.Adware.Mikey.8516
50.00%

Lavasoft Ad-Aware
Gen:Variant.Adware.Mikey.8516
50.00%

McAfee
Trojan.PWS-Zbot.gen.ep
50.00%

Sophos
PUA 'MultiPlug' (of type Adware)
50.00%

MicroWorld eScan
Gen:Variant.Adware.Mikey.8516
50.00%

Malwarebytes
PUP.Optional.Unizeto
50.00%

K7 AntiVirus
Unwanted-Program
50.00%

Bitdefender
Gen:Variant.Adware.Mikey.8516
50.00%

NANO AntiVirus
Riskware.Win32.MultiPlug.doojhs
50.00%

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
50.00%

Avira AntiVirus
PUA/MultiPlug.11245, ADWARE/MultiPlug.Gen
50.00%

G Data
Gen:Variant.Adware.Mikey.8516
50.00%

AhnLab V3 Security
PUP/Win32.MultiPlug
50.00%

The domain pfs.ezdownloadpro.info has been seen to resolve to the following 3 IP addresses.

185.53.177.6
July 5, 2016

54.149.241.47
ec2-54-149-241-47.us-west-2.compute.amazonaws.com
May 5, 2015

54.69.228.231
ec2-54-69-228-231.us-west-2.compute.amazonaws.com
May 5, 2015

File downloads found at URLs served by pfs.ezdownloadpro.info.

1 / 68      (Malware)
http://pfs.ezdownloadpro.info/hp/?q=vri6sIwqoKhxb xztvg7lx0j8n51e9IbdcZohb6oGkb4em2KcwYztNB6adWQfunsPsRwtLEzmPCVYQhsDMUHhVudELp qK4nSIfsK9HR2GCytiz9ZeQw/1F1BLGSV5rViG7ZLL2xapONbDZoci3VPrA0EjeR n/ptq82qbupK0qWUYepW4PNugMJAqFjbtPXVu0QBCYDv9CmzMucqvXA6rPOfWxKzOmY2YcRvjYz80B1PWTWcgJi3vgEBz4PiiirIJn8a/8WmeTldmXkyNN44lU4TFwnJsK7UFXwwC8dsQYzjFcwN9nUEJm/U1VW3s9HnO3u0goGFhep923n3vlvJhxKPAPU2azh/3dRfc /2wDIIgU cwRDWy PdNTvmg3w9HRRzDB3/w50RwC1C/8TxpvfkSX2Rnd8Gx7SMBE6LQQGVuuBkV6W00P4CiRHigynVOUfPdc23mJX09CFcry5Lvh3yCboPyVwKP2QK7ssweSuIxJlKP7rSOwnDemSyT2jjrKhD/I11OUV6vlEbvlwjYYsZh30Lt7mitepwslhXzVuVbnIvGJlGSvGsqRixaeCQX6BjkB0aT jyyIoIXxQr1iKmQ9tH qJ rJ/.../JFrIbRUkZXqCO7I 2OD0eOHsMfL efcx6ASYy4txVTWPopFJQRWoWeLrjEEe4OIicCixZ99SsUF8E01WKTEjfhjyVEtXsQQGx1f&external_id=1425151336923810673&uuid=oSoFomFpYjIUZfa7wUZfb55J6ht1PZjyARXE7F0uc04Aec0MJgU4NgAXgIhNmCD7ctt3XuFNSI3RFEMrXns67x1gBxjt65WronevKrKs0KXJ1Z7oP6Ea8kg5u1yzXUbCOU1std1iDGcYHGACA1bo6uHf7tMQ1eQbVo6EpFOgQLJA5v6eXFRUh7Clj  (unnamed.mp3.exe)

1 / 68      (Malware)
http://pfs.ezdownloadpro.info/hp/?q=q3zaKm28dBIMTWYSUMFtdXKAqp/3co03fU3myiBf2UoYR4QqmUFv/kUDmJqZ2GRDfYLjIK233n7DGN9ZnVGVgyUKEVn9OvZZjl8S1WlIcljJl05b411WT8g6vi uJIykVwUr/WySV7IMUSjfl2 DBt37Nj3AykCTyts d90MjrwvXv9VFBOVBkfMx30wrHu 0vf/BPS1X/MFREa5mJJuzkBOM7br0TqHRo1CSzlnoGN9BQlbI/f/9reE6mcPy1BgBvPcdXlLMDeBEc1Mwfwg zMVT/ZprvcAViRnSpHQ CXGSflKAzwm4Y7oH9QTsB3 nhEiHGd819KSEMzRuZFAmOS0nYAM2hxZvX5HU SR9WQWEKXBVA1mrqtbRmsVTktiCve3Jol1f1L7hkTVszboCEojhxLEBtIf9BV8cSIVYQrkoTusKD4zeW86lxkpaISN4UfCYsKSGKJSD4CbX1ste35Y7rQfrgMJBWAnrIbQDlBqiOM 0u63eYokXfdwZIdU95HgMQ0wPjZ8mAfQ nMhfQxxnAbbejCKETTU2UeW3zi LUGvU nMmiG1suD30azlUYuT 7TvECPbnwVqjxOEcZx4/z7oVFPCMY3LAHYlAcE8VG236EER6HCgg5EJnKJHPnePvXesLsgp2vCDxYAT5QOO0Q0QMQxq84U95 mMZa8j0I7SPFUv5/fD5/N4SI9b91n86Lc/iz3Pfdb utkpbpjYMzxKP1PFWkJ9gJnidpEMl4PQ1aorA0lgOTubZremU8bAvPyfyT14TdU obgXOuNxCpsQzaO5uKbcnGbigBMtmqGsXEQBFTwrTdf7Vg0eoYpwBauyBy9dR65W6u9sPBzKVxH8K/.../gA4HXQ8q4UrXMm0tIqB2vLekkUYZt7ektlWHS1ItNUzVmaiMPKyF49xmViQT3wCRXsQm1wD  (happy birthday, mickey mouse style!.mp3.exe)

24 / 68    (PUP)
http://pfs.ezdownloadpro.info/hp/?q=paPur3Fy13hRJsfZTVehV2Au1J5DrjxcXGnzPaGQbRUrOZBNmFu3q5z57zWuYEXQNOkw1AC8XVskosByO663ycO26Wg0HZQbT7 4pmRQN7HjOftBPeSD41uIIiLL8KfWxjY1bWmY0Aw5T7mzCE48pgqHcKgAAYKsKbmU5wnhXcl0Clwz8aDG8QqP4fo6zgKt9Qunp5QCbVd5STeL5hDeJKWQmsxiaiuyPJuQ0v87HZRamSzWZ2JG36tmH5R2NczTu4xFfdUqobyqP 6mzQGYGy0SPXb3H1M46Gu9jUM8JWJRBGAjGaQi/6KPnFLjXrHyxaoCsJDp8wl4He5zCT9eIutUa 9Yf V62efRrsnj7OKw6Vx6 mphM23dP9EyfICCuhEhcqbGVgO7q0KmiV0Slzv1JSrGf/lY3XKuYqell873GN/ULWbFY uNptdJmGKLJNUx11ypJ eT /.../YO&uuid=YLOlBxsb0ILJ664wMkWaYGIqI4Hj97I5lNrURUysRjw1j1td8PWZT1uRPQXa0otZaZO2yXphQAZXqhjcLhhac8Pu3mnu9qt0FxGXCU1pD38yJ0TzYl21VpcxxD7FwyprvadgxrCFLESJTjEsHY5hfV6ZwOy7E4wGeQS5LwtFeuLoQH8BVDWjMvySjZQnt2nX5ioAnhvBR49Ngy4rZRvJoFC6fDFogglhB6RIwqQOJdeFkSz5jVSrIzBxU8ZUdadz85Jnk6OrgAGa4PufgAVHrhcrJxy1q2t0M9n3VAZYbflJ0dSlFNMgAkhsd4UuVy46BRhGpcU4rS5st9TaqtisWmVMOw4fQo5Px8rkm1AsHUlDLcm5oYbkKAs75yYg2PCyI7hLxrF6gXdzqG3V8Rd3nOON  (sia elastic heart (karaoke_instrumental).mp3.exe)

24 / 68    (PUP)
http://pfs.ezdownloadpro.info/hp/?q=UCFigTfC2lfZ2vqomj3NoVsFPEi1J3mTvStVvaqmFJxk7JtT2Ljv4ic4otWjF/mC8258K9f6LvJEhRZ0jOjtMxYzCWqZHf2hgHGshEjZAxO9N4k/4o3ycoPJYjFsasLOrGK2Og7FTh5/m4xA4Iej113U6ivv5NmDeCuKwklIq4nOVODpI/rVtZZ7zJhaktl5k1R5cNmRCSXqIJsBhpOdKc4pz1wqV 19ESwaMASLJIGlZw7DjlkWVY /8uloGIE2h5uTu5hUDhMtg2QI/AQLb8Qa4b22KQ2Tvxaw c8oj8ylcqIPsfEO3g/LxlVsEry6jevVPFntn3CUuzirsxQcF HbR4QQHhl/GavH/Sp YQYWviZZdmbYMF IIHLzjNfLGNQI TGIgCCZyaowbfzdqbO8T/VKUVyZ3 A4RVElfkKSQ5ZFv5XaQfgiP1p71Nibgcdh8orALiTvqqEQoTNmTrljTuVat9FpYlad1BkqjpCqSM 3bGdBOpXyNT3M9lILTo/ogs9iQ4Ct 3y9ycvIKxtTlbjxEa25s 3MzfmbImRAfnPWHH9k/QOitDrCoRTks 0VK1JZsh26c6HyvOuGown92kVl6O9U1W5JlN2Zu6/kgxkgjdacS933VQHIDqEipyXzWq0QjqaMe/.../dPMCxcFEgrArAzEnNHlJTGn7q5FghvE7mveZzNA SJTReC f46PzXy9 GRMPkWFJtnxVu7Q3jCYDDlQ4R svsRuXgPkuVcHJl9v4a7NZwM 3uEGM1nj9EUBteQcODjO4P41eP73k1A4oShwNC Jkommxlt5djOopLOfrKdxO5QOelU  (sia elastic heart (karaoke_instrumental).mp3.exe)

23 / 68    (Adware)
http://pfs.ezdownloadpro.info/v3458?installer_file_name=Crack and Setup  (crack and setup.exe)

The following 3 files have been seen to comunicate with pfs.ezdownloadpro.info in live environments.

TCP » 54.149.241.47:80
papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80
installer_game develop.exe

TCP » 54.69.228.231:80
download.exe

URL:
http://pfs.ezdownloadpro.info/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.