» sandrasoft.com
Overview
Analysis
IPs Addresses (2)
Downloads (29)
Network (4)
Website Detail
Related Domains (28)

sandrasoft.com

Ivan Zaycev

Domain Information

The domain sandrasoft.com registered by Ivan Zaycev was initially registered in June of 2014 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Scottsdale, Arizona within the United States which resides on the GoDaddy.com, LLC network.

Registrant:

Ivan Zaycev

Registrar:

GODADDY.COM, LLC

Server location:

Arizona, United States (US)

Create date:

Tuesday, June 24, 2014

Expires date:

Wednesday, June 24, 2015

Updated date:

Wednesday, October 15, 2014

ASN:

AS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC

Whois:

2 sandrasoft.com records

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Installer.InformationTechnologySystems.R, PUP.Installer.InformationTechnologySystems.Y, PUP.installCore.InformationTechnologySystems.Installer (M), PUP.installCore.Informat.Installer (M), PUP.installCore (M)

96.55%

Malwarebytes

PUP.Optional.Downloader, Trojan.Downloader

44.83%

Avira AntiVirus

ADWARE/InstallCore.Gen9, Adware/InstallCore.QH.3

44.83%

Dr.Web

Trojan.Packed.28409

44.83%

AVG

Generic

44.83%

VIPRE Antivirus

Threat.4150696

44.83%

ESET NOD32

Win32/InstallCore.PX potentially unwanted application

41.38%

K7 AntiVirus

Trojan

41.38%

SUPERAntiSpyware

PUP.InstallCore/Variant

41.38%

F-Prot

W32/InstallCore.AC.gen

41.38%

McAfee

Trojan.Artemis!460ECEB35134

41.38%

Clam AntiVirus

Win.Trojan.Installcore-231

34.48%

NANO AntiVirus

Riskware.Win32.InstallCore.dfgmcg, Riskware.Win32.InstallCore.dfgmnf

31.03%

Vba32 AntiVirus

Malware-Cryptor.InstallCore.gen

31.03%

Sophos

Install Core Click run software, PUA 'Install Core Click run software'

31.03%

The domain sandrasoft.com has been seen to resolve to the following 2 IP addresses.

50.63.202.47

ip-50-63-202-47.ip.secureserver.net

December 28, 2014

207.244.85.71

August 23, 2014

File downloads found at URLs served by sandrasoft.com.

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=11359798281408434496&pubid=307190&c=7d7258a2446c06802a081e7e76e61057&v_id=e7f26077159c06681807ddb730257a43 (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=15123588651408405150&pubid=57521&c=7d7258a2446c06802a081e7e76e61057&v_id=ca6ce05ffe746fcd296f4f28044bb532 (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=11241890211408385404&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=e5f6642abbba01e4f1d822ddaf9f551b (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=11409454651408408703&pubid=307190&c=7d7258a2446c06802a081e7e76e61057&v_id=385bb05d8e41ec3c2d26e758cd3fb113 (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=10968123611408394651&pubid=310486&c=7d7258a2446c06802a081e7e76e61057&v_id=f32ff07c0a5b27d0fdc081367ca0a6c8 (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=29263272921408387811&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=2533c2006a7b5579abc99299ad4ca79b (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=11632274971408398644&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=fe9d277245ad02e3b037034b0c88ae76 (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=4059613611408378604&pubid=207787&c=7d7258a2446c06802a081e7e76e61057&v_id=dbfe799a17379c95b6422de3f20a3e1f (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=11334210791408384829&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=947dd0bfafaae181c8e7845b34d2437d (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=18119524041408398349&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=dc06fd47a6bb851926fab30df0df1965 (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=11462503421408387076&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=9601953d8acfb639bac8b7960fa05d58 (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=352106661408404490&pubid=300622&c=7d7258a2446c06802a081e7e76e61057&v_id=108ff6479bdda55c9f4d3de9e2a870a1 (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=15230103461408393806&pubid=269682&c=7d7258a2446c06802a081e7e76e61057&v_id=8852fc290865c7ef60443896fe9fcbe2 (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=29228031881408376601&pubid=231699&c=7d7258a2446c06802a081e7e76e61057&v_id=98b563670c8dd8d0dea930a54ba4d839 (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=482189841408389263&pubid=50726&c=7d7258a2446c06802a081e7e76e61057&v_id=fcefd0ec321a775bf9e5049ffdc01424 (adobe_flash_setup.exe)

1 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=30934746921408385676&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=e5a9e47c09aafbdb54a597b1e229c3de (adobe_flash_setup.exe)

18 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=18250236451408387837&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=2533c2006a7b5579abc99299ad4ca79b (adobe_flash_setup.exe)

18 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=11363554631408397312&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=58436512eaff2c432687c1f41f21f591 (adobe_flash_setup.exe)

18 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=4186227081408400653&pubid=307190&c=7d7258a2446c06802a081e7e76e61057&v_id=579599ee036a30be3d3dc0527e1a6762 (adobe_flash_setup.exe)

18 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=11293589191408398534&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=fe9d277245ad02e3b037034b0c88ae76 (adobe_flash_setup.exe)

18 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=12569915241408398977&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=0479ff2e51c0115cd73a9e13fe5c2990 (adobe_flash_setup.exe)

18 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=8553121291408411589&pubid=231699&c=7d7258a2446c06802a081e7e76e61057&v_id=c28eb3a8299f36953717ef350d5b17da (adobe_flash_setup.exe)

18 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=36358341371408397414&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=c3c56e7ccca30f668b3f4d3528b865c5 (adobe_flash_setup.exe)

19 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=29161981871408396798&pubid=276966&c=7d7258a2446c06802a081e7e76e61057&v_id=01a1e37359a4a11098775071595f7e69 (adobe_flash_setup.exe)

15 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=35069233141408383120&pubid=307190&c=7d7258a2446c06802a081e7e76e61057&v_id=c36facf10483cf82c80dd9b736ea366c (adobe_flash_setup.exe)

13 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=29141338761408391184&pubid=36910&c=7d7258a2446c06802a081e7e76e61057&v_id=c7d39f9edf04784e33b10e19375cb2b5 (adobe_flash_setup.exe)

12 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=11&lp_id=42&v=ico&dist_id=141&channel=achrfb141&src=ac&cid=15243418551408374036&pubid=310486&c=4e1adde7fd3a3b7377adf68cde1d3ac7&v_id=b7d52e54a0526785d993638418387a7c (facebook_messenger_setup.exe)

8 / 68 (Adware)

http://sandrasoft.com/.../download.php?site_id=230&app_id=4&lp_id=327&v=ico&dist_id=125&channel=acpopf100&src=ac&cid=34723741471408394414&pubid=274944&c=7d7258a2446c06802a081e7e76e61057&v_id=63fe79b730b244bc31278a47d83b4512 (adobe_flash_setup.exe)

10 / 68 (Adware)

The following 4 files have been seen to comunicate with sandrasoft.com in live environments.

TCP » 50.63.202.47:80

online-guardian-v2.0.9.exe

TCP » 50.63.202.47:80

online-guardian-v2.0.9.exe

TCP » 50.63.202.47:25

wrk.exe

TCP » 50.63.202.47:80

produpd.exe (produpd.exe by Vested Development, Inc)

URL:

http://sandrasoft.com/

Title:

“sandrasoft.com”

Web server:

Microsoft-IIS/7.5 (ASP.NET) (Version: 4.0.30319)

Related Domains

1clickmoviedownloader.com

blue1211.info

cancellationfinder.co.uk

downloadserver518.com

videodownloadstudio.com

wqdl3.org

zfiramnel.info

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.