home

wfs.ezdownloadpro.info

Rafael Leviev

Domain Information

Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter. The domain is associated with the publisher Rafael Leviev who is located in Shfela, Israel.
Registrar:
1API GmbH

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
ezdownloadpro.info

Whois:
2 ezdownloadpro.info records

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

Dr.Web
Trojan.DownLoader12.35418
50.00%

Emsisoft Anti-Malware
Gen:Variant.Adware.Mikey.8516
50.00%

Lavasoft Ad-Aware
Gen:Variant.Adware.Mikey.8516
50.00%

ESET NOD32
Win32/Adware.MultiPlug.FK application
50.00%

F-Secure
Gen:Variant.Adware.Mikey
50.00%

McAfee
Trojan.PWS-Zbot.gen.ep
50.00%

Sophos
PUA 'MultiPlug' (of type Adware)
50.00%

MicroWorld eScan
Gen:Variant.Adware.Mikey.8516
50.00%

Malwarebytes
PUP.Optional.Unizeto
50.00%

Zillya! Antivirus
Adware.MultiPlug.Win32.225864
50.00%

K7 AntiVirus
Unwanted-Program
50.00%

NANO AntiVirus
Riskware.Win32.MultiPlug.dorspi
50.00%

F-Prot
W32/MultiPlug.H.gen
50.00%

Bitdefender
Gen:Variant.Adware.Mikey.8516
50.00%

The domain wfs.ezdownloadpro.info has been seen to resolve to the following 3 IP addresses.

185.53.177.10
April 21, 2016

54.149.241.47
ec2-54-149-241-47.us-west-2.compute.amazonaws.com
May 5, 2015

54.69.228.231
ec2-54-69-228-231.us-west-2.compute.amazonaws.com
May 5, 2015

File downloads found at URLs served by wfs.ezdownloadpro.info.

1 / 68      (Malware)
http://wfs.ezdownloadpro.info/hp/?q=ngbWS3i4a4jRdBCDWYRLqn yMwNM1c40WkSPVaI 31QBzCIjpn4BLoOiwR3fUGlWso5FzUnc3j Dfl8iQwRYvonFgj93cnLx4B1xafZOrtK3ZA5x3xocATKNeMhCD80Am N/47iF/qhfawq L2SRK/ I8kX65XcpmFHde 07aIX/gJuaFsg37/Mzi43U/PAUpsjvdm 3ILzw9r1038gfywtR4BgJjBQJxnR393zw8ucvsko3VvHRJ3tsc7ok/p5BfpLRBv520ZP8i2jdSJALlySO/P yVFKbFFqQApHGSOlDeGKIP1bfrUqZM2TumCojflBdPmvxxK6JrIe1DpLNaTHyCjooXfz 5kBo96RDQ92L6YT3oy13iQgxa6KAlpW304NGK6 cYmsdCyRkDB8xgPDNIb7ZKcTQnSvEcHddh/dhcOtJ5WLMJBBI6Dc4u/EYYuthbompUjLwmVMPvwREYtkrZWx5eRokCvawYgX3Exf9gcrfqb7A7mBMd8WFqYHMl3fVnCh69rhfRm5QN0rXmIA sshMd3q QKWiCHq5uqxKnNWim8DJ7sO2sUm9ghrA8S5GqTWSAKIFSRfuXTA5 CS4NDdd9ca5x0MuVZ5QSfg2AiMEImR6rGdPj9TmfuQYWypyuNgxGuZlhQB1AVA1OgICGsADn4s187v5L55QSfgcY5/cStloHVEUNwEV8u3O6mG6/R3e8nTKqCrnX2pWy8Mc7rFQivBV8Zrb4kpfDhbgcLSgMVfbYgHJigWlCJ6XaIWAkzi4UNN4Eomm1T1568ILKmxYD4Zg2LS n9cjbjFsBA2YXPqtC4TK3XN0LOb7sfcX4z5/ iTsP6MJk1sxjxPmzicbdN2oFigM2C2K6jSr4EjsnUvKQOtUHDrEP1hd5C2CQ6StA3OfflBd8mhkDK//.../7  (download game cooking academy 3 full version gratis _ info dedik.exe)

23 / 68    (PUP)
http://wfs.ezdownloadpro.info/hp/?q=x6/L4TVFHDRajPZ5wyOsmMcLzCYYxXrsmMl9lc0ftc5a3ucCnQUJn7o6wMSm4YgzkTSdOZClr7X/ZsTtLbA7JMazF6gNgkMITZ8y6HG78zFU1GzUDWV1ZaQ0robVwrPBf2RZYOxedFlp7obuTmu9Qd6xX6bmEwfiEBJZNV6KweLfci2Jyf4NZjsv1KLKgdhWINu5jsUZBRzMmxXdKQL1nxBPhh9LBDEZ0iVicB0kmquCnOQkl84JSFAY85z9potoZNfkIamQ54HfGv2XDMgYjQ08n/UDuRM30Dmhvji lLcoF4Le yULDO7I5N3EpC24Q4JrRZeOlea/Ei1bE/.../ux4260uYsUM&uuid=sF4gONO9OK1hkNimTXX3LAvGItiARfW6ercta9j4faLdqEmLVHJAsb0gHzKfVIlGSJuICRzjZnuwadDAzRUUQqRSXTqIz9nGjAlvDCPEDvoKTqAKgP5Iym1pNkpka8xEhSuuwmkCgCI6vh2KvbE5ulglxDXDoZ1LtcUmasnLKLODKMYg0I7B2kx4ctPDBUwxCgaOrbZEnpNdSnRVYUppNffZpiwjcRxnCfESpd8xFLVg8S4YCdaPhcJrkHw2b6Z8kGvUm29HCiS75jvX3cULBBaMdIpiqSl8vOLhMovbvJwoA5fgb3FspeY5rMEXKS1waQK7gNdVxDEBpFDeNJ1nvJGDmdqM5cmGc8ZbmPMuVRgRoRXYolOu3oVs4mXzFxDVLBMF8wt0pkBPD2AWGUZLZJKWwgc  (global ship traffic seen from space.avi.exe)

23 / 68    (PUP)
http://wfs.ezdownloadpro.info/hp/?q=lXdSMS2fWIa1fPRJLFvosOcvfoYhw9ySN0gB6IxJE0la8clWUoUws8AUqOON4G19Kd1pqbhlnHKaz1k/CwZU/Y3uuNVQ 7lzKgB2ccdhQKeTZ9pN2BbbBtBpPflEv0g7klOEfYv6iKmXABM 48IbBt6SD0PndlCmoBGQ9DkoQ4onfSEBj59iJ3gx0TTceHcTupqMzQghQuhPHzU5kKsFIbBMbHMDtSRbb km9gDJ/p/wQG8dC/y7Z6Nwmx0cchQyH5dfnUpVxnEdiMmItwVEdRFPLpCRmz/oM35YtZVElF2hiQ3IvMLm6R5KU23eSfeIZQSjIiJuwJlvyOrBYJcswQmyQ7U1l0oh0glwSnFZpA00snevYRDbctCTQDBNYE1TfdqDvFUbiNutMBxIty1N767/pC7pX6xRmXWTz/1JVCEVWo9Xwup42zUSt304NC3d/H12UmF7UobfGtyA5yJFc8VEbL8nLbaC1Y/pOTuYuCaaltlJE7ZCEcLoZ6v3b24MhQOnNIajPKu6Y5quNNRK2gpP8RbDXE7XCh5O97J5ai4wt/s7xuMicc4pLTyKkTZ0uCK4u/u4/v6l5BZwJwZsknR4MZHuw7ucOlNiR2hsPH/.../ovLoOhHO pj0IqRfOMt kBVWMb2DiE7BpZ7lUSQtTPFIHP7N8lalkZttZSQicsFv5uTGR1dOqkeqTL4fL d7c0dH2zTZ6Nwv4Ij4wBLQ63ggeasFP  (global ship traffic seen from space.avi.exe)

23 / 68    (PUP)
http://wfs.ezdownloadpro.info/hp/?q=lXdSMS2fWIa1fPRJLFvosOcvfoYhw9ySN0gB6IxJE0la8clWUoUws8AUqOON4G19Kd1pqbhlnHKaz1k/CwZU/Y3uuNVQ 7lzKgB2ccdhQKeTZ9pN2BbbBtBpPflEv0g7klOEfYv6iKmXABM 48IbBt6SD0PndlCmoBGQ9DkoQ4onfSEBj59iJ3gx0TTceHcTupqMzQghQuhPHzU5kKsFIbBMbHMDtSRbb km9gDJ/p/wQG8dC/y7Z6Nwmx0cchQyH5dfnUpVxnEdiMmItwVEdRFPLpCRmz/oM35YtZVElF2hiQ3IvMLm6R5KU23eSfeIZQSjIiJuwJlvyOrBYJcswQmyQ7U1l0oh0glwSnFZpA00snevYRDbctCTQDBNYE1TfdqDvFUbiNutMBxIty1N767/pC7pX6xRmXWTz/1JVCEVWo9Xwup42zUSt304NC3d/H12UmF7UobfGtyA5yJFc8VEbL8nLbaC1Y/pOTuYuCaaltlJE7ZCEcLoZ6v3b24MhQOnNIajPKu6Y5quNNRK2gpP8RbDXE7XCh5O97J5ai4wt/s7xuMicc4pLTyKkTZ0uCK4u/u4/v6l5BZwJwZsknR4MZHuw7ucOlNiR2hsPH/9ycvORPTukPN6ZOANalUtVFOy4XWeSv0yoKzRgZMH6GsFs0Be81xZmaAZuKa8qU0t2F1yiH7XXFd5I7xJOyoHAC8WymltfhNq ZBjDwLHdKFMmuMJGjV4OexZIygNuHkTfnhgdNs0ezrsGoHjrwK9b M3p4iPoZuTRFRSSHHTr5U0XWvOqNP6CSKQ/.../7Ig  (global ship traffic seen from space.avi.exe)

The following 3 files have been seen to comunicate with wfs.ezdownloadpro.info in live environments.

TCP » 54.149.241.47:80
papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80
installer_game develop.exe

TCP » 54.69.228.231:80
download.exe

URL:
http://wfs.ezdownloadpro.info/

Title:
“ezdownloadpro.info”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.