home

www.toursvaultdl.com

Communigal Communication Ltd

Domain Information

The domain www.toursvaultdl.com registered by Communigal Communication Ltd was initially registered in January of 2016 through GAL COMMUNICATION (COMMUNIGAL) LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
GAL COMMUNICATION (COMMUNIGAL) LTD.

Server location:
Oregon, United States (US)

Create date:
Tuesday, January 26, 2016

Expires date:
Thursday, January 26, 2017

Updated date:
Tuesday, January 26, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
toursvaultdl.com

Whois:
1 toursvaultdl.com record

Scanner detections:
Detections  (93% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.installCore.GERYONADS.Installer (M), PUP.Installer.Bundler.Installer.Meta (M)
93.33%

Dr.Web
Trojan.InstallCore.1027
66.67%

VIPRE Antivirus
InstallCore
66.67%

Sophos
Install Core Click run software (PUA), PUA 'Install Core Click run software'
66.67%

AVG
Generic
66.67%

Malwarebytes
PUP.Optional.InstallCore
46.67%

K7 AntiVirus
Unwanted-Program
46.67%

ESET NOD32
Win32/InstallCore.ACZ potentially unwanted application
46.67%

Agnitum Outpost
PUA.InstallCore
46.67%

Avira AntiVirus
PUA/InstallCore.diur
46.67%

G Data
Win32.Application.InstallCore.EG
46.67%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
46.67%

Zillya! Antivirus
Dropper.Dinwod.Win32.1768
46.67%

Qihoo 360 Security
HEUR/QVM06.1.Malware.Gen
46.67%

ESET NOD32
Win32/InstallCore.ABK potentially unwanted (variant)
20.00%

The domain www.toursvaultdl.com has been seen to resolve to the following 10 IP addresses.

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
May 18, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
May 18, 2016

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 18, 2016

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 18, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
February 13, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
February 13, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
February 13, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
February 13, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
February 13, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
February 13, 2016

File downloads found at URLs served by www.toursvaultdl.com.

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=iYC16plUpRj1R/EBB56dr84DqsmE IoKDq6GWZKkdVs=&c=fwkvNMSDPSzhSg8zRIqk7gysxPV2E5DhKeNo9zaRbzmXvIVql7d3kCqClaYQ4qok WIa 4UqnIKhiOtg 8Gcb8OlbvLH6exWcY62ptTYEdxt4Q6LOqOuA9H3HUvjraQJIxdNY7yqAy9PiDU/MR5qj5B0eGHjU5maFsaZ8zai74k=&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (43384749932638b6bf3d682bdb17fb55)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=okJbFIUsy0esy5VqqwOwuVYWjEP6UDRp1pu3Qouy25k=&c=tuXvQX1ljIlc9cMhpMld3Ht/SeUEfYMm/H3MK4XuE76rA1vdl6HTNZWjZItc5gEa KbWiadVrgFfIZ6qUaUA4k6b7OD3LX4E5dWCitAkL4xlLJQBu1VFG7QLpVC2xPaA&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f3b0deb6838cb00cb7a3cc9e2d8cdf87)

6 / 68      (PUP)
http://www.toursvaultdl.com/c?x=493ngpbF77axH74lm/g/pfwMVjTL4w Xxxk25mVpvRA=&c=Gei5FQ4sUwu s/u0wyPMfdtkTKi2hE5R07WPl0rwK29GetfjdCK4o7cSmZ5KPYghRKVGcHdE9DNPc4MqEhfSvLzQXibSd5R1rZr87WRIM1jLD9QddXZpIxwDmtRSjxZV&downloadAs=Flash_Update.exe&fallback_url=http://download.macromedia.com/get/flashplayer/current/licensing/.../install_flash_player_18_plugin.exe  (172336973897999c73048f3f86441732)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=XB51ZcHXEdtMNq7OvovNa7vG0LFtz14gBUe/XeFsViw=&c=WsIIerDh3h5 4ZsnArv7 2L8EEsneb/qgnVshpluS2ZoTlCvKDoRuv8wULHxKrC3MhlSwPrj21jIp2pQe1AQ0bVjlkpqPamLPA9l4RZ0Eq9PH1IyGOML6DblbbnYZeAm&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (8a3fe1c07c8833fd6a4b014386892233)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=gPeSlf W7SGEYD21Ajj9U/D17CSSoV1cBZu3enUB0W4=&c=tVlemKiE9TuVLZXagka9paVVePNZesGP0kR76F2N3TSl83Foe9ZZReCNz iktz9H431NGkMvy5jSVO1M32OSWHdDMx7loTmKi9eEa pqivUUzusDAmpXzlIVm jAzxyT&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f49de29a7a80a2ccd4b9d916e159392e)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=SO6mzxzCO6aGHv0Nq2vxy EWPdudtXvQXdCD6FWy6Tk=&c=9XeGoUkiEAOa9Wm9B52065Up9nGckokSiN1cNNDgT36uZ1big3ifkKi61GjepMc48ixE8W8y7vhKQj1uqkhl1lZgdbZU16clqYDz vnwybyt0Gw0sieRoOGPbR09GqIz&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f49de29a7a80a2ccd4b9d916e159392e)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=OjWc0H7fm3Wtf/khpoIjGE7fMmiNWfDWEKPvMoXNBow=&c=F4lElmKBzMoQrP9dSQYe32qovOr5 bHk9deehDVMdXlx6ZxUVfkntsp7rvnrLcElIBA5aaEwISUWt/Q4kMQedEjdWKEL5f2UR3gcZNooV0vwpDn/D4FmaFsaDRIsriD1&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (b62ac00bb0799eaff804af34ee9d8625)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=5feXlr543G//IikkDNRnmopuIN1BZPpc50cQNJ3LC1w=&c=K9z2/wuNcU6TqKq6cIwAYROFevLnj7CaS9mofV 6HfylxkfBz633fBFPhBiFLzp08X4g4kh2ml20Sz36KrDZ6lsMWZTsA2raZDCfekzC2 E0OA5pKRo9yZf8E3qExCV2HAOWML3iTWaPnHKVMsGOcuqW65duCva0TQHTO YOIho=&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (43384749932638b6bf3d682bdb17fb55)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=xtnB23qW41Y/hlgXd9g5IQN/EUGdOSVE7oWLgUSpKaA=&c=uq3OoYjUOznovPWfD345LV1zB3OqU1Vu Y3HSyJAEgv8WjEYHDrYAbmUSsmcysGdTV O OhwAriRd3jjLbHybDY1twq8biwJt4pxuYGoHTIVM5OezonVvxYuqjH4oAG &downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f49de29a7a80a2ccd4b9d916e159392e)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=DeyN/KZE9dDnzKaPYlOolDY61CNay1IUS HcxGfPv o=&c=iKbcEFNOPk5YRKgtxZu3H1kLQ8kWIaA0Hc7EN0xXPz4jIdA7b5IIP5rhWXBdmpswNjBu hPOQ0Di rKT8qxTRPBzz uQ8z3hJxbi5i9b8gDvV zt/gxRf3PYMsdrAlMO&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f49de29a7a80a2ccd4b9d916e159392e)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=Lud4mJWBoHQcu/cpW RY9G1e9ODCvheJ6w6Rzk95fY0=&c=4NQddZwHKw/eUXPF2/j/FI/qVf7uLDBZF8do6PrgFFlIGhIntBapDVWs58LyK6zyG1hrmmUkTUyHwHE5ZLwRWk6G0huF0pdq/GNOf/lwP25eKRY3tF04DAMiajTnmvfI&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f49de29a7a80a2ccd4b9d916e159392e)

2 / 68      (false positives)
http://www.toursvaultdl.com/c?x=dwkNuXB34CGXHPTWrtb/tb76CeDvwAdH9QEnrN0UaR4=&c=Prfp1kitgReJE1Da4vtyb8PuP13MJlvHFoH6dqe0tva3VsJAySwD/2uhLskYVfbXTuP8e9cbPKVgFbJEw6u6k0hF2GfSwh8brl5zHBZegc67s2DYGJlavsduve04cnxK&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (wrar420.exe)

1 / 68      (PUP)
http://www.toursvaultdl.com/c?x=Sjzg7WVQyvu9qTTXTaAgO5T/sK3BuCfn9w7j VAiH3s=&c=2DVSD23C/X3fiSdc ARmlYsx9utho9olzGEeEvlb7pMOoPLdZVcDqk1TyWxRzuOoPqQ3No8dpAJX8qAhIlNXwYmcrbDs1oUkbgHRtOEvK8xrsXP6TyvOwcyl2LdqszrfOF/7mygoqeQy1x4jN83IS6MTI6rqqjSXqpc9ysSC0CM=&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (setup.exe)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x= aTAWC4lWcSzrYAQf5g9989lthzSfG1 2t iTVWx2M=&c=wNs8Lr34zVEliqeogukqMy4sdvFfyTt33eZs9xtxIt5mB3o/W4201ft7EX1sR6Jbnj//hfg2MwW/3bkAyx5xWXGsc6K1swL44q9dEbr2M4 ZdsLRb LgGvJA0ZW/q438&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f3b0deb6838cb00cb7a3cc9e2d8cdf87)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=7rPMlOinU2IVHoPrMFeFzEPozhPqNJ3Swf22zj WH8I=&c=G3Rca1orfCxVug9uqt1BA6RdU3RAn3JxtXwpdJDUPpYEnyviqNzHWuzszNaWP45gdwgy6ec0zyuWiJV/oR4lo760ImJ0ZTnCwbZP/4 EOYSsemhIj5vSXwXd9VR7Bu9G&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f49de29a7a80a2ccd4b9d916e159392e)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=Dq6YO/Yo0dVpNe3isGIxxkXUVx6vglf1WcIGr2Y7VJ0=&c=xp gMWwD ksHceLQi5753iD3S AqiAZCuebgY/o8l759MQiVGcrXqU7M4LRRp3JTqCnMwOTHUZBXPlyrTXAR8hdWaQwzRbS9rszWnPGi2SAEFRdUffkgXLGWxIMlrN8K&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f49de29a7a80a2ccd4b9d916e159392e)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=qg4tryXosTC5URs0ifubw7ewEhbxf crGtStaXZgFko=&c=maau4Xr37d3WpdcZzC69SxXCnMdtZiVLPK7S2Uqo0C5wkPlh77UWDGwQd5yOqiv7D1ysov0QC/nKn5 cv y6Iazo/dOaFjlZDPTapqdMPn 7HBOtSNnzb1DoVIFKFzgN&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (407a285d82279ad274b5daf761ab1519)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=URPKLeZLzWM0il8R7DHH5mlPmEgywI0h3pjhXqwpiQg=&c=SpWdkHWBPIkC6Z8bLmcM6Q5d495Z8mnjTLvIz47RQO9xfJcluW4XtYlf837XS14LZrH6i/108LKYPAtTYJROqtphYTBMLQ7uNi82XoEJrqez9CdACuf5v8hs7KqW3L5f&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f49de29a7a80a2ccd4b9d916e159392e)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=LAe6aruD5d7HWFAAaeDMWd6ieZyyEpePYYstlOncjGE=&c=IhzRDoZLg5Sbbe0ybWQA5ExNSBOKeebVBI6Z3l231imP7281GSOigQpV/rUJGgoDaJhnASwHwerfbjTCByIfNNcbjEhsev9w3pBL2Zs9 tRfZ1zOBjc6Rt2Sa2sa1 lV&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f49de29a7a80a2ccd4b9d916e159392e)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=LUwdmOPyHIq1TYQFciFh05fdh9RlkSVo6v06IA3ejlU=&c=UUTHUHiDkDEycZ8Z8aBrWMRbPfsKF9bd9Ir8tt1nVUBNq4Odh8q/FGcOrRVySzeNu5O6tekcA1q7CcRyO4z2VbinwKb6utDFB9pMBfC9c DvHVVhGchrJKQTc5OQxehH&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f3b0deb6838cb00cb7a3cc9e2d8cdf87)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=BkhX5jsg2RFLFLr3C6p0VF93WJasHk3HqOSOZvK/e2Q=&c=x9PhyGsemV lb7BfRkJQi20cJT2mu5HP0s02mvE9jNN2nKFLHJUSKvUutpUxJ7w4vhzaPr87Lm3UMAHDaP8PcyztZ9CLzJM3tCjq HUpp6MhNhKOnbrctvfiQD2HmpdS&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (e24ec87d1c6e4ac25c42613e8e83a6a5)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=zXrKd4HJgmzNuKyt/Tei1nSnR6MWFssiVIuSBQEdJZY=&c=SMj3Ffnf oDEpd2l19yTIQOPSRBqwMQLVgMabIIJxhpDhLDSy smXhnnv0/QfvAy1SDAJJYu hBLz2Jc izPK05BBCCFRq3AOuk31xY9yM0tEICq1hL7j849 hFd9mg2 jZwqKsJMVKQXTlskt2YU7B5oqmuRNcHp4wUl1s6TbA=&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (43384749932638b6bf3d682bdb17fb55)

6 / 68      (PUP)
http://www.toursvaultdl.com/c?x=q4fqEcjMArU3ujlBbLMYahEZgCA r/Ixp//BPiVjMZE=&c=ZrCqCwsITZGz5rzocbJOmA W/tBXrs6f1/zRLbQiTk9JyUj1d/6Nfw8xhbOE7OqFCYFrB b2sdLOT Bepw6J/C2DOvxAo6FoA/xEUu xMHm5Oq63qBbu2pbCHRW67gvuDRI4VkqQfUTJeMJwcRwrEYvV1an1TLApTXlb3tFL67M=&downloadAs=Flash_Update.exe&fallback_url=http://download.macromedia.com/get/flashplayer/current/licensing/.../install_flash_player_18_plugin.exe  (5e51fa33b0214d32ca187868b542f7ae)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=gP/geQ4W7kJlV90ZbRNrlVOD55QWEDFqft7X2Clagq4=&c=Tga7Qn9gvBMhVSluWpi5r1CxDLyHnp55HT7C/Fw/ojXmsem0Wdi3jPRCpRd3Vu2Y/lAvmdgqx VK7ODEdHuhxusa1/rjhFwED2yQ6fFG5JDizfjxxmKDGUtJ4lN5V6O3&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f49de29a7a80a2ccd4b9d916e159392e)

1 / 68      (PUP)
http://www.toursvaultdl.com/c?x=vVhEb2EdGJhpkTeb8rJjZ1xgK4pvBKXhEkhwxdUkR5s=&c=d2tYbQUj/x5W6HwwswhkZsCGDMhcsXE8sG/jfrvUqLg8hhuRMx0yycANX7OiE1TCpqr fvNP7UWnqAfwoFr0OQe/AIzxSbhNprxsbGJVM5KzU3kWNRivd4BEes32oo0X&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (icreinstall_java_update.exe)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=DCrUhvUBibnvCRcDqtG7vadF5KwwqGmTZmnkREzi1hU=&c=fSEtVWCMW36ZmUIFvVNjPatXlyyQbiqwPGDsDEGVirBIgBISvtlMfExoFmS8XFdd0x8nyLBQqAgB0laEvIeOlwTkQP7KD7szf33WwQ/ZDbW2B1FVK9So Er9OVGA/h4N&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f3b0deb6838cb00cb7a3cc9e2d8cdf87)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=IEoopXzQiPKiogNFy5M0ktaPBkHzuriZo6lRG9qLIJM=&c=lLnWKwHe2Tbnj3cvMSGCTiMydToeAAqB3nhWEJEIAvh 1Z S2NvjEYYjmDMnhS3Ttq0faCYMV/7sBHL1DcaaGmnFbMmxOOYQAacvbyP1kOqeBh4kUPYUx4xghtzP9q6y&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (f3b0deb6838cb00cb7a3cc9e2d8cdf87)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=osXaE4rSoRnHnmuoKxpsq/bO2hbPAxlHmiZ9tBbZyd8=&c=2Aavqncn1iCwVFpeALE3fhmj1MQDgw6MzKn3YVov7TfaMCwJONFTYvlG3TLynULu8bWAe7d/qlHeewdLwKxBk9SorrkCGXSAjQ57lgmB7FbhbwKU09zgiUezmvneDJHE&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (e24ec87d1c6e4ac25c42613e8e83a6a5)

6 / 68      (PUP)
http://www.toursvaultdl.com/c?x=0P1QuupX JEnsouHGguXy6chAVfVSDL8sMkm4roJHZI=&c=zudNffl9oQU2P2u7gYwirpSCIJXFCjkLfkcZPHGcL4JFqpwLALAie7xwc7AZYk3Jg122UaeufmjlqcLtvjCmE8/vkgtZEK8uqR3w5ez7jhiHJn/FDT9f39mKweQWv8bS&downloadAs=Flash_Update.exe&fallback_url=http://download.macromedia.com/get/flashplayer/current/licensing/.../install_flash_player_18_plugin.exe  (17bd4b6908dbaf1b4280b1285baf29a4)

14 / 68    (PUP)
http://www.toursvaultdl.com/c?x=t2XVUCZ on1avId v8Wkxxldw6tSOrc8AcIZ5vJaoF4=&c=Fu0addqYnkV/Mej6pdU5lYbIVxU7fwzj q41hX3HJJm8IWVfUVImAI m0b2AqAopLD3T5U/RGaIxk81ehKc7IEduV02xn2CQQ7JLj98bwPWVmsXD34TfDVm5asqfM Tc&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214  (e24ec87d1c6e4ac25c42613e8e83a6a5)

 
Latest 30 of 42 download URLs

The following 6 files have been seen to comunicate with www.toursvaultdl.com in live environments.

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.