home

a.birdisoprogram.com

Eduard Vasilyev

Domain Information

The domain a.birdisoprogram.com registered by Eduard Vasilyev was initially registered in May of 2015 through ONLINENIC, INC.. Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
ONLINENIC, INC.

Server location:
Oregon, United States (US)

Create date:
Sunday, May 17, 2015

Expires date:
Wednesday, May 17, 2017

Updated date:
Wednesday, May 18, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
birdisoprogram.com

Whois:
1 birdisoprogram.com record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP, PUP.WebPick.StepanRy (M)
100.00%

The domain a.birdisoprogram.com has been seen to resolve to the following 4 IP addresses.

141.8.226.19
May 22, 2016

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
May 20, 2016

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
May 20, 2016

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
May 20, 2016

File downloads found at URLs served by a.birdisoprogram.com.

1 / 68      (Malware)
http://a.birdisoprogram.com/hp/?q=FHdSMS2/.../F23sIoAnS96jQY423mtS1mngjxtS92txYhjc5cO7PGpN QevjrPbcb3EeRZbw6JL6uzEc1I1U35QXlHo1fNv7YYbKz1xM7aMGRtaysuji0U9KW3Uz1BhlZMc79BjYgWSyAzi tk9eNQq0QFca8JomuvozgWFpGRVTDPnYeZ731OY  (rygar.exe)

1 / 68      (Malware)
http://a.birdisoprogram.com/hp/?q=R9Nsrrt0C1yEKomjlh5qctod2D8xm7IwQNPVol96/pCvbH7 3eRe5ZGQZCKJcQ4N2 0c2 zgReKQejQip0pMfiEL1xNiRegLfuUjcYkhmsS5Itd11crqMcbq/nJb7sr8oTuF6jbg1Y DEvWg1PrqSTKstDykN1LJAPhR9ewJ1W9dksDI4h5GPd0ei13UL/AuduTSnGQTK8DIe0C/kIeSi1eqJQiykZTszacIoan6xmUv3f5WM2cHFtnzlC7pDMew2Ocxs/E 9X7SnS4Ci7YSmG23dg9FTiI dxWzYCRQGTF8rXQ8pxeMQFlmzRud5tiI4FO0LdiaSfpGTCva0v3Gr utM/JALBGpxnjLj1h4tlizDZf/DiYgBcrqZRcKkyajwIabvIgy7qmXPx9f11cFot/PAmcdWxZg1G4c TSDcMD/.../NHzhWdWxvvEw2VPhNDlDcqWr  (declaratie de dragoste (dvdrip) (1985).exe)

1 / 68      (Adware)
http://a.birdisoprogram.com/hp/.../m76DJWzF4LcNipo QALso  (download.exe)

1 / 68      (Malware)
http://a.birdisoprogram.com/hp/.../juAlyDsL3tHWmbD3DNRKVr7iZBuubNevd1XHG9Q5QDHWOf93JOB TsDuyf4lit  (download.exe)

1 / 68      (Malware)
http://a.birdisoprogram.com/hp/.../kvqM0jlUY9VX HohSxqeufns8kN2b0j4w5qjwAPVtQfJZRmuFgHfOXqOvIhgCQ yd2  (download.exe)

1 / 68      (Malware)
http://a.birdisoprogram.com/hp/?q=cxWEf7SRLQFH6789/XQJv8OoBriph0RHbfC 4i9qSpGQeQWlLwDTJG9JkNjhn/WioWtYiFA1Y3Keqe87wsNp6vJXL7zYzFP6rHNL26aGvf6D6IJnr9LrtsjY5mvZ5Qo tIZaDkP/.../1x Qp3GLjlpF1gxtsrn8nqJwJNp8H3vA2  (download.exe)

1 / 68      (Malware)
http://a.birdisoprogram.com/hp/?q=hnLnkDxrJBYN4Hwysulf/R8GcC6NICYsWXpeK1EUflD3g14TiPkR/Ao0NuCmUJnliwHOQczDuacUo0vM6D1 qigSBpWTyCA3u53Ys5wmVfDPHsWlM7/Ppt73SJzU6DlYWnaNky/ MwNjwji9IsZlm GPrBc96EmonZR3bcvI7s3N/Q7TKdkO5hAY MjqYpvo4qnFLPl0GHJRYd1e/PJJ8wX40yRU/H9dnHeNBqsutSHQMBKtLepLdis8ollUoJae0MO6X43O9YIrOxqNBsbk3AlSIWLYbqlPPqh4Ri1Ja qT4Fc99uxZrX 6hGcRyyfacfTiLSFxS9dQua0eiy7It/zgDP3S4IenFYQXBjFJJykV/xDVWqF/.../Y4QkG2StzzIKQbFwGOwX5LQFn  (assimil le polonais sans peine pdf mp3 rar.exe)

1 / 68      (Malware)
http://a.birdisoprogram.com/hp/?q=xkJpiAYKRW7LLdefABTXL4NWZCO/R3CmT1RIYYfolu3 bP3gDPM9RKwKEcufkANADRSSec4 8ZR12hmvn4VFOeBcxMvOSwvt/HQGqM2w8j7Ku5/1qxOoRg FeNljAtqBlvN/.../M5caIDJXwT jyNjac5fPd R  (download.exe)

The following 2 files have been seen to comunicate with a.birdisoprogram.com in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.