home

a.contenthal.info

Pending Renewal or Deletion

Domain Information

Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
Dynadot, LLC

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
contenthal.info

Whois:
3 contenthal.info records

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Optional.PCUtilities.Task.Meta (M), Threat.Win.Reputation.IMP
100.00%

VIPRE Antivirus
Threat.4732184
20.00%

Dr.Web
Win32.Siggen.7
20.00%

Microsoft Security Essentials
Threat.Undefined
20.00%

McAfee
Virus.W32/Virut.n.gen
20.00%

The domain a.contenthal.info has been seen to resolve to the following 6 IP addresses.

199.59.243.120
April 20, 2016

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
January 27, 2016

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
January 27, 2016

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
January 27, 2016

52.11.167.137
ec2-52-11-167-137.us-west-2.compute.amazonaws.com
July 1, 2015

52.27.23.115
ec2-52-27-23-115.us-west-2.compute.amazonaws.com
July 1, 2015

File downloads found at URLs served by a.contenthal.info.

1 / 68      (Malware)
http://a.contenthal.info/hp/?q=DYeUOOVJh7TACurpnicVi3Ydy4yTKfNLwr42Xc/HEnq/R2Uvpx0gHW4OPYS765x uk9CoQ0FcafKt6HFRkviWLesddajoQ3VxklW37VTEL6RglMzJZKkmsFkH0OJKfjPfUQzPqxcT6dV0J5gPbK1JAsqgP8fT8FM3UnsopcCouTnRiTDRTBPKH7D16Xpog5 nxOUdIJr/aQuRtmfgjh 5bwNzqbPTd2nMYKwmQmN9Ss8fUpkBiHoaI9LIWPQ0qhN6deRvo0QAnoIy/.../  (download.exe)

1 / 68      (Malware)
http://a.contenthal.info/hp/?q=2l3ZV/vjcY0WaLFHwymDjAo3Jl3TvE40tSO/BdEhzIA/NfsZoc0xhOPZPYZYCaJS1iPwP/K2K1pjPu7XQiQAiPg6E5L2R0Z6 on87p4Pv2SJ/ua1ZwLfFWzeytvwon30QP0n4aRNBRrQl1nB1D7k1St0JaeYMTMdqfxLreIR8yBocKOdO5xIknNolpS9bk0NyiX1isH216ZzSGLOqqH7 QT5ksMEhB2TbrcWNdjmMemE2KZe1Q8tVBjvKqE9/WI1cVqTRNSD4/Y1heYguDfIExDL4NrtCUtQh6pOK6Zanp1rlt76M0r5HmTZZhiuq0gAiQHHn9haP5WZD4qlwJ7xPr9qwmIAQQWf6HLX2jcBT4b642YRY5RUs41AGcz2xu0yTLnN6CmyhCUD2eXxAd25v90DWnOhRKFscP93uXsGRgmXQ1ZHkquyTWvcMXtQM5Pv/GLqEYe6LJfa9Icw51u1PfKNS5ZxvzlRUACmYlIGveL2aLw4cLiy2UcEeQLceJ0o71kNaEi/.../LN1NLSCS8NQjzLO d3TJvcACqKA7vqUGd0WNumsbhineOezoz znjdRvLjRq3LZN5Mr6RNZASVWWQBCHVYlGYFtBGEMYQB TtotCkz tYW4G9Z77f0e pUMz6rPGBKtA1xjKu6Rz14cL4COKKc r6gmbCQ3AkQ9XW2kIqOHO3 fsZJCANrqdSyy0LYugyUfMsDYt ScfryWUCersOW13LUz58FuGuHbNlhDEGEq5lYykGYbAikrtU76KQpGpF9bdi58  (download.exe)

1 / 68      (Malware)
http://a.contenthal.info/hp/?q=TabWS3jdJ3dFqtvqom2SB8QTFISyTjDDCDfVrNRFNDWgbElBtMConHZaMTAUrkvxW6JTK130U0g0eTfrA7fATPg37VCidbTwH4XSGYjUXMO3uEWgQJyajnOYm S8izwdZcYWW6dlrPmdn2yThpeaZB8aneJGNuhNn0CmMei3HOl4uuTnaDdizvP7QMXp6T8ZlJPBDdjVPYAYy8Lj9vt3iLSSmQEZQz/lJP HlVHRP1n GUbPeLfKGNDJ/.../Oo4  (farming simulator 2013 reloaded.exe)

1 / 68      (Malware)
http://a.contenthal.info/hp/?q=1s4TNMXOYxC7Iztvqo1KTa4tSgu32w/KGQbJzu6aBxVqm NKlq91lJGO MuuJOMYDjibCOSk0ZTHkvfc uASJNWjqgOEa4HzYjriPuJBd32ReEzm nVtc zdCnQ/qlRLUHvbtentgxWPbipmd9tTFO3PeGIb4i8 sm830dbk04CuMLDbArQR KEPZIcU4gEVYekQZwh6fNUHMVAl96sI6I24oqu7jU34c9fQ/XbfWqYkDq4GMLft6msZYhxKMEJrPC CBo3m1oJe2eE/Bh1R8qyYhyFnaaFMnHPsjXO9NK1GRfpwENf2wDdg7w6cYj1KB6tzHVzLYH6EDxnc5C0 TSSC3nxhD0liumV8L2tEo8fbwBLeT6hpeJ0ACJfboOCqK76cSa1IjgpHR2i6cH uxr g6P1/Y 4UCFSSLUPGtp6ee0DI7sbBAX/uzC2LBmQnvqTaTrLrJEmj5nlVrJuFQ051V9z 5kBYzrn6R3NLbf343C0Wcr2TQFx1bNk0d5Ca0mhnWJ9/.../9sZuh7AFsrmBtJ6VrVFFzCsuR2MU8Wf  (wavepad sound editor masters edition serial key,crack download.exe)

5 / 68      (PUP)
http://a.contenthal.info/hp/?q=lcKoj7SFmhnv89/XZTKU35NWare2yg/kvUddejebi6VGfTtSypUvMjtgH5kkKkevJco3H47oRkK4VtlR0nUQjCPihlrQeZ7Z/.../HzACHvM qk wMqxcNmpjX mPyHLLny00  (download.exe)

The following 3 files have been seen to comunicate with a.contenthal.info in live environments.

TCP » 199.59.243.120:80
qvtp.crx

TCP » 52.11.167.137:80
download.exe

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

URL:
http://a.contenthal.info/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
Microsoft-IIS/7.5 (ASP.NET)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.