home

cdn.cleaninstallsthread.com

Communigal Communication Ltd

Domain Information

The domain cdn.cleaninstallsthread.com registered by Communigal Communication Ltd was initially registered in May of 2015 through GAL COMMUNICATION (COMMUNIGAL) LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Hollywood, Florida within the United States which resides on the Prolexic Technologies, Inc. network.
Registrar:
GAL COMMUNICATION (COMMUNIGAL) LTD.

Server location:
Florida, United States (US)

Create date:
Sunday, May 17, 2015

Expires date:
Tuesday, May 17, 2016

Updated date:
Thursday, June 11, 2015

ASN:
AS32787 PROLEXIC-TECHNOLOGIES-DDOS-MITIGATION-NETWORK - Prolexic Technologies, Inc.,US

Root domain:
cleaninstallsthread.com

Whois:
1 cleaninstallsthread.com record

Scanner detections:
Detections  (89% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Atube.Optional.Installer.Meta (M), PUP.Installer.DestinyDreamSA, PUP.Solimba.PrelasanDevelopments.Bundler (M), PUP.installCore.DestinyDreamSA.Installer (M), PUP.installCore.DestinyD.Installer (M)
88.89%

Vba32 AntiVirus
Trojan.Agent, Malware-Cryptor.InstallCore.gen
22.22%

ESET NOD32
Win32/Somoto.Q potentially unwanted
11.11%

VIPRE Antivirus
Threat.4786018
11.11%

ESET NOD32
Win32/InstallCore.ZM potentially unwanted application
11.11%

Bkav FE
W32.HfsAdware
11.11%

Malwarebytes
PUP.Optional.InstallCore.A
11.11%

The domain cdn.cleaninstallsthread.com has been seen to resolve to the following IP address.

72.52.4.91
unknown.prolexic.com
May 31, 2016

File downloads found at URLs served by cdn.cleaninstallsthread.com.

1 / 68
http://cdn.cleaninstallsthread.com/c?x=ysMk6uiOuUY36W49kpAD3MqEGaIcP0ZqktdmIXUbun0=&c=oA4P7ZbgKUNxb5PbI1sSqDa3L5Xs16qo5aTP/4y2M1ZcFJ6sslK4An6juqjYvpTW2FNy/2wylBxquFIBec p3XgQvlMJuLnIBnphgEleRF9k16Z8s4RoQPug2l8jofNq&fallback_url=http://pf.phpnuke.org/s/1433877720/fr/4/.../40641-1794546-driver-canon-lbp-1120.exe&downloadAs=driver-canon-lbp-1120-r1.10-v1.1.exe  (lbp-1120_r110_v110_win_x32_en_7.exe)

1 / 68      (Adware)
http://cdn.cleaninstallsthread.com/c?x=KeV8P9SkUmRJ6XKNZHSjDBBtzhhzQQEKMLai7O3kz78=&c=sin1ltt27B 260duJR5r8KjDzsuo3E9 83kx44e etjTtvRsdN3jGVooxnUcx5 ohxlt1ht7ydpTg55sBrkgK4myT09m1NJAdz//64Gxd00edfQh 7c7pS9v12j0eYbM&fallback_url=http://pf.phpnuke.org/s/1433857351/en/2/.../232176-668858-pimp-my-car.zip&downloadAs=pimp-my-car-final.exe  (3776d8b8464ac28584c4a730de1ec688)

2 / 68      (PUP)
http://cdn.cleaninstallsthread.com/c?x=xlxfptNtYv6x7kcEj3TvnLst2m6DlHoVwbwhIy4 1RI=&c=Q0wucwZOFJ8P8Ns14UqJNHn4qN1hUuJemHkXw68K4wrcid36g rPYvQy/laStiLkAy0L7iU8qIisKANcD0Oo4KNobmX7ptPROpLFrl7Zv2BJLCHdaqTYF7rIgMoTOznf&fallback_url=http://pf.phpnuke.org/s/1433895286/es/7/.../79750-1805035-atube-catcher.exe&downloadAs=atube-catcher-3.9.7986.exe  (f_00282b)

1 / 68      (Adware)
http://cdn.cleaninstallsthread.com/c?x=C3Qml98jng1k42ap4B0sZf0KVgK97LRU2uidhA8FfYU=&c=e5ExdBlZEiXn71GLgYTjBAUSE2bJ9ppOITFtsdCvRqulseZLTNAFzIW4lg8PL8Q32T08Yn48DPUvqNuymVdPYyvTpaGfQ4efAR07lnUSyS0il5E6hMBRBo4SRwvlK1kB&fallback_url=http://pf.phpnuke.org/s/1433867651/en/.../2/224355-1797352-canon-pixma-ip2700.exe&downloadAs=canon-pixma-ip2700-2.56a.exe  (canon-pixma-ip2700-2.exe)

1 / 68      (Adware)
http://cdn.cleaninstallsthread.com/c?x=URT9 brRJ1oIy/jd/rTNwg0t3SkY ESuKgKPNZ018Kg=&c=BLEECUtiCD5wjUVvD5KK6/iY8YVz70wB Rz8gVFuLLU5uvgySvScIYE3ufyki/Vi/sYHPGVGaxfbsaJ6TJybmxQ77OHtShQ09odepxVZaO7k8kRL294RUNY3pyKR/sVW&fallback_url=http://pf.phpnuke.org/s/1433862525/en/.../2/227044-659113-prince-of-persia-the-sands-of-time.exe&downloadAs=prince-of-persia-the-sands-of-time.exe  (19174cc3e3200441a0c37b5bce5e9113)

1 / 68      (Adware)
http://cdn.cleaninstallsthread.com/c?x=f0VIX00Nvjp5EDNgpyyH2fLln2nXOi4ZWV73wBqgEfc=&c=xLR00cj5xDA7DOkuUpGSNGnO5D3k9NXEARpZHH5ItteoBHK2cRC5BpH8X b86iOvMZx/sQW4n0XdKwh4j7kYaYcwm7oCP70M3t9aX/f8tI/O0Jl6SeZkWEktuR CDZns&fallback_url=http://pf.phpnuke.org/s/1433886050/es/.../2/227021-1806203-autocad.exe&downloadAs=autocad-2016.exe  (10f7de389996bd4ac2e8166458f7698a)

1 / 68      (Adware)
http://cdn.cleaninstallsthread.com/c?x=2J9m5loLUlwo56CBnUezjyiW10/H3oHaXs0HpDGbQA8=&c=zo8SX7rMXvDbmhXb4Gs4VJi1toqyBHx3fvMdA0Xpf8Rh/0SEOd9MmrJzEidW/m0d6vYZCBR7FADYRMpSg0W19PT1X7OrANNqYMfSEj6Ka3juF1Sp8p0vOalvw 9qyG1r&fallback_url=http://pf.phpnuke.org/s/1433867833/fr/.../2/224907-667542-pro-evolution-soccer-2011.zip&downloadAs=pro-evolution-soccer-2011.exe  (35c913b7b3bbdef53fb45d818eba4d50)

1 / 68      (Adware)
http://cdn.cleaninstallsthread.com/c?x=MsC5JGrPE9rTtH Dvmbxj7 IoR9g44gtq29N8IUbt4=&c=LVjv1F8whviJ4HTNoLRSznw8rx kJr2X9nuFN5EFo2I7FwSqDQO4Rqtc9nDD/JptfRmTRAm/v ps07KEkU1EYFpzG0sdGvp7pL5SvsYMSwWm2mKZyi7Za9PzleBznLRo&fallback_url=http://pf.phpnuke.org/s/1433873541/es/7/.../79750-1805035-atube-catcher.exe&downloadAs=atube-catcher-3.9.7986.exe  (c7d95e4b1846c3c87e034d621ff05491)

6 / 68      (Adware)
http://cdn.cleaninstallsthread.com/c?x= 3z9AxrRuouprANRW9k2z1sumVqynw1mCFqDGD12gyI=&c=iTJ6B/mgNaTnp2Hqj9dYOppyxDUrRX7W xuyx8mL419edDUeInpKKDX9927VxEbZikxp/BDfFWdHnpji3duajYQPhMXjHzVCZNvtCOe/rJT4u0/GBKSoajNsYQ77 Gho&fallback_url=http://pf.phpnuke.org/s/1433875277/en/3/.../39719-1793953-microsoft-office-enterprise-2007-trial-version.rar&downloadAs=microsoft-office-enterprise-2007-trial-version.exe  (1b0b3a216424da818855e3d227f84db9)

The following 17 files have been seen to comunicate with cdn.cleaninstallsthread.com in live environments.

TCP » 72.52.4.91:80
jingling.exe

TCP » 72.52.4.91:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 72.52.4.91:80
crossbrowse.exe (Crossbrowse)

TCP » 72.52.4.91:80
hbpzabffmyx.exe

TCP » 72.52.4.91:80
pbiiuvda.exe

TCP » 72.52.4.91:80
ContentFinder.exe (ContentFinder by DigitalSoftware Group)

TCP » 72.52.4.91:80
winsysapp.exe

TCP » 72.52.4.91:80
chromeplugin.crx

TCP » 72.52.4.91:80
winalert.exe

TCP » 72.52.4.91:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 72.52.4.91:80
autoDENGI.exe (autoDENGI by autodengi.com)

TCP » 72.52.4.91:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 72.52.4.91:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 72.52.4.91:80
emuletorrent.exe

TCP » 72.52.4.91:8080
smu.exe (W by Search Module)

TCP » 72.52.4.91:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

TCP » 72.52.4.91:80
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.