home

codepackjav.batrewoom.com

Domain Information

Server location:
Madrid, Spain (ES)

Root domain:
batrewoom.com

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.FreeDownloadFriedCookie.W, PUP.Outbrowse.Bestapp.Bundler (M)
100.00%

ESET NOD32
Win32/InstallCore.UE potentially unwanted application
50.00%

Dr.Web
Trojan.InstallCore.15
50.00%

VIPRE Antivirus
Threat.4150696
50.00%

Kaspersky
not-a-virus:Downloader.Win32.FrieCook
50.00%

Malwarebytes
PUP.Optional.FriedCookie
50.00%

K7 AntiVirus
Unwanted-Program
50.00%

Comodo Security
Application.Win32.InstallCore.KRD
50.00%

Avira AntiVirus
ADWARE/InstallCore.Gen7
50.00%

AVG
Generic
50.00%

The domain codepackjav.batrewoom.com has been seen to resolve to the following 2 IP addresses.

93.189.35.250
January 11, 2015

93.189.35.249
January 11, 2015

File downloads found at URLs served by codepackjav.batrewoom.com.

1 / 68      (Adware)
http://codepackjav.batrewoom.com/.../download?p=MATOMY-SDD&trckid=131745|20N.YF4aMx3YPsLa3ibPhf1y31sM000.&affid=697643&sdd=1&ce_cid=20N.YF4aMx3YPsLa3ibPhf1y31sM000.  (installer_java_portuguese.exe)

10 / 68    (Adware)
http://codepackjav.batrewoom.com/.../download?p=MATOMY-SDD&trckid=131745|20AW3O4kQgZaNd8z1zHEOn1y3mP2000.&affid=30679&sdd=1&ce_cid=20AW3O4kQgZaNd8z1zHEOn1y3mP2000.  (installer_java_english.exe)

The following file have been seen to comunicate with codepackjav.batrewoom.com in live environments.

TCP » 93.189.35.249:80
banaduy.exe (Maskaseft Visual Studio 2010 by Maskaseft)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.