home

coolany.org

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain coolany.org is registered by proxy through PDR Ltd. d/b/a PublicDomainRegistry.com. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR Ltd. d/b/a PublicDomainRegistry.com

Server location:
Virginia, United States (US)

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
2 coolany.org records

Scanner detections:
Detections  (92% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Bundler.InstallCore, PUP.NewMedia.Installer.New Media Holdings.Installer (M), PUP.installCore (M), PUP.NewMedia.NMH.Bundler (M), PUP.InstallCore.RE48 (M), PUP.InstallCore.RES (M)
90.91%

ESET NOD32
Win32/InstallCore.ZC potentially unwanted application, Win32/InstallCore.YW potentially unwanted application, Win32/InstallCore.YH potentially unwanted application
36.36%

VIPRE Antivirus
Threat.5084491, Threat.4150696, Threat.4786018
27.27%

Dr.Web
Trojan.InstallCore.592, Trojan.InstallCore.563, Trojan.InstallCore.45
27.27%

avast!
Trojan-gen
18.18%

Agnitum Outpost
Trojan.Badur, PUA.InstallCore
18.18%

K7 AntiVirus
Adware , Unwanted-Program
18.18%

Trend Micro House Call
Suspicious_GEN.F47V0519, Suspicious_GEN.F47V0521
18.18%

Baidu Antivirus
Adware.Win32.InstallCore
18.18%

Avira AntiVirus
TR/Starter.Y, ADWARE/InstallCo.zkh
18.18%

Zillya! Antivirus
Trojan.Badur.Win32.29506
9.09%

herdProtect (fuzzy)
a variant of 99d1fe85c9df64484d3b713da946c1d9e0e12361
9.09%

NANO AntiVirus
Riskware.Win32.InstallCore.drfvvl
9.09%

McAfee
Artemis!99A33EDF3F45
9.09%

Fortinet FortiGate
Riskware/InstallCore
9.09%

The domain coolany.org has been seen to resolve to the following 6 IP addresses.

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
January 29, 2016

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
January 29, 2016

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
January 29, 2016

54.209.232.94
ec2-54-209-232-94.compute-1.amazonaws.com
May 6, 2015

54.236.147.238
ec2-54-236-147-238.compute-1.amazonaws.com
May 6, 2015

54.84.140.114
ec2-54-84-140-114.compute-1.amazonaws.com
May 6, 2015

File downloads found at URLs served by coolany.org.

1 / 68      (PUP)
http://coolany.org/?dl=1&pi=Ajg4NzcRNzg0Ni==&osos=VdluDrW3cw==&gclid=CIvx59GW-cQCFQMQ7AodfzAARQ&dr=7Kxu T1Y73vl7Xxp2mVWvmt3hXtGDXl3 3vCfSDt2Z1Y K507dP0eXslfSDt j1YcrRP7dVtDKF0fSDj2Z1Y2r5yDdV0fSDu2Z1YIKDZ dF0DKF0OCxWedlmLdVPcmNoOlxWvmV4cHaWed5jDKlCfSDPcZ1Y7Kxw 3Np2rlJ E0mDH7Wedxl2mljDX0mcHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthKFC2ZLmc3aWc3vjvmCWcyDEcmlChSDBDz1w2kDj7z1kLQDj rcWcHim7z0RvmiWAkDjIKiWXznwNT7FNzAdAQDPDdlChV8RAjg1AZA4NzidAS7R&pd=2323UmPlcmLt2SFj d0=&campaignId=9jn0AjCRAjC4AZMq  (windowsmoviemakersetup.exe)

1 / 68      (PUP)
http://coolany.org/?dl=1&pi=Ajg4NzcyAj7wNg==&osos=VdluDrW3cw==&gclid=CKaUoK3K-8QCFerm7AodIxMAFg&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWi0nm7dREhKVuvmAWASDChTMm7dlChV8dNTC3AjnwNzAm7K2pDZ1fNjCRNjC0OZi1OZn=&pd=cdVlDrW3 mRJ7Kiu7dWt&campaignId=9jn0AjCyATadAZMq  (minecraftsetup.exe)

1 / 68      (PUP)
http://coolany.org/?dl=1&pi=AzA3Aj7dAzgdNw==&osos=VdluDrW3cw==&gclid=CjwKEAjwx9KpBRCAiZ_tgYKWvhQSJABQjGW-OzNjMQgduG0RuY-df48hjYl9aOhu7NxZlAU_XwFPgRoC68rw_wcB&dr=cHaWck1q7XDPvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAzLwOTMRNjAyvm5EIKiWXzA1AZLzNjgwNz7R&pd=2XNlUKxJ2dFB d5CUmNJ i==&campaignId=9jn0AjC1NTgyAZMq  (javaruntimeenvironmentsetup.exe)

1 / 68      (PUP)
http://coolany.org/?dl=1&pi=AT7zNZC3Ajc3Ai==&osos=VdluDrW3cw==&gclid=CIvdu8zqusUCFVKUfgod5QUAyQ&dr=cHaWck1z2rVP SD0 T1z2dVl2ZCmc3aWc3vjvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXziwNTiyATA3AQDPDdlChV80NZA1Azn4OZMyAg==&pd=IKFz2r5B HAt7mVlUmNJ i==&campaignId=9jn0AznzOZLyAZMq  (steamsetup.exe)

1 / 68      (PUP)
http://coolany.org/?dl=1&pi=Ajg4NzcRNTMFNM==&osos=VdluDrW3cw==&gclid=CKXknLXD-sQCFQIQ7AodH0cAPw&dr=cHaWck1q7XDPvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fAzLwOTMRNjAyvm5EIKiWXzA1AZARNzgwNz7R&pd=2XNlUKxJ2dFB d5CUmNJ i==&campaignId=9jn0AjCRNz7dAZMq  (javaruntimeenvironmentsetup.exe)

1 / 68      (Adware)
http://coolany.org/?dl=1&pi=Ajg4NzcRNZA3OM==&osos=VdluDrW3cw==&gclid=CjwKEAjwru6oBRDDp4jRj4bL_xASJADJ2obyuAnHsn6m0rFin9ls1_ZMwtKIgWSszK8mcVB0BJgA0BoCRTnw_wcB&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDK4m7dAWx0am7dREhKVuvmAWASDChTMm7dlChV8FNZa4AZc1Njam7K2pDZ1fOTaRATL4NjLFNTn=&pd=IKFz2r5B HNlDSFj d0=&campaignId=9jn0AjcFNTi0AZMq  (minecraftsetup.exe)

0 / 68
http://coolany.org/?dl=1&pi=ATLdNZ7dAjC0Ng==&osos=VdluDrW3cw==&gclid=Cj0KEQjwpM2pBRChsZCzm_CU0t4BEiQAxDVFmnxMEp2flkO4wAtxqRwyedfkJCMwnQuQi1-B-3QKBDoaAiiY8P8HAQ&dr=cHaWck1q7XDPvExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKl0vmNjhLlLvmNBDz1p2kDjhTnmDZ0wvmNpDZ1fAzC3OTgdOTiyvm5EIKiWXzAzAjcRAj71NZny&pd=2XNlIKFz2r5B kFj d0=&campaignId=9jn0AjC0OZi0AZMq  (jre-7u60-windows-i586.exe)

1 / 68      (PUP)
http://coolany.org/?dl=1&pi=Ajg4NzcRNzc0OM==&osos=VdluDrW3cw==&gclid=CMGn462C_cQCFQiWtAodEWEAHQ&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDrLm7dAWxnLm7dREhKxlvmAWASDChTMm7dlChV8RNZiyNZL3NZam7K2pDZ1fATi0AZA3OTMdAZa=&pd= dFlUKxJ2dFB d5CUmNJ i==&campaignId=9jn0AjCyNjnyAZMq  (minecraftsetup.exe)

13 / 68    (Adware)
http://coolany.org/?dl=1&pi=Ajg4NzcRAzL3Aw==&osos=VdluDrW3cw==&gclid=COXqlrPc5sQCFcXItAodMggALQ&dr=cHaWck1NIKFl73vPDEim2r0Wc32lDXiFvENyhXNy7yDphXAmD3vpDZ0m rcWDEam7dAWxlam7dREhKDyvmAWASDChTMm7dlChV8yNjL0OTnwOTam7K2pDZ1fAj7FNjg0ATc4AZa=&pd= mW3UXNlDSFj d0=&campaignId=9jn0Ajg0OT7yAZMq  (minecraftsetup.exe)

6 / 68      (PUP)
http://coolany.org/?dl=1&pi=Ajg4NzcyAZgzAw==&osos=VdluDrW3cw==&gclid=CjwKEAjw3sKpBRDJ7rDqzsyuhDASJACZAikiuip3nSGXmoyAcAlGBBFl3CKiP7n7VKvgZxzDbPOIEBoCLprw_wcB&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVpsvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAZL3OZi3ATgyvm5EIKiWXzMFNzMdAjAdNjny&pd=7KN0IXDlUKluc3xP rRzUEVzUmNJ i==&campaignId=9jn0AjCyNTC0AZMq  (firefoxsetup.exe)

11 / 68    (PUP)
http://coolany.org/?dl=1&pi=Ajg4NzcRNT7wNw==&osos=VdluDrW3cw==&gclid=CjwKEAjwjKOpBRChjsTyicbFy3QSJADP1gTN3pn6NEEyyYjOE2hn_Ti3PXwVt1GAenrqWitb5oORLxoCNEnw_wcB&dr=cHaWck1mIXvlDmW4vExthXN3DKV0OSDzcj1zcmAmIT1zvm2yIKiWvmREhXxyvmNjhVxSvmNBDz10cQDjhTnmDZ0wvmNpDZ1fNzczNZa3NZLyvm5EIKiWXzc1AZMzNz73OZ7R&pd=DdWJDHxPIdLu 3vE&campaignId=9jn0Ajg3NjM4AZMq  (firefoxsetup.exe)

7 / 68      (PUP)
http://coolany.org/?dl=1&pi=Ajg4NzcRNzA4Ni==&osos=VdluDrW3cw==&gclid=Cj0KEQjwpM2pBRChsZCzm_CU0t4BEiQAxDVFml9XflX49u2OoQEhYhjfLTvAh0MXNr8VL0OtuUh4ZRMaAh0X8P8HAQ&dr=cHaWck1j7dRl7KFlcQD0 T1z2dVl2ZCmc3aWc3vjvmCWcyDEcmlChSDBDz1l QDj7z1HiQDj rcWDK4m7z0RvmiWAkDjIKiWXzMzNZnFAzA4AQDPDdlChV8wATCyOTARNZcRAg==&pd=DdWP rvlc3iu 3vE&campaignId=9jn0AjC0Aj74AZMq  (ccleanersetup.exe)

The following 3 files have been seen to comunicate with coolany.org in live environments.

TCP » 54.84.143.69:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80
notifier64.exe (Notifications)

TCP » 54.84.143.69:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

URL:
http://coolany.org/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.