home

dlw646.goforfiles.org

Fundacion Private Whois  (Proxy Registrant)

Domain Information

The domain dlw646.goforfiles.org is registered by proxy through Internet.bs Corp. (R1601-LROR). This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dublin, Dublin City within Ireland which resides on the Amazon Technologies Inc. network.
Registrar:
Internet.bs Corp. (R1601-LROR)

Server location:
Dublin City, Ireland (IE)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
goforfiles.org

Whois:
1 goforfiles.org record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Task.RighwayTechnologies.U, PUP.Installer.RighwayTechnologies.q, PUP.Installer.RighwayTechnologies.d, PUP.Installer.RighwayTechnologies.EE, PUP.Installer.RighwayTechnologies.y, PUP.Installer.RighwayTechnologies.i, PUP.Installer.RighwayTechnologies.a, PUP.Via Advertising (M)
100.00%

Dr.Web
Adware.Downware.4798
66.67%

VIPRE Antivirus
Threat.4925438
66.67%

MicroWorld eScan
Application.Bundler.FO, Gen:Variant.Kazy.503477
66.67%

Malwarebytes
PUP.Optional.Downloader
66.67%

avast!
Win32:Adware-gen [Adw]
66.67%

Bitdefender
Application.Bundler.FO, Gen:Variant.Kazy.503477
66.67%

Comodo Security
Application.Win32.NoGoFiles.A, Application.Win32.EDown.FTVP
66.67%

F-Secure
Application.Bundler.FO, Gen:Variant.Kazy.503477
66.67%

Avira AntiVirus
APPL/Downloader.Gen4
66.67%

G Data
Application.Bundler.FO, Gen:Variant.Kazy.503477
66.67%

AVG
Righway Technologies
66.67%

Lavasoft Ad-Aware
Application.Bundler.FO
55.56%

ESET NOD32
Win32/ExpressDownloader (variant)
55.56%

IKARUS anti.virus
AdWare.Downware
55.56%

The domain dlw646.goforfiles.org has been seen to resolve to the following 2 IP addresses.

54.72.130.67
ns1.ibspark.com
September 14, 2016

74.63.79.82
October 24, 2014

File downloads found at URLs served by dlw646.goforfiles.org.

1 / 68      (Adware)
http://dlw646.goforfiles.org/j5GAZEfk4llpzOZSa8qwbmjVrWxk8fd8Pba8PTy8km4v NRkFeDZaBXgyyxfupgHE XMUwTS3xtXlokBX5peGlrRNlE2gmgdIJ1uID6BYeZzyTPkPml64Gs1O/s e377MX9RqhZ4TPoCZ0P6HjZSzAM6QcMBf1rEA0pJ3QMVDedYXiDW7m8q1 9XJuDkV2zzqEgxtM0pKfahfHP6omZT4KZiUO EJQiEzjUet5dsEtLNakWEglNOiddSSYyLWraXjw7gk6MUus3yFbrG l7kYvM/3SG 56R5o6L bq61lTWu/spzl/.../wkCzM7IxB  (eset_box_mara-fix_v1.7_rar_downloader.exe)

21 / 68    (Adware)
http://dlw646.goforfiles.org/j5GdcW7ZuRBWxqJZb8uiKmHStCs58vd7MLCuciv80Gco 9NlEObPKFO2hDsX4chWHujTF1OSjQVTlqIGXtUyVUqeZBEkmWokMo19GnfAN AilXbsbzM//zJ3Quc1e1WuKmRA9gZjR/.../SUKMDgkH4=  (xflip_professional_2.0_downloader.exe)

1 / 68      (Adware)
http://dlw646.goforfiles.org/j5GjVmHVq1Rp3 ZPa8uiNGHOsWx0qbcvc7b2fTTxz2I1rYYjS6aIL0 7g3RJt5UGBbqHAlfGjRgL1cleDtg5QQzePVExhWsSIsk0Rn7JJaU nWfzPGVr1D9gILx8fFPyOGpM9D1kUOsDKRW5CXRYwAUhAYEGREr0HktO20dcKdYfSDbZ50Rn2OlZa8vuSw6g4Uk7s A5ZJvdYi q yQ sPIlBrz9PgbmkXIZu9kHGJOTb0zJhlFX2odVU9qPTvSS4QTkhKpNucr2RrWe/EipNP0d8zTqs/.../KTRJPUhB7Q1M9Ant2iR6HFoQoxlqpUc9q5TXOFgQgoyOgj  (goforfilesrqo265teuz.exe)

17 / 68    (Adware)
http://dlw646.goforfiles.org/j5GTZE2bilRowqhNfuClLErqkWwn7utlJurveTGOiD1/oMMjUe3Ybxfg2WwY7MJWCK ABVuExFoG1M1ZCs5xEkyYaxIwr2Afe8crCziZd Unn0rzK3B8tm4ifuMza0quaipR8xFPQfQVYBDrAn1Qxx1yUNNcQ1bGUFBZ3CVLLsYQWDfOv3cLnfRRLNPVWz2q7VcKqf19be3iIC6Q8zhc669iVOaTfljrknpf6owtELzGPQaPj1Ac0ocCStbcDbjKiV7gxPtEsMP1EbjH/RqhM/.../iIFNTUhEk=  (vso_convertxtodvd_5.2.0.26_final_downloader.exe)

16 / 68    (Adware)
http://dlw646.goforfiles.org/j5GqUWTZql4txL9QbN2iMGfTuyZ 66knY7f2fSr50nhm tF8S6OGcFK7ny1PtoVFWq/IVgbRzV8F0c5dDM5yBlyFYUp7yT1NdNJ9HjiMf Y8o3zjbzM//yRle kza37nJ3xAqlc2SvcPd0aiXj5Fxx1DXcgBVATfHkFcywlGJMdQTyrapEQtyNlXIsrkTCO6s3sX4eAlOKfJJzGm SM vfFxUPHWNBqEzyRQ55t2QNKfckTXhk5L3pARHLDSCfKbg1zgzvMWvsKgEbTG/.../h5awz4eatP K9kyC7qtB239PhPYrzkHqEvtJCmqGBAYLS1k Dx8lwk8z8ANjY FU=  (office_professional_plus_2013_x64_iso_torrent_downloader.exe)

16 / 68    (Adware)
http://dlw646.goforfiles.org/j5H3BzOA7Ak/n51Nb5OQIHrVoyZmpb1tYrfgfi751Wct tBmF/aaLkS9iWIT4cVSHvqFBkCUlw5Eu5QLB9snB0yNYxErk1YPP4RoQnjecu8nn366ZiZt7yVbdeApfBznNmlE8xF TO9Id0LyTGxV0DF/WtIcVEvSS2N/iQhNIN8hTyne4VsW1ekJe5n XCKc50xo/6NuaPqnamz/rmZT5rg5BIjKMRqzm2QI5ps RtrIOUzehVIc2I9QRNeJDbTLiQ61x/.../SUKMDgkH0=  (2010)_pre_activated_downloader.exe)

1 / 68      (Adware)
http://dlw646.goforfiles.org/j5GXVnDvk1J2651eecumLHzYihV3rbY9c7b7O2n10Gcv NVvEODebQCnmD1DvMxaF XGXhSQmBlCipgdZYFlTg3KcQUjlm8SJat5BjqdLLZon3nuMWskv3BwefwFYE7gKjFR/wdxTegIcVmxCXdchRp4RvgRT0zFAlZEkipjZ8EbTSno4Vwg2O1rI9C3Dne36k8KruJ9avK4cGzhq3lQ/.../Af9uni3yF7d9XnOWId7mGzRaS  (rar_zip_password_remover_downloader.exe)

15 / 68    (Adware)
http://dlw646.goforfiles.org/j5GWfk bilp00OZ7a8ywaFzZtihkpasyPZeyKW6/gCF755NkDODHagjhxi9LqoVRCKiGWgPUyF8G0s5cDtEnAEuObBN/yTBKc8ArDyuKZe0rjkruNj0qrSJ2fOk8YULMKnVV8l8lD/gKfU70VysX1wpvas8dU02WAkxYzh5bL9YKAibY7xY93/VrLtD/ViWx9wERgrQyPKr6Gz6j8ysKjPAjWOWEJA2o T0d4phpQs2fbk3Jg1FKxYddSsnPCd6b3x/tyqRA6sigFeyZ EqhYv0erWLl5Kxu5eWoPeq/.../UU8 Un1uEy9lamdyeWpqR9hF2jas=  (goforfilesyplfosu5mv.exe)

15 / 68    (Adware)
http://dlw646.goforfiles.org/j5GWfk bilp00OZ7a8ywaFzZtihkpasyPZeyKW6/gCF755NkDODHagjhyytZ5cBXH jFUQHTzF8Ql4gNU4w8SgfdMENkgGgJMppoDRWRdb592mH1M2Z/4jVbafYqbRymeG9J/gF7FK9AYEnsNXBe0BohQc8XQV3YGEFJgRlHLJUKSDbo4V881fJGNILOfXex6105mPEsMKj9GzOgp3xHp/o/Or7SbVvqlXpc7ZJ2QNKdckTehUYMiukMHJzSVefD3V/jlqMWu8n2Fb6d8h2mZ/.../seZfxPzOJoLxi3yL7IwXyOzHSJbV2l pzdkSyY61Dpw=  (sim_card_data_recovery_software_v3.0.1.5_downloader.exe)

The following 142 files have been seen to comunicate with dlw646.goforfiles.org in live environments.

TCP » 54.72.130.67:80
simplefilesupdater.exe (SimpleFiles Application by http://simple-files.com/)

TCP » 54.72.130.67:80
yourfileupdater.exe (YourFile Downloader by http://yourfiledownloader.com)

TCP » 54.72.130.67:80
uninstall12590625.exe (YourFile Downloader by http://yourfiledownloader.com)

TCP » 54.72.130.67:80
uninstall5322109.exe (YourFile Downloader by http://yourfiledownloader.com)

TCP » 54.72.130.67:80
yourfileupdater.exe (YourFile Downloader by http://yourfiledownloader.com)

TCP » 54.72.130.67:80
uninstall190602.exe (YourFile Downloader by http://yourfiledownloader.com)

TCP » 54.72.130.67:80
yourfileupdater.exe (YourFile Downloader by http://yourfiledownloader.com)

TCP » 54.72.130.67:80
googleupdate.exe

TCP » 54.72.130.67:80
browserserver.exe

TCP » 54.72.130.67:80
sm.exe (System Monitor)

TCP » 54.72.130.67:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.72.130.67:80
uninstall129231.exe (SimpleFiles Application by http://simple-files.com/)

TCP » 54.72.130.67:80
sfupdater.exe (SimpleFiles Application by http://simple-files.com/)

TCP » 54.72.130.67:80
kometa.exe (Kometa by @COMPANY_FULLNAME@)

TCP » 54.72.130.67:80
TBNotifier.exe (Ask TBNotifier by APN)

TCP » 54.72.130.67:80
pepperzip.exe

TCP » 54.72.130.67:80
internetenhancer.exe (Internet Enhancer)

TCP » 54.72.130.67:80
ssn.exe (ssn)

TCP » 54.72.130.67:443
mintcast_updater_service.exe (AutomaticUpdater)

TCP » 54.72.130.67:80
yacqq.exe

 
Latest 20 of 154 files

URL:
http://dlw646.goforfiles.org/

Web server:
nginx/1.2.1

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.