home

download-for-u.org

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain download-for-u.org is registered by proxy through PDR Ltd. d/b/a PublicDomainRegistry.com. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR Ltd. d/b/a PublicDomainRegistry.com

Server location:
Virginia, United States (US)

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
2 download-for-u.org records

Scanner detections:
Detections  (91% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Bundler.InstallCore, PUP.InstallCore.Internet.Installer.Meta (M), PUP.installCore (M), PUP.NewMedia.Installer.installCore.Installer (M), PUP.InstallCore (M), PUP.NewMedia.NMH.installCore.Installer (M), PUP.InstallCore.RES (M), PUP.NewMedia.NMH.Bundler (M), PUP.NewMedia.NMH (M)
95.24%

ESET NOD32
Win32/InstallCore.ZC potentially unwanted application, Win32/InstallCore.ACZ potentially unwanted application, Win32/InstallCore.ZM potentially unwanted application
14.29%

avast!
Malware-gen
9.52%

VIPRE Antivirus
Trojan.Win32.Generic, InstallCore
9.52%

Baidu Antivirus
Adware.Win32.InstallCore
9.52%

Qihoo 360 Security
HEUR/QVM06.1.Malware.Gen
9.52%

Malwarebytes
PUP.Optional.InstallCore, PUP.Optional.InstallCore.A
9.52%

K7 AntiVirus
Adware
9.52%

NANO AntiVirus
Riskware.Win32.InstallCore.dyofgk, Riskware.Win32.InstallCore.dsgvyn
9.52%

Trend Micro House Call
Suspicious_GEN.F47V0506
4.76%

herdProtect (fuzzy)
a variant of 4d20e76eff7b49f8013f251f61d276f7d4819ba9
4.76%

Zillya! Antivirus
Worm.Allaple.Win32.25095
4.76%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
4.76%

G Data
Win32.Application.InstallCore.EG
4.76%

Bkav FE
W32.HfsAdware
4.76%

The domain download-for-u.org has been seen to resolve to the following 6 IP addresses.

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
November 18, 2015

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
November 18, 2015

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
November 18, 2015

54.236.147.238
ec2-54-236-147-238.compute-1.amazonaws.com
May 7, 2015

54.84.140.114
ec2-54-84-140-114.compute-1.amazonaws.com
May 7, 2015

54.209.232.94
ec2-54-209-232-94.compute-1.amazonaws.com
May 7, 2015

File downloads found at URLs served by download-for-u.org.

1 / 68      (Adware)
http://download-for-u.org/?dl=1&pi=AznzNZM0AZgFNg==&osos=VdluDrW3cw==&chnl=&dr=c3aW7mcm2r0Wc32lDXimcHaWck1E dWE rLtDK5y2rgmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fATMyOZC4AZCRvm5EIKiWXzawNza3NzAyNZa=&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0Aza3NjL4AZMq  (googleearthsetup.exe)

1 / 68      (PUP)
http://download-for-u.org/?dl=1&pi=ATC3Nji0AZgzAg==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1wIrW0 3Nj7XslvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzAwOZCdOTMFASDPDdlChV8RATiFOTa4AZaz&pd=2323UEVwUKluc3xP rwu7dWt&campaignId=9jn0Aza0NTi0AZMq  (photoscapesetup.exe)

1 / 68      (PUP)
http://download-for-u.org/?dl=1&pi=AjM1NzLzNjgdNM==&osos=VdluDrW3cw==&dr=cHaWck13IKF6IXMm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzLzAj7RAzn0ASDPDdlChV8zAjn0AjAzATMz&pd=2323UmxJ2dFB d5CDdWP HAu7dWt&campaignId=9jn0AjC4ATLdAZMq  (winzipsetup.exe)

1 / 68      (Adware)
http://download-for-u.org/?dl=1&pi=ATAyNTg0AZ7ROi==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1p2kDj7z1vVkDj rcWIXim7z0RvmiWAkDjIKiWXzMFAja1OZMFASDPDdlChV8ROTcwAzcFATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AznzNTgyAZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://download-for-u.org/?dl=1&pi=Ajg4NzcyAzi3Ai==&osos=VdluDrW3cw==&dr=cHaWck1w 32lcEsJIKF0UXDpDX2lcQD0 T1z2dVl2Zamc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fOTCzNZA4AZCRvm5EIKiWXzMyNZa1NTgRNZa=&pd=2323Um2l2k11cdLu7dWt&campaignId=9jn0Ajg0AZ7yAZMq  (powerpointviewersetup.exe)

1 / 68      (Adware)
http://download-for-u.org/?dl=1&pi=ATL4OTCFOTcdNi==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhL2kvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAjczNjC4AZCRvm5EIKiWXzCFAzCzNTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0AzLROTcdAZMq  (popcorntimesetup.exe)

1 / 68      (Adware)
http://download-for-u.org/?dl=1&pi=ATi3AzC0OTg1Ai==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1E dWE rLtDK5y2rgmIT1zvm2yIKiWvmREhKVzvmNjhLVTvmNBDz1lcyDjhTnmDZ0wvmNpDZ1fNzCROZC4AZCRvm5EIKiWXzC1AZndNzAyNZa=&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0AzMFNZiyAZMq  (googleearthsetup.exe)

1 / 68      (Adware)
http://download-for-u.org/?dl=1&pi=OZgyAjAFNj7=&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1HiQDj rcWDK4m7z0RvmiWAkDjIKiWXzgFNz7dOTMFASDPDdlChV8yOTM0OZ73AZaz&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0AzaFNzgyAZMq  (windowsmoviemakersetup.exe)

1 / 68      (Adware)
http://download-for-u.org/?dl=1&pi=ATi0OZiRNZ7ROM==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhLFAvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNzn0NjC4AZCRvm5EIKiWXzcRNZA1NTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0AzLyNzn0AZMq  (popcorntimesetup.exe)

1 / 68      (PUP)
http://download-for-u.org/?dl=1&pi=Ajg4NzcRNZAdAi==&osos=VdluDrW3cw==&dr=cHaWck1tIKFl73vPDEim2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzgyATMzOZMFASDPDdlChV8RAziyAja4ATiy&pd=2323UmRlDdVuDrVyeS1PcHszUmNJ i==&campaignId=9jn0Ajg4NTM4AZMq  (minecraftsetup.exe)

1 / 68      (Adware)
http://download-for-u.org/?dl=1&pi=Ajg4NzcRAzg0Aw==&osos=VdluDrW3cw==&dr=cHaWck1zcrW0IKDFvExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8RAZadNjARNZnm7K2pDZ1fNZ7dOZg1NTnwAw==&pd=2323UEVw rWPDk1E d2JUmNJ i==&campaignId=9jn0AjcdNjnwAZMq  (spotifysetup.exe)

1 / 68      (PUP)
http://download-for-u.org/?dl=1&pi=ATiRNzayOTi4NM==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1q7XDPvmCWcyDEcmlChSDBDz1lcyDj7z15LyDj rcWDXAm7z0RvmiWAkDjIKiWXz7RNZidOTMFASDPDdlChV8zATA3AZA3AZaz&pd=2323UmxJ2d4tDdV0UmNJ i==&campaignId=9jn0AjC3Az70AZMq  (javaruntimeenvironmentsetup.exe)

1 / 68      (PUP)
http://download-for-u.org/?dl=1&pi=Ajg4NzcyAj7yAM==&osos=VdluDrW3cw==&dr=cHaWck1tIKFl73vPDEim2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1nSyDj rcWDK4m7z0RvmiWAkDjIKiWXzM0OTCyOZMFASDPDdlChV8yNz70ATa4ATiy&pd=2323UmRlDdVuDrVyeS1PcHszUmNJ i==&campaignId=9jn0Ajg3OTLwAZMq  (minecraftsetup.exe)

1 / 68      (Adware)
http://download-for-u.org/?dl=1&pi=AjcyAj7dOTC4Ai==&osos=VdluDrW3cw==&chnl=&dr=cHaWck1Q HVlc3xP7dtzvExthXN3DKV0NkDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8RNzL4NzgwOTnm7K2pDZ1fAzCFNji4ATa0Ag==&pd=2323Um5wcHAt mV3UmNJ i==&campaignId=9jn0Aza1OZcdAZMq  (bluestackssetup.exe)

0 / 68
http://download-for-u.org/?dl=1&pi=ATadATnROTa1Ng==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1z2rVP SDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8FOZLdNjCwOTnm7K2pDZ1fAZAwAzadNzMyAw==&pd=2323UmxJ2d4t7XswcyFj d0=&campaignId=9jn0AznFAjA0AZMq  (steaminstall.msi)

1 / 68      (PUP)
http://download-for-u.org/?dl=1&pi=AzM1NzCdOZL1Nw==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzM1NziFOZMFASDPDdlChV8wATaRNzazAjiy&pd=2323UmDyDKVBDK2l mxPcECu7dWt&campaignId=9jn0AzMwNZMdAZMq  (teamviewersetup.exe)

1 / 68      (PUP)
http://download-for-u.org/?dl=1&pipi=Ajg4NzcRNZAdAi==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1wIKNPcdnmIT1zvm2yIKiWvmREhKVuvmNjhL55vmNBDz1l QDjhTnmDZ0wvmNpDZ1fOZgzAjARATiRvm5EIKiWXz7wOTn1NTAyNja=&pd=2323Um1J2rCt rVEDKFC7XvFUmNJ i==&campaignId=9jn0Aj74NjL0AZMq  (picasasetup.exe)

13 / 68    (Adware)
http://download-for-u.org/?dl=1&pi=AzA3NT7FOZawAw==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1w2kDj7z1kLQDj rcWcHim7z0RvmiWAkDjIKiWXz7zNjazOZMFASDPDdlChV83NTiwNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0Aza0AZiwAZMq  (GoogleChromeSetup.exe)

1 / 68      (PUP)
http://download-for-u.org/?dl=1&pi=Ajg4NzcyNZgdNw==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1TxyDj rcWDK4m7z0RvmiWAkDjIKiWXzCRAzAzOZMFASDPDdlChV8dNjgyNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AjCwATgyAZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://download-for-u.org/?dl=1&pi=ATnRAjgzAZc0Ag==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1zcrW0IKDFvExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8RAzM3NjCwOTnm7K2pDZ1fAzAFNj73NzMyAw==&pd=2323UmxJ2dFB d5CDrW3 QFj d0=&campaignId=9jn0AziRAzMyAZMq  (spotifysetup.exe)

0 / 68
http://download-for-u.org/?dl=1&pi=ATayNji4NTa4OM==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzAdNz7dOTMFASDPDdlChV80OTg3Nz73AZaz&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0AzLzAZc0AZMq  (windowsmoviemaker_setup.exe-setup.website)

8 / 68      (PUP)
http://download-for-u.org/?dl=1&pi=ATaFAZM3AZ7wOM==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=c3aW7mcm2r0Wc32lDXimcHaWck1q7XDPvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzMFAzidOTMFASDPDdlChV80AzgRAZA3AZaz&pd=2323UmxJ2d4tDdV0UmNJ i==&campaignId=9jn0AzAwAZA0AZMq  (javaruntimeenvironmentsetup.exe)

8 / 68      (PUP)
http://download-for-u.org/?dl=1&pi=ATa4Aja1AjMzNw==&osos=VdluDrW3cw==&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8yAZM4AZMROTnm7K2pDZ1fOTgyAzMyNTnyAw==&pd=2323Um2l2k1oDXvlUmNJ i==&campaignId=9jn0AzM1NTCwAZMq  (openofficesetup.exe)

The following 3 files have been seen to comunicate with download-for-u.org in live environments.

TCP » 54.84.143.69:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80
notifier64.exe (Notifications)

TCP » 54.84.143.69:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

URL:
http://download-for-u.org/

Title:
“File-Opener”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.