» ember.cdburnerxp.se
Overview
Analysis
IPs Addresses (2)
Downloads (63)
Network (1)
Website Detail
Statistics

ember.cdburnerxp.se

stehag0702-00009

Domain Information

This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Berlin, Berlin within Germany which resides on the RIPE Network Coordination Centre network.

Registrant:

stehag0702-00009

Registrar:

SE Direkt

Server location:

Berlin, Germany (DE)

ASN:

AS24940 HETZNER-AS Hetzner Online GmbH,DE

Root domain:

cdburnerxp.se

Whois:

1 cdburnerxp.se record

Scanner detections:

Detections (66% detected)

Scan engine

Details

Detections

ESET NOD32

Win32/OpenCandy, Win32/Bundled.Toolbar.Ask (variant), Win32/OpenCandy (variant), Win32/OpenCandy.C potentially unsafe (variant)

87.88%

Reason Heuristics

PUP.OpenCandy.Installer (L)

60.61%

Dr.Web

Adware.OpenCandy.3, Adware.OpenCandy.7, Adware.OpenCandy.39, Adware.OpenCandy.137, Threat.Undefined

36.36%

Sophos

OpenCandy, PUA 'OpenCandy', OpenCandy (PUA)

18.18%

Baidu Antivirus

Adware.Win32.OpenCandy

18.18%

NANO AntiVirus

Trojan.Win32.OpenCandy.cumlgz, Trojan.Win32.OpenCandy.cuexth, Riskware.Win32.OpenCandy.cyducd, Riskware.Win32.OpenCandy.dqxwfl

15.15%

Agnitum Outpost

Riskware.OpenCandy, Riskware.Agent

15.15%

Bkav FE

W32.Clod43a.Trojan, W32.HfsAdware

12.12%

Trend Micro House Call

TROJ_GEN.F47V0422, TROJ_GEN.F47V0530, Suspicious_GEN.F47V0808, Suspicious_GEN.F47V0531

12.12%

Microsoft Security Essentials

Adware:Win32/OpenCandy

9.09%

ESET NOD32

Win32/OpenCandy.A potentially unsafe application, Win32/OpenCandy.C potentially unsafe application

9.09%

Fortinet FortiGate

Riskware/OpenCandy

9.09%

Quick Heal

Adware.OpenCandy (Not a Virus)

6.06%

K7 AntiVirus

Trojan , Unwanted-Program

6.06%

Kaspersky

not-a-virus:AdWare.Win32.OpenCandy

6.06%

The domain ember.cdburnerxp.se has been seen to resolve to the following 2 IP addresses.

136.243.175.196

ex41.cdburnerxp.se

February 3, 2016

174.37.194.130

ember.cdburnerxp.se

December 22, 2013

File downloads found at URLs served by ember.cdburnerxp.se.

0 / 68

https://ember.cdburnerxp.se/cdbxp_setup_4.5.0.3717.exe (1b9888881862057670af10cf8b0f9ef8)

0 / 68

http://ember.cdburnerxp.se/cdbxp_setup_4.5.7.6229.exe (2da4e234799172fcb9d62a618b2add4f)

0 / 68

http://ember.cdburnerxp.se/cdbxp_setup_4.5.6.5931.exe (1033b978f05bb7dfa398209f09abe8da)

0 / 68

https://ember.cdburnerxp.se/cdbxp_setup_4.5.1.4003.exe (7d8c285a9d4d486729ad97d1c9bebbd0)

0 / 68

http://ember.cdburnerxp.se/cdbxp_setup_4.5.7.6139.exe (342b94173017d30eb3158bd7fb3f6f03)

3 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.4.1.3341.exe (6ee067c51266976f1fc3bc87d7bfc97f)

1 / 68 (inconclusive)

http://ember.cdburnerxp.se/cdbxp_setup_4.3.2.2140.exe (8a545a5402fdd7ff0726c27a802f5a49)

4 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.5.6.6059.exe (tmp8eb9.tmp)

0 / 68

https://ember.cdburnerxp.se/cdbxp_setup_4.5.4.5306.exe (33f650da43ba754995785c17509832ba)

6 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.5.5.5642.exe (ed688a0baade87e18a4eda860ae9c6ec)

4 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.4.1.3184.exe (9f49153ac27495831c679b078cadaae9)

4 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.3.8.2474.exe (6bb172ef7dd31ec30d7bdc9aed22d40d)

4 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.5.5.5666.exe (f827a77c4a70f471e5c529d791a2b474)

6 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.3.7.2307.exe (6c9d9d15b2dd6971e143bf5fc949040e)

3 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.5.4.5143.exe (62df4a295b860c5e359c03e116aa86ed)

11 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.5.5.5790.exe (594e3c1bde17de0a96fbe6b1359fe926)

2 / 68

http://ember.cdburnerxp.se/cdbxp_setup_4.5.5.5571.exe (22188b22be5aba25102b0d0ec0ea2553)

2 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.4.0.2838.exe (fd27beb5b55c5bd935dad3dc7160281f)

7 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.5.6.5844.exe (ac777821bcde0a95d6dd09ca8c49e46d)

5 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.5.5.5767.exe (a302f56dd2b4ebbb7090d66006510d9c)

2 / 68

https://ember.cdburnerxp.se/cdbxp_setup_4.5.5.5571.exe (22188b22be5aba25102b0d0ec0ea2553)

3 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.5.4.5306.exe (a47a07b4e6cbcb214ecc87d5683dc29c)

2 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.4.0.2968.exe (f7a462fa2dee7126e0d18471dcfcbeba)

0 / 68

http://ember.cdburnerxp.se/cdbxp_setup_4.5.4.5118.exe (8aecdd399f7757cba324f39a7a84b33a)

0 / 68

https://ember.cdburnerxp.se/cdbxp_setup_4.5.4.5118.exe (8aecdd399f7757cba324f39a7a84b33a)

3 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.5.4.4954.exe (a373370c5ce41f67ca5ed6b567e0dbaf)

2 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.4.1.3099.exe (3579c370c69929ae7056ab63e712d0bd)

3 / 68 (PUP)

https://ember.cdburnerxp.se/cdbxp_setup_4.5.4.5143.exe (62df4a295b860c5e359c03e116aa86ed)

5 / 68 (PUP)

http://ember.cdburnerxp.se/cdbxp_setup_4.3.7.2423.exe (5b424a41f98305b65b1d3b99ad89e631)

1 / 68

https://ember.cdburnerxp.se/cdbxp_setup_4.5.4.5067.exe (20ad7c7ac4d12a22121ad2741fe611a7)

Latest 30 of 63 download URLs

The following file have been seen to comunicate with ember.cdburnerxp.se in live environments.

TCP » 174.37.194.130:443

sogouexplorer.exe (by Sogou.com)

URL:

http://ember.cdburnerxp.se/

Title:

“Index of /”

SSL certificate subject:

CN=*.cdburnerxp.se, OU=Domain Control Validated - RapidSSL(R), OU=See www.rapidssl.com/resources/cps (c)15, OU=GT94255428

SSL certificate issuer:

CN=RapidSSL SHA256 CA - G3, O=GeoTrust Inc., C=US

Web server:

Apache

Compete.com:

US visitors: 1,051

Statistics are for the previous month.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.