inst.express-files.com

Faglaro Enterprises Limited

Domain Information

The domain inst.express-files.com registered by Faglaro Enterprises Limited was initially registered in December of 2011 through INTERNET.BS CORP.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Saint Helens, Oregon within the United States which resides on the Hosting Services, Inc. network.
Registrar:
INTERNET DOMAIN SERVICE BS CORP

Server location:
Oregon, United States (US)

Create date:
Tuesday, December 06, 2011

Expires date:
Tuesday, December 06, 2016

Updated date:
Saturday, December 12, 2015

Root domain:

Google Safe Browsing:
unwanted

Scanner detections:
Detections  (97% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.FaglaroEnterprisesLimited.Q, PUP.FaglaroEnterprisesLimited.R, PUP.FaglaroEnterprisesLimited.T, PUP.FaglaroEnterprisesLimited.P, PUP.FaglaroEnterprisesLimited.J, PUP.FaglaroEnterprisesLimited.z, PUP.Blisbury.FaglaroEnterprises.Bundler (M), Threat.Win.Reputation.IMP
100.00%

ESET NOD32
Win32/ExpressFiles (variant)
89.47%

VIPRE Antivirus
ExpressFiles Installer, Trojan.Win32.Generic
86.84%

avast!
Win32:Downloader-TSH [PUP], Win32:Expressfiles-D [PUP], Win32:Expressfiles-A [PUP]
73.68%

Sophos
Express Files
65.79%

Trend Micro House Call
TROJ_GEN.F47V0530, TROJ_GEN.F47V0921, TROJ_GEN.F47V0220, TROJ_GEN.F47V0827, TROJ_GEN.F47V0721, TROJ_SPNR.08CP13, TROJ_GEN.F47V1101, HV_ZYX_CA23482D.TOMC, TROJ_GEN.F47V0403
63.16%

McAfee
Artemis!84E59B50E960, Artemis!27B22C7D66ED, Artemis!4AE5BF86A142, Artemis!F3A1CAB60B34, Artemis!93AB60794E97, Artemis!033BB3343FEC, Artemis!EA81253AFDD0, Artemis!8872DAA5CBFB, Artemis!F5676EC6F752, Artemis!EB7066FD33CC, Artemis!146F4EAC6D2C, Artemis!85B977E971D7
60.53%

McAfee Web Gateway
Artemis!84E59B50E960, Artemis!27B22C7D66ED, Artemis!4AE5BF86A142, Artemis!F3A1CAB60B34, Artemis!93AB60794E97, Artemis!033BB3343FEC
60.53%

Kingsoft AntiVirus
Win32.Troj.Generic.a.(kcloud), Win32.Heur.KVMF7.hy.(kcloud)
60.53%

K7 AntiVirus
Riskware, Unwanted-Program, Unwanted-Program
44.74%

K7 Gateway Antivirus
Riskware, Unwanted-Program, Unwanted-Program
44.74%

AVG
MalSign.Faglaro Enterprises Limited, Suspicion: unknown virus, Dropper.Generic8
44.74%

Malwarebytes
PUP.Optional.ExpressFiles.A
42.11%

AhnLab V3 Security
PUP/Win32.ExpressFiles
39.47%

G Data
Win32.Application.ExpressFiles
36.84%

The domain inst.express-files.com has been seen to resolve to the following 3 IP addresses.

199.195.196.180.static.midphase.com
October 29, 2015

January 14, 2014

199.195.196.181.static.midphase.com
December 26, 2013

File downloads found at URLs served by inst.express-files.com.

3 / 68      (Adware)
http://inst.express-files.com/j5GjTyLXvElzlLhRZteyKC7fuiN34LglcrayJn7ulj53qNhiEuTPKFO2mjJDvMxaF zFXxSUilYH18hWAtw5RQzd  (microsoft_office_2007_sp3_blue_edition-digital_activated_updatable_downloader_gb_99008.exe)

12 / 68    (Adware)
http://inst.express-files.com/.../jDp68ddnEPaaLkSjgDZO5dcXE7o=  (modello_relazione_iniziale_sulla_situazione_della_classe_doc_downloader.exe)

6 / 68      (Adware)
http://inst.express-files.com/j5GIVnDfplUmge0SKuu LWnP9QZwr6w/No68IX/oyWEu/.../oIWTKuYDlbdwFIE3c9JTps8Qg3aMER3xDpNdA==  (telecharger_keygen_two_worlds_pirates_of_fortress_downloader_il_99292.exe)

9 / 68      (Adware)
http://inst.express-files.com/.../Tn3J  (reaper_license_txt_file_crack_downloader_ca_99259.exe)

1 / 68      (Adware)

0 / 68

1 / 68      (Malware)
http://inst.express-files.com/j5GpWHGQp/m8he1bb5i9LH2c4XcysKsieKe0P3ukhCA /.../fMkRzwzFDccA=  (los_nº1_de_los_40_principales_2013_downloader_es_99260.exe)

17 / 68    (Adware)

20 / 68    (Adware)

17 / 68    (Adware)

9 / 68      (Adware)

17 / 68    (Adware)

17 / 68    (Adware)

14 / 68    (Adware)

 
Latest 30 of 218 download URLs

The following 19 files have been seen to comunicate with inst.express-files.com in live environments.

URL:
http://inst.express-files.com/

Title:
“SmileFiles”

Web server:
nginx/1.2.1 (PHP/5.4.45-0+deb7u2)

Facebook:
Shares:  3

Statistics are for the previous month.