home

jdcdn2com.blob.core.windows.net

Microsoft Corporation

Domain Information

The domain jdcdn2com.blob.core.windows.net registered by Microsoft Corporation was initially registered in August of 1995 through MARKMONITOR INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Sao Paulo, Sao Paulo within Brazil which resides on the Latin American and Caribbean IP address Regional Registry network.
Registrar:
MARKMONITOR INC.

Server location:
Sao Paulo, Brazil (BR)

Create date:
Thursday, August 10, 1995

Expires date:
Saturday, June 4, 2016

Updated date:
Wednesday, October 8, 2014

ASN:
AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation,US

Root domain:
windows.net

Whois:
1 windows.net record

Scanner detections:
Detections  (90% detected)

Scan engine
Details
Detections

McAfee
Artemis!291DCFB44C0F, Artemis!E362627FDD6C, Artemis!0D38139D8334, Artemis!1964B9785478, Artemis!306511EA8E68, Artemis!2874A74B0FA6, Artemis!81EA9529F5A3, Artemis!D1528393C322
90.00%

Malwarebytes
PUP.Optional.OpenCandy
90.00%

K7 AntiVirus
Trojan
90.00%

Agnitum Outpost
Riskware.Agent
90.00%

Clam AntiVirus
Win.Trojan.Agent-855157
90.00%

Dr.Web
Adware.Downware.9759
90.00%

G Data
Win32.Adware.OpenCandy
90.00%

ESET NOD32
Win32/OpenCandy.C potentially unsafe (variant)
90.00%

Trend Micro House Call
Suspicious_GEN.F47V0325, Suspicious_GEN.F47V0330, Suspicious_GEN.F47V0331, Suspicious_GEN.F47V0413, Suspicious_GEN.F47V0416
80.00%

AVG
OpenCandy
80.00%

AhnLab V3 Security
PUP/Win32.OpenCandy
60.00%

Qihoo 360 Security
HEUR/QVM42.0.Malware.Gen
50.00%

Baidu Antivirus
Adware.Win32.OpenCandy
40.00%

Fortinet FortiGate
Riskware/OpenCandy
40.00%

VIPRE Antivirus
Opencandy, Trojan.Win32.Generic
30.00%

The domain jdcdn2com.blob.core.windows.net has been seen to resolve to the following IP address.

191.239.203.8
blob.am3prdstr10a.store.core.windows.net
May 5, 2015

File downloads found at URLs served by jdcdn2com.blob.core.windows.net.

10 / 68    (PUP)
http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../winrar-x64-521.exe  (d1528393c3220dc3f75342c838207a11)

12 / 68    (PUP)
http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../SetupImgBurn_2.5.8.0.exe  (0d38139d83344d0bd9f27c1196a82349)

2 / 68      (false positives)
http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../photoscape_v3.7.exe  (wrar420.exe)

16 / 68    (PUP)
http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../winrar-x64-521.exe  (655a6c0b2c34457aba5d9a34b3f21ac7)

12 / 68    (PUP)
http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../adwcleaner.exe  (adwcleaner_3.exe)

2 / 68      (false positives)
http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../TorchSetup-r9-n-bc.exe  (wrar420.exe)

11 / 68    (PUP)
http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../ooVooSetup.exe  (33f885e44c57824b40f8d1bfa0bb02a9)

14 / 68    (PUP)
http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../setup-instagram-downloader.exe  (81ea9529f5a3bc126ecc61b97e57fa97)

17 / 68    (PUP)
http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../cpu-z_1.72-en.exe  (qanxicwl.exe)

16 / 68    (PUP)
http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../bluestacks_0.9.exe  (306511ea8e6849398d067ef4d216a370)

11 / 68    (PUP)
http://jdcdn2com.blob.core.windows.net/fas/wi/18/34/1/.../torchsetup-r6-n-bc.exe  (291dcfb44c0fc5bfe4e38eca80db570a)

The following 6 files have been seen to comunicate with jdcdn2com.blob.core.windows.net in live environments.

TCP » 191.239.203.8:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 191.239.203.8:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 191.239.203.8:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 191.239.203.8:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 191.239.203.8:80
dsrlte.exe

TCP » 191.239.203.8:443
MPPoker.exe (Microgaming Poker Engine by Microgaming)

TCP » 191.239.203.8:443
online-guardian-v2.0.9.exe

URL:
http://jdcdn2com.blob.core.windows.net/

SSL certificate subject:
CN=*.blob.core.windows.net

SSL certificate issuer:
CN=Microsoft IT SSL SHA2, OU=Microsoft IT, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Web server:
Microsoft-HTTPAPI/2.0

facilisimo.com

remotrapp.com

stylejukebox.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.