home

sfs.ezdownloadpro.info

Rafael Leviev

Domain Information

Currently this domain has been known to host various forms of malware. The hosted servers are located in Dublin, Dublin City within Ireland which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the EU (Ireland) region datacenter. The domain is associated with the publisher Rafael Leviev who is located in Shfela, Israel.
Registrar:
1API GmbH

Server location:
Dublin City, Ireland (IE)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.

Root domain:
ezdownloadpro.info

Whois:
1 ezdownloadpro.info record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

Emsisoft Anti-Malware
Gen:Variant.Adware.Mikey.8516
40.00%

Dr.Web
Trojan.DownLoader12.34955, Trojan.DownLoader12.34929
40.00%

Lavasoft Ad-Aware
Gen:Variant.Adware.Mikey.8516
40.00%

ESET NOD32
Win32/Adware.MultiPlug.FC application
40.00%

F-Secure
Gen:Variant.Adware.Mikey
40.00%

Sophos
PUA 'MultiPlug' (of type Adware)
40.00%

MicroWorld eScan
Gen:Variant.Adware.Mikey.8516
40.00%

K7 AntiVirus
Unwanted-Program
40.00%

F-Prot
W32/S-4ef98cc5
40.00%

Bitdefender
Gen:Variant.Adware.Mikey.8516
40.00%

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
40.00%

G Data
Gen:Variant.Adware.Mikey.8516
40.00%

AhnLab V3 Security
PUP/Win32.MultiPlug
40.00%

Vba32 AntiVirus
SScope.Adware.MultiPlug
40.00%

The domain sfs.ezdownloadpro.info has been seen to resolve to the following 3 IP addresses.

185.53.177.6
September 4, 2016

54.72.9.51
ec2-54-72-9-51.eu-west-1.compute.amazonaws.com
September 3, 2016

185.53.177.10
February 27, 2016

File downloads found at URLs served by sfs.ezdownloadpro.info.

1 / 68      (Malware)
http://sfs.ezdownloadpro.info/hp/?q=uF09XlYVWnhsyhabcd9c8wIj30hnQ4OaLl7SSVAruVEOY FjHrnfMfJjFXUC0HC4RHMPOVA4GIZvXwWm MW1nyVO2I5gHZvPMrdREcmERmNHaz/5U/qHVpm2KH9VKu7Q7CsoGUDeKdXr6SuxvJ5YlNpjVKx2nQvXD4aerzwX4csQnXtE/ppuJHesCC/At6mGy29yTev54 0aHI6sumKUNf9xJH14IcQ2 s5wekqfppAbzAcQO7wZtIjISsx6zTkguokbguhmNmvVv3N3hlKK6Iixf7SUhT6yB51Y zhz9DaJsU//iUY4C3MgNI UF4bp1ljFEdTS09qdacMFzqT014U6x/kUWtHiN Hi06cfngciFsZPp7UWpR/u75KAj9I8oBAtvPWJOOBRZRIWcTMlYhn79Do6nwrvjsnwBPvZYb fsFgZETD/.../ScgFItznW 5CUxFdxZK6VDI&external_id=1425237169479491226&uuid=5M6EHm4zqXyCaA7zCi93DrTMGsaemxwIRVvQEyGEccOFK4OSJDxuw3jNHM3JTNqmMISBrHKWBlIvDiUB2PQWJhewDKq2MUSUPbcfoj5qiyRWOE3DgOl9LMWfvrHoc2NPVh73mGPpLwdOfr8za4eXpdU9QDMXeAdQcGmITlGVPu5JW2r6Fmz8N0HopR5Z4QMdrKUra4py8PwiqmzG7OysXafLWRH8n9K4Y4pecOEt5rYGfeU57fRtHsSodgLpT93XHeugSKVu3TEVkhcbFAly8fHiuJf2cTIvPBGOqc6Suuy5hlOhISI9KKGraFRfINmsyuGxcUT5N9qLxmRNUVXVOetSYkxi7kHsSzDmphRF7DT6xw6BnNnUoURvLrlZCIqQMDHLGPJVTcRHO1m5IfL3x7LifbbZu9hGJmkT8NkwFNlHRpUIZi6wS  (clash of clans.exe)

1 / 68      (Malware)
http://sfs.ezdownloadpro.info/hp/?q=WsbWS3ihyOQDe xztvgA/wSNqK4hZCUrZ0F0oZNN0ZoBlDp7gzmxTF6cfk9ozcWjCWaUiE6dbgJTgLAJk8ThR8MC5Aj118O3DukWBoQxz4lUvLG4MFFPTGkHehYsjU7dIb LFJym18PzUKEfj5/jLK09Ua1LR6pn0NaPQ5rLemDUdCQUdQn4mf26pHipk1i2/3aQWYrVZqb6ldnCSYzfFMevj oN6Prlsu9qaRIym//koOUKiTpPCmO5jRU9aV g0Y3v7S0C1RMc/.../4PaNbzWkpcB3ZLa7HC1yrWTOM9qIWgxor kAqB74iJB3D8z0oZ6uUrFKiiEOgDraFJ3T&external_id=1425230784400721155&uuid=2nJ8s4zkhtvpNjUFY2O0wtKJZAO3Mh9eYKquMCbhdlFDfCuyxGKygs4FS5RfKLGIOAsE3Esxm5Ut4AaQJY1ufz2fRFJ0qE7aDpruYkDmNznOwDl832VeJKra6djETK2LPK5WfiPoQ9f3nhT9LNRN7NuLrkxviyMrCsKVb6V1WoWqA7CENuVIqKRwITxDN9nmfDtiWWWsvBNTXq4u0XfmHCw3pU0E0YWbrkj1WjBhe3xXNPVafiOlbeaPPFFc9C0U5uTw9pQls8rAMDYWyRvWdqiTiHUhGhUAET3sYLhWOycXTYDXjvHXLd3RDiQZfbvyzuzakrsaHHEWhBenBNZ3gVnCACYTXSkhNwZbR2Y9temAn6aa0Y9PHcGu7h8JCN318KBSSC3RXM8LkS18TwSqnKWaixEYStpxtAPYhBr1NFw21zUgJYmgjnKqQjBQF5AjuHcf5N2BL  (snapchat.exe)

1 / 68      (Malware)
http://sfs.ezdownloadpro.info/hp/?q=uSjAtLjeazvnKdefABTWAnHzXlMBt 0Z4y5Syyw6Ekl msIYq7I cYOzmyIMcIkjSmwME6sQSeFC99UA Z9pxBf0Bd26n8YQoWJibtBzScuiGocT7owSeJP16a0SZnKtD/zVplXicox5wcxk TuTWnLw1mu XfwkXTtGh7piHHntthpaDEumuvWsrYcAWQklst0oo1imFLBo5vfdc/ATo7iro7g32082 Osm1yTWIJhcUpDabdjfYiMP6KbFfcfaCUOtMApOyizEvQnUIMxm1XK2VvkHFQUCHF ZFKXI7Jo26cvWbylZCgGU Wl ZNtJoQ5B4ATTscCDuhRRcr8U4ohGdJQatbczZsIAMgsOsmdzM7wyvAizZPCBm9rqkTU/nxBqag728L/GtwZRykESTW2gwxs QOGDeyWKi/mNnE/fyMHB6jrr1ARt9GU0yXCY0l1yJdBo HRESLr/ GqyQ62I/2GLiqAnw6rua03v5AZNpIbSZP6dnManJskyWtX6b8Zn9x Y5CzLs/aZykGu75ZXxVEyOr303mgfgKYSyCDzrgHKoB8SIgs 7e8bgqIV8BQxLe3LWzQTUjbzOeRK/Sk9euSWjpZwaKvW8Mr4ubn8jrTo47fUCXg2lPU2zjrXgeRpmnsMFXyq4/GZd0GGkYaASkGTfFVnCg1TJCXD7rOu mXo4RhnRFvHDZP3nm8N9kZQIYlPTvgJTJd6vfr2SdvpvdCYhGEnS6ibywEhXbagUwdbe7jZm2VjiKreSLP/tcmfjxBvjznYZNfHVzEtbSuUkiwb4okp2ulXARKKCsTJ8GORAX2n6lINeqXgQIj8bKSJVL5GfRqFEWJHyU9PY4DxjxRodi7xukih2fUSOdPA/SQlm /Y/wpBbewCotuq0nyJ i35emB3p8cn2DSQJB AYmhH/.../4Mx5Fndd67EhP3VpbpBydH7 AUNy  (microsoft_hololens_transform_your_world_with_holograms.mp4.exe)

23 / 68    (PUP)
http://sfs.ezdownloadpro.info/hp/?q=AOMztbKxsZUQumPvqoHUJl6mFlbOAJ5sRMT2dEejin1j93TTn8DV5Z6QkNyo7LetogI7zp8z/4BkO8NC56YO/2b1o859ISI9APWTfePYAlg4f0jMb4mrx2berycdfGgRG8lmj9LYAUsUOnvkzail4MH95F6y05dljr2wbd97Z oIpn9UeI1X1s4t65UFbnuBSIet/ILG8Sa2TMR1jPscNalxVEzO t5ldXAEHbp/muQOoFLoq/V6KxdrsGe4TYasl1nghLel7iT87C7F1pgAbhAxrEVPJVTrDh8H2xQThONoc5Cum/Uom4R4A1ejVgxCb64xDg4Esti3Yo4wnZBR/1/waGja77ydmxviXI5dYt89cSPdGa55H3IyVYFgnfUQ4pGUa8Dc0ff0Xh2YmvhAPxMpWSC2zp0ihNbdt5hBKB/bWTBjqVAFIOyt8wyDtVqk5hUbz2bQhAcr8MVcg/22Dq ZCEefNDqEnGR44MAtuDc3mqfCUNwTJOX8lnUHs8/nB8A8hPFLdIHi6NjylDTdt26vVG 9/8MMKv9GPe/SHeDqCaJTadhOmWc/ry8nEYgs/cyFujeoSm3zA9n3hc4rJzCfhP/lEirL8DTDTyF8 m2HI6KPYpmg68itjD9UfaiTP1xn/Z5hK7/yIXYLzjtEyC3H0peOzdDg4gCvK61TUOrLARDEi8DWd5pDCo/HH6y4aItHR/CTuHozFHojGtk0heb5TTDg1rbUODzOqfw7uh909rjYwyG2Yz6GXP6jdee7m5HcNJyWS4SIrEXZBRqrN3QrNKAUEADaDBISmgze8/uRk60udiVyBhaRJZrKCumpjISjScuSpWVM/pSNjO/.../tyK1jVO8VK9tbwg8YHnBGw9U5 xEN7pJdL7xKwzid0kL0umMCe169wkqKGclbDMmIkx  (why did cesar millan get bite_ - explanation and full analysis.mp4.exe)

18 / 68    (PUP)
http://sfs.ezdownloadpro.info/hp/?q=vlXF6DypS/Yg89/XZTKVN3p7ZYbrYMrvHfu7wu7wUAXT58mm6RjUW/ujntk81xQ/dmz2/yvxFoe5of8mEi15PpCR/OX8XZS4rPvMllP6JQI nB/mNcC94u1I063gvecFSc0RSW6bYBBD9Lum37aQaEwvEWMeSGTRIPxkAH3v8fk/cPKF/jXlbTENOfBcYgQ1pB5D/cqw1KMlasyV4fZsmZJ1E7wFfQOv4aqVqCIlq3vPDMkbAwE8 HdgqA76Uhvqg93VIO6DOMJLLIfHfb0HwI64yVSwX8Wg/Us4tpTu/18n5yJa2ME7EKySnRNmnb8PewVWtdtbhvYKYpPeP9icRq 3zSuTe5R3bZvoxxkDBMeZZfkFgPJZrp ucMRYtljFrsDnNtCBMant 4jX1g/ sR621WbJN9ucYcO/VbqzurHHmPVevd95kUAo/uzJlA7SVFOBRjS1SDPFa49Ksu0I/56FJwD0Ghf3g6DhgBHW/kUuHiIe68XYtmwdY9TawHf8kgYy y2Z5wzF9QNAFraIbVxJ4zvAANV5kIk8S0Y9MAMYc6/6IoNJEJecQ3/mJAWjeSNv3wZHDi/.../oBZqrCk6RPRMF1JQ3WyGh9TJGnzeMMY D4u pcS&external_id=1425228078343749257&uuid=1rkYMVGuwKsulq9nSUxm7GPsFAMzDGgN7Oc4aDNboVRHL4WDUAYqTfFEzLQtP1YL51L2xREoxiFa4NvVl0V1spLbXsA2sRkcKxwhMQODKKbpOFMCA5xM3O7iAE42LsBUexvFURofwa0XGFD98P0kntARO9jc4kMocV45aMmNNcubaafZMM9f7ukwUjmqBLNMTWDGcgCvPaO7wYv25BNgbcdX57GiLLsbRVW8epYA1NhWGZSUXdWGg1Z5ILVLFcQinQ8gNo3nnh6iauX4zi  (xperia_e_single_jb_cwm.exe)

The following 215 files have been seen to comunicate with sfs.ezdownloadpro.info in live environments.

TCP » 54.72.9.51:80
toolbarupdaterservice.exe

TCP » 54.72.9.51:80
hdnInstaller.exe (hdnInstaller)

TCP » 54.72.9.51:80
onedrvup.exe

TCP » 54.72.9.51:80
hdnInstaller.exe (hdnInstaller)

TCP » 54.72.9.51:80
247843.ftf (Optimizer Pro v3.2 by PC Utilities Software Limited)

TCP » 54.72.9.51:80
1799877.exe

TCP » 54.72.9.51:80
IEError.exe (IEError)

TCP » 54.72.9.51:80
install_flashplayer14x32_x64md_aaa_aih.exe (bon joueur)

TCP » 54.72.9.51:80
optimizerproinstaller.exe (Optimizer Pro v3.2 by PCUtilities Software Limited)

TCP » 54.72.9.51:80
charles.exe (by Apple)

TCP » 54.72.9.51:80
onedrv.exe

TCP » 54.72.9.51:80
IEError.exe (IEError)

TCP » 54.72.9.51:80
updater27793.exe (CouponDropDown Plugin by Innovative Apps)

TCP » 54.72.9.51:80
install_flashplayer16x33_masp_aaa_aih.exe (by Apple)

TCP » 54.72.9.51:80
toolbarupdaterservice.exe

TCP » 54.72.9.51:80
hdnInstaller.exe (hdnInstaller)

TCP » 54.72.9.51:80
g.jpg

TCP » 54.72.9.51:80
smlb.jpg

TCP » 54.72.9.51:80
smlb.jpg

TCP » 54.72.9.51:80
hqghumeaylnlf.exe (Optimizer Pro v3.2 by PC Utilities Software Limited)

 
Latest 20 of 219 files

URL:
http://sfs.ezdownloadpro.info/

Title:
“ezdownloadpro.info”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.