The domain ttb.files101.com is registered by proxy through SOLUCIONES CORPORATIVAS IP, SL and was originally registered in June of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon.com, Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrant:
Only contact by email, all postal mail will be rejected
Registrar:
SOLUCIONES CORPORATIVAS IP, SL
Server location:
Oregon, United States (US)
Create date:
Thursday, June 5, 2014
Expires date:
Sunday, June 5, 2016
Updated date:
Friday, June 5, 2015
ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US
Scanner detections:
Detections (100% detected)
Scan engine
Details
Detections
Reason Heuristics
PUP.SmartSecureSoftwareSl.R, PUP.SmartSecureSoftwareSl.N, PUP.SmartSecureSoftwareSl.DD, PUP.SmartSecureSoftwareSl.K, PUP.VolvanPremiumSL.M, PUP.SmartSecureSoftwareSl.CC, Threat.Win.Reputation.IMP, PUP.VolvanPremiumSL.CC, PUP.Installer.Solimba, PUP.Solimba, PUP.Bundler.Softpulse, PUP.Softpulse.Bundler, PUP.Softpulse.Appsecure.Bundler (M), PUP.Softpulse.SmartSecureSoftwareSl.Bundler (M), PUP.Softpulse.VolvanPremium.Bundler (M), PUP.Softpulse.SmartSec.Bundler (M), PUP.Softpulse.Appsecur.Bundler (M), PUP.Softpulse.VolvanPr.Bundler (M), Adware.Softpulse.Bundler (M)
100.00%
VIPRE Antivirus
Threat.4783235, Threat.4729122, Threat.4150696, Trojan.Win32.Generic
46.88%
AVG
Win.Threat.High, Generic, Found Win32/DH{gRIxflCBB3lUTxVRgQkcU4ET}, Found Win32/DH{gRIxfX5QgQd5VE8VUYEVgQkcU4ETQYEP}, PSW.Agent, Adware BundleApp_r.AW
46.88%
McAfee
Socrydo, SoftPulse, SoftPulse.a, Program.SoftPulse, Trojan.Corrupt-AK!6974C85FC1CB
46.88%
Avira AntiVirus
TR/Dropper.Gen, APPL/Softpulse.Gen8, APPL/Softpulse.O, TR/Trash.Gen, Adware/Softpulse.1325752, APPL/Softpulse.oang, TR/Agent.982304
43.75%
K7 AntiVirus
Unwanted-Program , Trojan
43.75%
avast!
Win32:GenMalicious-HN [PUP], Win32:SoftPulse-AH [PUP], Win32:Malware-gen, Win32:GenMalicious-ADB [PUP], Win32:SoftPulse-AW [PUP]
37.50%
NANO AntiVirus
Trojan.Win32.DownLoader11.ddvhzo, Trojan.Win32.SoftPulse.dfwfat, Trojan.Win32.Agent.dhzclw, Trojan.Win32.SoftPulse.dhadid
37.50%
Sophos
Smart Secure Software, SoftPulse, PUA 'SoftPulse' (of type Adware)
37.50%
Malwarebytes
PUP.Optional.DomaIQ, PUP.Optional.DigiPlug, PUP.Optional.SmartSec
37.50%
G Data
Win32.Application.Softpulse, Adware.Agent.OLP, Gen:Variant.Adware.Graftor.162591, Gen:Variant.Application.Bundler.SoftPulse
37.50%
AhnLab V3 Security
Trojan/Win32.Agent, Win-PUP/DomaIQ.Gen, PUP/Win32.SoftPulse
34.38%
Dr.Web
Trojan.DownLoader11.24441, Trojan.DownLoader11.36367, Adware.SoftPulseENT.1, Adware.SoftPules.3, Adware.SoftPules.3, Trojan.DownLoader11.36367
31.25%
Norman
Malware, Kryptik.CDHN, Gen:Variant.Adware.Symmi.49325, Application.Bundler.SoftPulse.F, Gen:Variant.Adware.Kazy.494201, Application.Bundler.GL
31.25%
Kaspersky
not-a-virus:Downloader.Win32.LMN, HEUR:Trojan.Win32.Generic, not-a-virus:Downloader.Win32.DriverUpd, not-a-virus:AdWare.Win32.SoftPulse
31.25%
The domain ttb.files101.com has been seen to resolve to the following 4 IP addresses.
ec2-52-10-156-255.us-west-2.compute.amazonaws.com
May 28, 2015
ec2-54-149-159-30.us-west-2.compute.amazonaws.com
May 28, 2015
ec2-50-112-177-75.us-west-2.compute.amazonaws.com
August 19, 2014
ec2-54-201-201-245.us-west-2.compute.amazonaws.com
August 19, 2014
File downloads found at URLs served by ttb.files101.com.
Latest 30 of 32 download URLs
The following 2 files have been seen to comunicate with ttb.files101.com in live environments.
URL:
http://ttb.files101.com/
Network:
Amazon Web Services (AWS), running an EC2 instance
Web server:
nginx (PHP/5.3.10-1ubuntu3.17)