home

www.abc-free.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain www.abc-free.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in August of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Virginia, United States (US)

Create date:
Wednesday, August 20, 2014

Expires date:
Saturday, August 20, 2016

Updated date:
Tuesday, July 28, 2015

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:
abc-free.com

Whois:
2 abc-free.com records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.ICSSetup.P, PUP.Installer.ironSource, PUP.installCore.ICSSetup.Installer (M), PUP.NewMedia.Installer.installCore.Installer (M), PUP.NewMedia.NMH.installCore.Installer (M)
100.00%

Dr.Web
Trojan.Packed.28501, Trojan.Packed.24524, Trojan.InstallCore.25
23.08%

ESET NOD32
Win32/InstallCore.NF potentially unwanted application, Win32/InstallCore.RB potentially unwanted application, Win32/InstallCore.SC potentially unwanted application
23.08%

VIPRE Antivirus
Threat.4788237, Threat.5063361
23.08%

K7 AntiVirus
Unwanted-Program
23.08%

Sophos
Install Core Click run software, PUA 'Install Core Click run software'
23.08%

AVG
Generic
23.08%

F-Prot
W32/InstallCore.AC.gen
15.38%

NANO AntiVirus
Riskware.Win32.InstallCore.dfgosg
15.38%

Comodo Security
Application.Win32.Installcore.RB
15.38%

Avira AntiVirus
ADWARE/InstallCore.Gen7, Adware/InstallCore.A.254
15.38%

G Data
Win32.Adware.InstallCore.BV
15.38%

herdProtect (fuzzy)
a variant of e6f8fc0e1cd325fd02108906483e7518bc2a3bf7
7.69%

Agnitum Outpost
PUA.InstallCore
7.69%

Clam AntiVirus
Win.Adware.Installcore-606
7.69%

The domain www.abc-free.com has been seen to resolve to the following 5 IP addresses.

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
April 3, 2016

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
February 25, 2016

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
February 11, 2016

54.172.110.87
ec2-54-172-110-87.compute-1.amazonaws.com
November 29, 2014

54.164.31.239
ec2-54-164-31-239.compute-1.amazonaws.com
September 22, 2014

File downloads found at URLs served by www.abc-free.com.

1 / 68      (Adware)
http://www.abc-free.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzLyAZCyATn0ASDPDdlChV8FATnyNTC3AT7y&campaignId=9jn0ATgROTAwAZMq  (teamviewersetup.exe)

1 / 68      (Adware)
http://www.abc-free.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z15LyDj rcWDK4m7z0RvmiWAkDjIKiWXzMyAZCyATn0ASDPDdlChV8zNzi0NZC3AT7y&campaignId=9jn0ATgwNjg4AZMq  (teamviewersetup.exe)

1 / 68      (Adware)
http://www.abc-free.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1kLQDj rcWDK4m7z0RvmiWAkDjIKiWXzcRAZCyATn0ASDPDdlChV8zNZMRNZC3AT7y&campaignId=9jn0ATgyATa4AZMq  (teamviewersetup.exe)

1 / 68      (Adware)
http://www.abc-free.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1kLQDj rcWDK4m7z0RvmiWAkDjIKiWXzcRAZCyATn0ASDPDdlChV80AzMRNZC3AT7y  (teamviewersetup.exe)

1 / 68      (Adware)
http://www.abc-free.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1LSkDj rcWDK4m7z0RvmiWAkDjIKiWXzn0AZCyATn0ASDPDdlChV81ATM3NjC3AT7y  (pteamviewersetup.exe)

1 / 68      (Adware)
http://www.abc-free.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1OTkDj rcWDK4m7z0RvmiWAkDjIKiWXzgyAZCyATn0ASDPDdlChV83OTg0NTC3AT7y&campaignId=9jn0ATL3OTcyAZMq  (teamviewersetup.exe)

1 / 68      (Adware)
http://www.abc-free.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzLyAZCyATn0ASDPDdlChV83ATLRNTC3AT7y&campaignId=9jn0ATL3OTMwAZMq  (teamviewersetup.exe)

1 / 68      (Adware)
http://www.abc-free.com/?dl=1&dr=cHaWck10DK5t2mll2dVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXz7RATL4Ajn0ASDPDdlChV8wNzc4NTn4NZgy&campaignId=9jn0ATgwOTayAZMq  (teamviewersetup.exe)

1 / 68      (Adware)
http://www.abc-free.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzLyAZCyATn0ASDPDdlChV8FATnyNTC3AT7y  (teamviewersetup.exe)

1 / 68      (Adware)
http://www.abc-free.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1kLQDj rcWDK4m7z0RvmiWAkDjIKiWXzcRAZCyATn0ASDPDdlChV8zNZMRNZC3AT7y&campaignId=9jn0ATL4OTC4AZMq  (teamviewersetup.exe)

14 / 68    (Adware)
http://www.abc-free.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1nSyDj rcWDK4m7z0RvmiWAkDjIKiWXzLzAZCyATn0ASDPDdlChV83AjcwNjC3AT7y&campaignId=9jn0ATL3OTL0AZMq  (teamviewersetup.exe)

11 / 68    (Adware)
http://www.abc-free.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1HiQDj rcWDK4m7z0RvmiWAkDjIKiWXznyAZCyATn0ASDPDdlChV80AZi1NZC3AT7y&campaignId=9jn0AT7wOZndAZMq  (teamviewersetup.exe)

9 / 68      (Adware)
http://www.abc-free.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck10DK5t2mll2dVyvmCWcyDEcmlChSDBDz1l QDj7z1LLQDj rcWDK4m7z0RvmiWAkDjIKiWXzAyAZCyATn0ASDPDdlChV8RNTaFNZC3AT7y  (teamviewersetup.exe)

The following 3 files have been seen to comunicate with www.abc-free.com in live environments.

TCP » 54.84.143.69:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80
notifier64.exe (Notifications)

TCP » 54.84.143.69:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.