home

www.bro-downloads.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain www.bro-downloads.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in December of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Virginia, United States (US)

Create date:
Thursday, December 18, 2014

Expires date:
Sunday, December 18, 2016

Updated date:
Thursday, November 26, 2015

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Root domain:
bro-downloads.com

Whois:
2 bro-downloads.com records

Scanner detections:
Detections  (94% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.MocaNetworkNewMediaHoldings.M, PUP.Installer.NewMedia.Installer, PUP.NewMedia.Installer.New Media Holdings.Installer (M), PUP.NewMedia.Installer.installCore.Installer (M), PUP.NewMedia.NMH.installCore.Installer (M), PUP.NewMedia.NMH (M)
100.00%

ESET NOD32
Win32/InstallCore.SK potentially unwanted application
29.41%

VIPRE Antivirus
Threat.4788237, Threat.5063361
29.41%

K7 AntiVirus
Trojan , Unwanted-Program
29.41%

Comodo Security
Application.Win32.InstallCore.HG
29.41%

Avira AntiVirus
Adware/InstallCo.zkh
29.41%

G Data
Win32.Application.InstallCore.CZ
29.41%

AVG
Generic
29.41%

F-Secure
Riskware.Gen:Application.Heur.bv1@k0rWeIbO
29.41%

IKARUS anti.virus
AdWare.InstallCo
29.41%

Malwarebytes
PUP.Optional.InstallCore
29.41%

Sophos
PUA 'Install Core Click run software'
29.41%

avast!
Malware-gen
29.41%

Dr.Web
Trojan.InstallCore.45
23.53%

NANO AntiVirus
Riskware.Win32.InstallCore.dmkfpr
23.53%

The domain www.bro-downloads.com has been seen to resolve to the following 3 IP addresses.

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
July 1, 2015

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
July 1, 2015

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
July 1, 2015

File downloads found at URLs served by www.bro-downloads.com.

1 / 68      (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNTA4AznyNTAyvm5EIKiWXzLzAjMRNTC4NZCR&campaignId=9jn0ATCzNzCyAZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTC1AZnyNTAyvm5EIKiWXzLROTLzOTg4NZCR1&campaignId=9jn0ATC4AjA4AZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNTCRNZnyNTAyvm5EIKiWXzL3AZMwNzC4NZCR&campaignId=9jn0ATCyNznyAZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhLlOvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTCzOTMyNTAyvm5EIKiWXzL3NZCwNzL4NZCR&campaignId=9jn0ATCdNjL0AZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNTcwNZnyNTAyvm5EIKiWXzL1NTnRNTC4NZCR&campaignId=9jn0ATCyNz7dAZMq  (firefoxsetup.exe)

0 / 68
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVsavmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTA0OZMyNTAyvm5EIKiWXzL1AznwNzi4NZCR&campaignId=9jn0ATC0Az74AZMq  (firefox setup 27.0.exe)

1 / 68      (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNTCRNZnyNTAyvm5EIKiWXzLRNTCzNTC4NZCR&campaignId=9jn0ATCdAjC0AZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNTLFAznyNTAyvm5EIKiWXzL1OTMRNTC4NZCR&campaignId=9jn0ATCyNZiyAZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTLRNjMyNTAyvm5EIKiWXzL3AjcFNji4NZCR1&campaignId=9jn0ATC4OTayAZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTC1AZnyNTAyvm5EIKiWXzL3AZn0OTg4NZCR1&campaignId=9jn0ATCzOTAdAZMq  (firefoxsetup.exe)

0 / 68
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVsLvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTLFNZcRNTAyvm5EIKiWXzL1ATcFNZM4NZCR&campaignId=9jn0ATC0NZM0AZMq  (firefox setup 27.0.exe)

1 / 68      (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNTCRNZnyNTAyvm5EIKiWXzL3OZnwNzC4NZCR&campaignId=9jn0ATCzNzCyAZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTc0AznyNTAyvm5EIKiWXzL1AzCyNZC4NZCR1&campaignId=9jn0ATC3AzCyAZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhKl0vmNjhLlLvmNBDz1p2kDjhTnmDZ0wvmNpDZ1fNTA4NjnyNTAyvm5EIKiWXzL1NTC0AjAFNZCR&campaignId=9jn0ATCdATLwAZMq  (firefoxsetup.exe)

19 / 68    (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTAyAZnyNTAyvm5EIKiWXzL3AZc1Njc4NZCR1&campaignId=9jn0ATC4AjawAZMq  (firefoxsetup.exe)

19 / 68    (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTnFATnyNTAyvm5EIKiWXzLFNT7dAZC4NZCR1&campaignId=9jn0ATC0AzgdAZMq  (firefoxsetup.exe)

19 / 68    (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNTCRNZnyNTAyvm5EIKiWXzLzAjM3NTC4NZCR&campaignId=9jn0ATCdAznyAZMq  (firefoxsetup.exe)

18 / 68    (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTAyAZnyNTAyvm5EIKiWXzL1OTayNzc4NZCR1&campaignId=9jn0ATCFAjnwAZMq  (firefoxsetup.exe)

13 / 68    (Adware)
http://www.bro-downloads.com/?dl=1&dr=cHaWck1mIXvlDmW4vExthKDzckDzcj1zcmAmIT1zvm2yIKiWvmREhKVuvmNjhLNsvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTLROTMyNTAyvm5EIKiWXzLFOTnwOTi4NZCR&campaignId=9jn0ATCdOTMdAZMq  (firefoxsetup.exe)

The following 3 files have been seen to comunicate with www.bro-downloads.com in live environments.

TCP » 54.84.143.69:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80
notifier64.exe (Notifications)

TCP » 54.84.143.69:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.