home

www.call4freeapp.com

Intersolved, LLC

Domain Information

The domain www.call4freeapp.com registered by Intersolved, LLC was initially registered in January of 2015 through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
EPIK, INC.

Server location:
Oregon, United States (US)

Create date:
Saturday, January 17, 2015

Expires date:
Tuesday, January 17, 2017

Updated date:
Thursday, February 18, 2016

Root domain:
call4freeapp.com

Whois:
3 call4freeapp.com records

Scanner detections:
Detections  (88% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.SuperCoolApplications.K, PUP.installCore.SuperCoolApplications.Installer (M), PUP.installCore.SuperCoo.Installer (M), PUP.installCore (M)
87.50%

ESET NOD32
Win32/InstallCore.LU (variant), Win32/InstallCore.FJ (variant)
25.00%

K7 AntiVirus
Unwanted-Program
12.50%

VIPRE Antivirus
InstallCore.b
12.50%

Avira AntiVirus
ADWARE/InstallCore.Gen7
12.50%

AVG
MalSign.Max Setup
12.50%

Malwarebytes
PUP.Optional.InstallCore
12.50%

Agnitum Outpost
PUA.InstallCore
12.50%

Dr.Web
Trojan.MulDrop5.10078
12.50%

Sophos
Install Core Click run software
12.50%

Vba32 AntiVirus
Downware.InstallCore
12.50%

Clam AntiVirus
Win.Trojan.Installcore-142
12.50%

Rising Antivirus
PE:Malware.XPACK-LNR/Heur!1.5594
12.50%

ESET NOD32
Win32/InstallCore.BX potentially unwanted application
12.50%

The domain www.call4freeapp.com has been seen to resolve to the following 4 IP addresses.

91.195.241.72
custip-2072.sedoparking.com
July 19, 2015

54.213.175.151
ec2-54-213-175-151.us-west-2.compute.amazonaws.com
April 13, 2014

54.200.119.244
ec2-54-200-119-244.us-west-2.compute.amazonaws.com
April 13, 2014

54.213.231.162
ec2-54-213-231-162.us-west-2.compute.amazonaws.com
April 13, 2014

File downloads found at URLs served by www.call4freeapp.com.

1 / 68      (Adware)
http://www.call4freeapp.com/?dl=1&meta=cdtFcrLJDrW0UdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhSDj7z1iTkDj rcWvmAWASDChTMm7dlChV8FAjiwAT74NTnmI3cWedtleX2JcmxWvm10hXtt7XxjIHxFcrVWvm1uhXtw r5jDK1l ExWvmN0hXt07XvEDXxWvmF0hXtpDCNJ Exl Ei6xH1YIKDTDK5y7dg6VH0mDXPwcj1Y7KNlIKxWvm5whXtPDHsJcdl0IKWufSDC2j1YDrVdIKNlfS7m7K2pDZ1fOTgFAZM0OZLyOi==  (skypesetup.exe)

1 / 68      (Adware)
http://www.call4freeapp.com/?dl=1&meta=cdtFcrLJDrW0UdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhSDj7z1kLQDj rcWvmAWASDChTMm7dlChV8FAZAwNjgRNTnmI3cWedtleX2JcmxWvm10hXtt7XxjIHxFcrVWvm1uhXtw r5jDK1l ExWvmN0hXt07XvEDXxWvmF0hXtpDCNJ Exl Ei6xH1YIKDTDK5y7dg6VH0mDXPwcj1Y7KNlIKxWvm5whXtPDHsJcdl0IKWufSDC2j1YDrVdIKNlfS7m7K2pDZ1fOT7yNZMROTMFOM==  (icreinstall_skypesetup.exe)

1 / 68      (inconclusive)
http://www.call4freeapp.com/skype/dot/.../?dl=1  (skypesetup.exe)

1 / 68      (Adware)
http://www.call4freeapp.com/?dl=1&meta=cdtFcrLJDrW0UdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhSDj7z1vTQDj rcWvmAWASDChTMm7dlChV8FNZn4OTM4NTnmI3cWedtleX2JcmxWvm10hXtt7XxjIHxFcrVWvm1uhXtw r5jDK1l ExWvmN0hXt07XvEDXxWvmF0hXtpDCNJ Exl Ei6xH1YIKDTDK5y7dg6VH0mDXPwcj1Y7KNlIKxWvm5whXtPDHsJcdl0IKWufSDC2j1YDrVdIKNlfS7m7K2pDZ1fOTiROZM1OTiyOi==  (skypesetup.exe)

1 / 68      (Adware)
http://www.call4freeapp.com/skype/dot/.../?dl=1  (skypesetup.exe)

1 / 68      (Adware)
http://www.call4freeapp.com/?dl=1&meta=cdtFcrLJDrW0UdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhSDj7z1vVkDj rcWvmAWASDChTMm7dlChV8FNZCFAZ74NTnmI3cWedtleX2JcmxWvm10hXtt7XxjIHxFcrVWvm1uhXtw r5jDK1l ExWvmN0hXt07XvEDXxWvmF0hXtpDCNJ Exl Ei6xH1YIKDTDK5y7dg6VH0mDXPwcj1Y7KNlIKxWvm5whXtPDHsJcdl0IKWufSDC2j1YDrVdIKNlfS7m7K2pDZ1fOT7wOTnFNzLyOi==  (skypesetup.exe)

3 / 68      (Adware)
http://www.call4freeapp.com/?dl=1&meta=cdtFcrLJDrW0UdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhSDj7z1VLyDj rcWvmAWASDChTMm7dlChV8FOZLFNTgRNTnmI3cWedtleX2JcmxWvm10hXtt7XxjIHxFcrVWvm1uhXtw r5jDK1l ExWvmN0hXt07XvEDXxWvmF0hXtpDCNJ Exl Ei6xH1YIKDTDK5y7dg6VH0mDXPwcj1Y7KNlIKxWvm5whXtPDHsJcdl0IKWufSDC2j1YDrVdIKNlfS7m7K2pDZ1fOTM3OZi0OZMFOM==  (skypesetup.exe)

12 / 68    (Adware)
http://www.call4freeapp.com/?dl=1&meta=cdtFcrLJDrW0UdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhSDj7z1HiQDj rcWvmAWASDChTMm7dlChV8FAZcFNTgRNTnmI3cWedtleX2JcmxWvm10hXtt7XxjIHxFcrVWvm1uhXtw r5jDK1l ExWvmN0hXt07XvEDXxWvmF0hXtpDCNJ Exl Ei6xH1YIKDTDK5y7dg6VH0mDXPwcj1Y7KNlIKxWvm5whXtPDHsJcdl0IKWufSDC2j1YDrVdIKNlfS7m7K2pDZ1fOT70NTM1OZMFOM==  (SkypeSetup.exe)

The following 2 files have been seen to comunicate with www.call4freeapp.com in live environments.

TCP » 91.195.241.72:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 91.195.241.72:80
UCBrowser.exe (UC Browser by UCWeb)

URL:
http://www.call4freeapp.com/

Title:
“call4freeapp.com -&nbspThis website is for sale! -&nbspcall4freeapp Resources and Information.”

Title (4/13/2014):
“Skype”

Title (7/19/2015):
“call4freeapp.com - This website is for sale! - call4freeapp Resources and Information.”

Description:
“This”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.