home

www.okmidia.com

Corp New Ventures Services

Domain Information

The domain www.okmidia.com registered by Corp New Ventures Services was initially registered in April of 2016 through GODADDY.COM, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Scottsdale, Arizona within the United States which resides on the GoDaddy.com, LLC network.
Registrar:
DOMAIN GOLD ZONE LLC

Server location:
Arizona, United States (US)

Create date:
Monday, April 4, 2016

Expires date:
Tuesday, April 4, 2017

Updated date:
Monday, April 11, 2016

Root domain:
okmidia.com

Whois:
2 okmidia.com records

Scanner detections:
Detections  (88% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP, Adware.Generic.AT (M), PUP.Midia Technologies.MidiaTec.Bundler (M), PUP.BR Software.BRSOFTWA (M)
62.50%

Fortinet FortiGate
Adware/PCMega.J, W32/Foreign.AELB!tr
37.50%

Panda Antivirus
Trj/Dtcontx.D, Trj/Dtcontx.B, Trj/OCJ.D
37.50%

F-Prot
W32/MSIL_Dloader.A.gen, W32/AdAgent.AO.gen
37.50%

SUPERAntiSpyware
Trojan.Agent/Gen-Multi, Trojan.Agent/Gen-Ransom
25.00%

MicroWorld eScan
Adware.Agent.NON, Trojan.Generic.KDZ.9805
25.00%

nProtect
Adware.Agent.NON, Trojan.Generic.KDZ.9805
25.00%

McAfee
RDN/Generic PUP.x!es, RDN/Generic Downloader.x!bw
25.00%

Malwarebytes
MSIL.Downloader
25.00%

Norman
Ransom.DPF, Gen:Variant.Adware.PCMega.4
25.00%

avast!
Win32:Adware-ANL [PUP], Win32:PUP-gen [PUP]
25.00%

Kaspersky
Trojan-Ransom.Win32.Foreign, Trojan-Downloader.MSIL.Agent
25.00%

Bitdefender
Adware.Agent.NON, Trojan.Generic.KDZ.9805
25.00%

Comodo Security
UnclassifiedMalware, TrojWare.MSIL.TrojanDownloader.Agent.BBQ
25.00%

F-Secure
Adware.Agent.NON, Trojan.Generic.KDZ.9805
25.00%

The domain www.okmidia.com has been seen to resolve to the following 2 IP addresses.

204.11.56.48
April 21, 2016

50.63.202.43
ip-50-63-202-43.ip.secureserver.net
February 13, 2016

File downloads found at URLs served by www.okmidia.com.

1 / 68      (Adware)
http://www.okmidia.com/ids/.../download.zip  (download.zip.exe)

1 / 68      (Adware)
http://www.okmidia.com/ids/.../Download.exe  (a86fd8a13c453800d5ab41ba6a72aad9)

1 / 68      (Adware)
http://www.okmidia.com/ids/.../Download.exe  (34234022ea1325635b0112dabf462582)

22 / 68    (PUP)
http://www.okmidia.com/ids/.../Vade Mecum 2011.zip  ({blocked}.exe)

5 / 68      (PUP)
http://www.okmidia.com/ids/.../Clubsolute: 2013.02.zip  (clubsolute- 2013.02.zip.exe)

29 / 68    (PUP)
http://www.okmidia.com/ids/.../ Filme O Ritual – Dublado.zip  (filme o ritual – dublado.zip.exe)

1 / 68      (Malware)
http://www.okmidia.com/ids/.../filme.exe  (1cece838c1c0ba1cfa8b799c11ac6508)

4 / 68      (inconclusive)
http://www.okmidia.com/ids/.../Fast .zip  (fast.zip.exe)

The following 7 files have been seen to comunicate with www.okmidia.com in live environments.

TCP » 50.63.202.43:80
online-guardian-v2.0.9.exe

TCP » 50.63.202.43:80
ContentFinder.exe (ContentFinder by DigitalSoftware Group)

TCP » 50.63.202.43:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 204.11.56.48:80
chrome.crx

TCP » 204.11.56.48:80
chrome.crx

TCP » 50.63.202.43:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

TCP » 50.63.202.43:80
produpd.exe (produpd.exe by Vested Development, Inc)

URL:
http://www.okmidia.com/

Web server:
Apache

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.