home

www.read-pdf.org

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain www.read-pdf.org is registered by proxy through PDR Ltd. d/b/a PublicDomainRegistry.com (R27-LROR). This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
PDR Ltd. d/b/a PublicDomainRegistry.com (R27-LROR)

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
read-pdf.org

Whois:
1 read-pdf.org record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.ICSSetup.S, PUP.Installer.ironSource, PUP.installCore.ICSSetup.Installer (M), PUP.installCore (M)
100.00%

Dr.Web
Trojan.MulDrop5.10078
37.50%

VIPRE Antivirus
Threat.4788237
37.50%

ESET NOD32
Win32/InstallCore.PK potentially unwanted application
37.50%

Sophos
Install Core Click run software, PUA 'Install Core Click run software'
37.50%

AVG
Generic
37.50%

herdProtect (fuzzy)
a variant of ef9639cee41c8c89129756deb83ee1b67eccc74e
25.00%

Zillya! Antivirus
Backdoor.PePatch.Win32.37917
25.00%

K7 AntiVirus
Unwanted-Program
12.50%

Comodo Security
Application.Win32.InstallCore.QGJO
12.50%

Avira AntiVirus
Adware/InstallCore.Y
12.50%

G Data
Win32.Adware.InstallCore.BV
12.50%

The domain www.read-pdf.org has been seen to resolve to the following 10 IP addresses.

209.99.40.220
209-99-40-220.fwd.datafoundry.com
May 19, 2016

54.213.25.156
ec2-54-213-25-156.us-west-2.compute.amazonaws.com
November 18, 2015

54.69.189.98
ec2-54-69-189-98.us-west-2.compute.amazonaws.com
November 18, 2015

52.10.193.58
ec2-52-10-193-58.us-west-2.compute.amazonaws.com
November 18, 2015

54.201.15.32
ec2-54-201-15-32.us-west-2.compute.amazonaws.com
July 3, 2014

54.200.119.244
ec2-54-200-119-244.us-west-2.compute.amazonaws.com
July 3, 2014

54.213.231.162
ec2-54-213-231-162.us-west-2.compute.amazonaws.com
July 3, 2014

54.186.198.136
ec2-54-186-198-136.us-west-2.compute.amazonaws.com
July 3, 2014

54.186.46.235
ec2-54-186-46-235.us-west-2.compute.amazonaws.com
July 3, 2014

54.213.175.151
ec2-54-213-175-151.us-west-2.compute.amazonaws.com
July 3, 2014

File downloads found at URLs served by www.read-pdf.org.

1 / 68      (Adware)
http://www.read-pdf.org/?dl=1&meta=7KNy dvP2k1yDK5CDXaJ r2mUdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhKDyvmNjhLDSvmNBDz1mcQDjhTnmDZ0wvmNpDZ1fNzczATcFAzCRvmt3hXtGDXl3 3vCfSDt2Z1Y K507dP0eXslfSDt j1YcrRP7dVtDKF0fSDj2Z1Y2r5yDdV0fSDu2Z1YIKDZ dF0DKF0OCxWedlmLdVPcmNoOlxWvmV4cHaWed5jDKlCfSDPcZ1Y7Kxw 3Np2rlJ E0mDH7Wedxl2mljDX0mvm5EIKiWXzcFNjadNTnyOZAR  (acrobatreadersetup.exe)

1 / 68      (Adware)
http://www.read-pdf.org/?dl=1&meta=7KNy dvP2k1yDK5CDXaJ r2mUdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNznyOT7FAzCRvmt3hXtGDXl3 3vCfSDt2Z1Y K507dP0eXslfSDt j1YcrRP7dVtDKF0fSDj2Z1Y2r5yDdV0fSDu2Z1YIKDZ dF0DKF0OCxWedlmLdVPcmNoOlxWvmV4cHaWed5jDKlCfSDPcZ1Y7Kxw 3Np2rlJ E0mDH7Wedxl2mljDX0mvm5EIKiWXzcFAZAyATCROZAR  (acrobatreadersetup.exe)

1 / 68      (Adware)
http://www.read-pdf.org/?dl=1&meta=7KNy dvP2k1yDK5CDXaJ r2mUdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhKVuvmNjhLlOvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNzcRNZ7FAzCRvmt3hXtGDXl3 3vCfSDt2Z1Y K507dP0eXslfSDt j1YcrRP7dVtDKF0fSDj2Z1Y2r5yDdV0fSDu2Z1YIKDZ dF0DKF0OCxWedlmLdVPcmNoOlxWvmV4cHaWed5jDKlCfSDPcZ1Y7Kxw 3Np2rlJ E0mDH7Wedxl2mljDX0mvm5EIKiWXzc3OTn1NziROZAR  (acrobatreadersetup.exe)

1 / 68      (Adware)
http://www.read-pdf.org/?dl=1&meta=7KNy dvP2k1yDK5CDXaJ r2mUdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNznyOT7FAzCRvmt3hXtGDXl3 3vCfSDt2Z1Y K507dP0eXslfSDt j1YcrRP7dVtDKF0fSDj2Z1Y2r5yDdV0fSDu2Z1YIKDZ dF0DKF0OCxWedlmLdVPcmNoOlxWvmV4cHaWed5jDKlCfSDPcZ1Y7Kxw 3Np2rlJ E0mDH7Wedxl2mljDX0mvm5EIKiWXzcRNZMzNZCROZAR  (acrobatreadersetup.exe)

1 / 68      (Adware)
http://www.read-pdf.org/?dl=1&meta=7KNy dvP2k1yDK5CDXaJ r2mUdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNznwNznzATgRvmt3hXtGDXl3 3vCfSDt2Z1Y K507dP0eXslfSDt j1YcrRP7dVtDKF0fSDj2Z1Y2r5yDdV0fSDu2Z1YIKDZ dF0DKF0OCxWedlmLdVPcmNoOlxWvmV4cHaWed5jDKlCfSDPcZ1Y7Kxw 3Np2rlJ E0mDH7Wedxl2mljDX0mvm5EIKiWXzcROZcROZgFNzaR  (acrobatreadersetup.exe)

10 / 68    (Adware)
http://www.read-pdf.org/?dl=1&meta=7KNy dvP2k1yDK5CDXaJ r2mUdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhKVuvmNjhL2kvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNzAFAz7FAzCRvmt3hXtGDXl3 3vCfSDt2Z1Y K507dP0eXslfSDt j1YcrRP7dVtDKF0fSDj2Z1Y2r5yDdV0fSDu2Z1YIKDZ dF0DKF0OCxWedlmLdVPcmNoOlxWvmV4cHaWed5jDKlCfSDPcZ1Y7Kxw 3Np2rlJ E0mDH7Wedxl2mljDX0mvm5EIKiWXzc3NzAzAZiROZAR  (acrobatreadersetup.exe)

8 / 68      (Adware)
http://www.read-pdf.org/?dl=1&meta=7KNy dvP2k1yDK5CDXaJ r2mUdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhKl0vmNjhLlLvmNBDz1p2kDjhTnmDZ0wvmNpDZ1fNzA3ATcFAzCRvmt3hXtGDXl3 3vCfSDt2Z1Y K507dP0eXslfSDt j1YcrRP7dVtDKF0fSDj2Z1Y2r5yDdV0fSDu2Z1YIKDZ dF0DKF0OCxWedlmLdVPcmNoOlxWvmV4cHaWed5jDKlCfSDPcZ1Y7Kxw 3Np2rlJ E0mDH7Wedxl2mljDX0mvm5EIKiWXzcROZa0AzayOZAR  (acrobatreadersetup.exe)

8 / 68      (Adware)
http://www.read-pdf.org/?dl=1&meta=7KNy dvP2k1yDK5CDXaJ r2mUdWjUzWPDrFthXtjcmVP2rldDX0mIT1zvm2yIKiWvmREhKl0vmNjhLlLvmNBDz1p2kDjhTnmDZ0wvmNpDZ1fNzA3ATcFAzCRvmt3hXtGDXl3 3vCfSDt2Z1Y K507dP0eXslfSDt j1YcrRP7dVtDKF0fSDj2Z1Y2r5yDdV0fSDu2Z1YIKDZ dF0DKF0OCxWedlmLdVPcmNoOlxWvmV4cHaWed5jDKlCfSDPcZ1Y7Kxw 3Np2rlJ E0mDH7Wedxl2mljDX0mvm5EIKiWXzc3NzgzAjayOZAR  (acrobatreadersetup.exe)

The following 10 files have been seen to comunicate with www.read-pdf.org in live environments.

TCP » 209.99.40.220:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.220:80
ContentFinder.exe (ContentFinder by DigitalSoftware Group)

TCP » 209.99.40.220:80
autoDENGI.exe (autoDENGI by autodengi.com)

TCP » 209.99.40.220:80
ContentFinder.exe (ContentFinder by ContentFinder Software)

TCP » 209.99.40.220:80
popcom.exe (PopCom)

TCP » 209.99.40.220:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

TCP » 209.99.40.220:80
online-guardian-v2.0.9.exe

TCP » 209.99.40.220:80
Client.exe

TCP » 209.99.40.220:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 209.99.40.220:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

URL:
http://www.read-pdf.org/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.3 (PHP/5.3.28)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.