home

www.stocksafeupdate.com

Communigal Communication Ltd

Domain Information

The domain www.stocksafeupdate.com registered by Communigal Communication Ltd was initially registered in January of 2016 through GAL COMMUNICATION (COMMUNIGAL) LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
GAL COMMUNICATION (COMMUNIGAL) LTD.

Server location:
Oregon, United States (US)

Create date:
Saturday, January 16, 2016

Expires date:
Monday, January 16, 2017

Updated date:
Saturday, January 16, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
stocksafeupdate.com

Whois:
1 stocksafeupdate.com record

Scanner detections:
Detections  (77% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore.Installer.Installer (M), PUP.InstallCore.SoftWeb.Installer.Meta (M), PUP.InstallCore.FC.Installer (M)
90.91%

Microsoft Security Essentials
Worm:Win32/NeksMiner.A
9.09%

F-Secure
Application:W32/Generic.70053c248f!Online
9.09%

The domain www.stocksafeupdate.com has been seen to resolve to the following 14 IP addresses.

52.38.209.219
ec2-52-38-209-219.us-west-2.compute.amazonaws.com
June 2, 2016

52.33.165.25
ec2-52-33-165-25.us-west-2.compute.amazonaws.com
June 2, 2016

52.32.12.104
ec2-52-32-12-104.us-west-2.compute.amazonaws.com
June 2, 2016

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 16, 2016

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 16, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
April 17, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
April 17, 2016

52.26.95.11
ec2-52-26-95-11.us-west-2.compute.amazonaws.com
April 17, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
March 4, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
March 4, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
March 4, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
March 4, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
March 4, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
March 4, 2016

File downloads found at URLs served by www.stocksafeupdate.com.

1 / 68      (Adware)
http://www.stocksafeupdate.com/c?x=HOxkIJItYLzNBysNZd3MXyOYWKMW9zPPd9MLz8h8wXM=&c=4d1EnVC0qh5R5LNPanBg fIarOzCdlYmXO9DJxjOKOsP6HI/31ocsBp2bk9QoJ1WlPKLEYQBec0P5DqwWXCoueAD9YDnqHtnnvzWG0AlUA0ZQLZU02zDLaVXZTB9D9D7&fallback_url=http://storage.dobreprogramy.pl/.../VirtualRouterInstaller(dobreprogramy.pl).msi&downloadAs=Virtual-Router-25841-dp.exe  (f66bd78f68df79c914c412ba52b4c012)

2 / 68      (false positives)
http://www.stocksafeupdate.com/c?x=VsnT07XpF6QS1 Jw8v8JghXl1qigF1XQvfq0miDm03s=&c=vRB6Gqw2VB2cUBNsmWjnimQRViPDdmny M51uyy9bspvP3WlR9QiVXhRaUbvmQdf6japgXsG7R/8Z9b0SSh6yyh25wIcVjV2A5193nWgREk5u9OfbQy6ZtjNHyuHGwRe&fallback_url=http://storage.dobreprogramy.pl/.../uTorrent.exe&downloadAs=uTorrent-13270-dp.exe  (wrar420.exe)

0 / 68
http://www.stocksafeupdate.com/WVl6OTRQVTlwY1hkQmRVVkJURXg0WlVKcFNHTTVaRzFOYzI4NVFYaEZTRkJCZWxKMmNHWlphelE1YTNOU09XTWxNMFFtWXoxMk5uTm5NMjlFYzJsT2NqSnhKVEpHV2xaRGMwSkdUVEpqUkZkR2RIbDJTM2hLTkU1aFkwMHdiRXB4WW05SFNHRlRRWE42YjA1d1EyRkROM3A1V21Kc09YWndlQ1V5UWxWVFFrdE9lazV6SlRKQ1ZVWlVWbnAzWlc1VlRUbFFORzlDVEU1eGVpVXlSamRNVEZCSUpUSkdNMlV3YWswbE0wUW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjNkM2N1ZG5WNlpTNWpiMjBsTW1aMmRYcGxMV3hsWVhBbE1tWnBibk4wWVd4c0xXeGxZWEFsTW1aV2RYcGxUR1ZoY0ZObGRIVndMbVY0WlNaa2IzZHViRzloWkVGelBVRjZkWEpsZFhNdFZuVjZaUzFNWldGd0xUWXhPVFkzTFdSd0xtVjRaUT09  (VuzeLeapSetup.exe)

1 / 68      (PUP)
http://www.stocksafeupdate.com/c?x=EuXkM/Xtj7fLjNf86D4JhTdsM0KPfm55Kn/4YoXNNxg=&c=yVONcS3uWMzFCQ tdmfyqdgt/nlBrVO7fGE2/gLFJvwxV66bnvClcK78OoC6iR JE6zvc/KAVMpm4dVH 6nj6hO 7rY1lhLvmz5HNh lK60fSflkOUFNl4AQEIK 0N15&fallback_url=http://download.microsoft.com/download/F/B/9/.../Windows6.0-KB948465-X86.exe&downloadAs=Windows-Vista-Service-Pack-17321-dp.exe  (c.exe)

1 / 68      (PUP)
http://www.stocksafeupdate.com/c?x=9E7hm6fhqpekfili8AjeH/iwk98LDc8BiCeBGa863xM=&c=HFhB8TbDI6Z04VkAy6Pr3ls6 fudbv5JttAM/jsNxHIBLMSvbqgg7lVM90t/J/n7QNaPwgUPd4DTAy3TYz2PLulRHOWWNUhqLFWsNhhaIloEKbBMuQP8l/DdyHoC2/SF&fallback_url=http://download.microsoft.com/download/2/1/9/.../Windows6.0-KB936330-X86-wave1.exe&downloadAs=Windows-Vista-Service-Pack-12227-dp.exe  (c.exe)

1 / 68      (Adware)
http://www.stocksafeupdate.com/c?x=jXk2d4OFDv21TRFqY/ikGiE7/4Euwo4Il5vCLPLRlhM=&c=9b8NtLaB5R5ydeUXqiI4CwrQdkJuXGGzNZedLiWeG3t0y7ZzzZzRbrT1 DWXSRpWM9ubPqx8P0iZ40waPCbh81zoNHo0cnd8i6TelY4sZTZVLQslSZpVCCtbvrCEFhLo&fallback_url=http://storage.dobreprogramy.pl/.../ClassicShellSetup_4_2_5-pl.exe&downloadAs=Classic-Shell-35757-dp.exe  (9fc6e21f6a4575148d313daf1e21c20a)

1 / 68      (Adware)
http://www.stocksafeupdate.com/c?x=at6lFiLjDR0Ouvd5o8avnOVaRMMFURWFE5berHz PsA=&c=Un03CzpKX/Gj51pnIDGTLLuDbkSkxQcxY55ttWALpoxVW2rkmkh8N2gTiGK66KK1v62QPF0HdxxhMwGw7WrpwXat4A7mnGOzZdDE34qh5WMHxaGzdCuxzlMfmeEtVGNr&fallback_url=http://storage.dobreprogramy.pl/.../FFSetup3.8.0.0.exe&downloadAs=FormatFactory-13295-dp.exe  (d99bcf5228ad0441186e8c9e3433d8eb)

1 / 68      (Adware)
http://www.stocksafeupdate.com/c?x=IR40wen9AEEI71 o85K263hzPP1JCGC4SJ2Ov0pOvC0=&c=HG/ HoSL1Lr7XezVIHoU58fYgOhxzsPoydXDpH0IQqHI7 4IbJWiP6NuGNmIDq/Ds1IkKyfwMvNPtSI0ELlfmDfrlTkW c3z0m3sYV3QEDstu08U63CJSq9851DedJQJ&fallback_url=http://storage.dobreprogramy.pl/.../Imagine_1.0.9_x64_Unicode(dobreprogramy.pl).exe&downloadAs=Imagine-39484-dp.exe  (acd52535b11cd2de9fe6c3366752ec8b)

1 / 68      (Adware)
http://www.stocksafeupdate.com/c?x=oYJWoWb3nOWBYumCPmTkItMVXDry2dd6Q PYI /7Reo=&c=R4emx6nlmBBW2Ivf3WuBl9t9ZC3qqCEHALfn0lzi5rfabZm1xN7mBuXxFuWnzrCPGlXZV0w4g9frMWHFcwyDZpxySdMDv1QI7nLbKqOlXlnoYnteH4NfHL8 GBzosQeS&fallback_url=http://dpstorage.pl/.../iview441_x64_setup.exe&downloadAs=IrfanView-12867-dp.exe  (e59b1d9d4b12380faedd2e6e38379587)

1 / 68      (Adware)
http://www.stocksafeupdate.com/c?x=80Lwxl8bNUkdtH2Wtg7kKDRc0FElbiT7pRyVGxH eQ=&c=qOYwRP1GogSIS/rvy6iDiFYtuzXMWBAHq3yIDW1aq4sEO7dTRbZ54sqIlXGNXVkK6u4ZAMa1X2q0Ls2vb8iUZojhPcO1WTj15L/e fUEvnuZIUMmvRyFCH3Eg674TlkG&fallback_url=http://gdlp01.c-wss.com/gds/0/0200002550/.../crc-1-11-0-75r3-7l.zip&downloadAs=Canon-RAW-Codec-48983-dp.exe  (e57461ff78e407bffc4bffe1cc046282)

0 / 68
http://www.stocksafeupdate.com/c?x=mQGiNT4MQAdF7N8CFq2NPEF1 7Fjp8E4DEAXTJwV Hs=&c=G8jnmPCnHyjm nQtK2OyPxTsqf6L8j82UYBJepfDjJnR/P1oS2AbwxqC9O6Khh4EiYA6ArpQmEHNzzqZ8forqE4bn/Tpn0czSEsCbWBz7SeMBgb5SuMUOlXuNsQTWoxQ&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.4/win64/.../Firefox Setup 43.0.4.exe&downloadAs=Firefox-13108-dp.exe  (download.exe)

1 / 68      (PUP)
http://www.stocksafeupdate.com/c?x=g76ymB9b5IwIKOunwxvyGnpiydQXZ5P3PB6HILUd9WA=&c=nWyZi4vNHY4siZn905wqw3h2ecXB2l5Q3ftHKUUkIDQ9CZVODYcE4Qm6miNtw9uiOdwj/7bx3m2SIlNr4UB2MgzcSStc7p jYI1fIIL ka 4KX70VuS7CG4H0ZmyFtwK&fallback_url=http://get.geo.opera.com/pub/opera/desktop/34.0.2036.47/.../Opera_34.0.2036.47_Setup.exe&downloadAs=Opera-12614-dp.exe  (75dfc05ef38b254be86add28bea2c421)

1 / 68      (Adware)
http://www.stocksafeupdate.com/c?x=Yo9p7h/7Nik01qAEkTGUvH30BMBnXwHggpynCcBOJSY=&c=0ArMlWy kUCPPHayAQ8kniWSZh029oatJ5KFYOkp/QpUukXD3E0AI4uveiFLuZYAkiWQO4qA pgCASP5SUuZ2slUKLl TPblyL8fxQXtzZVta7NTe2bK47h2mKT2XYdn&fallback_url=http://.../ccsetup513.exe&downloadAs=CCleaner-13061-dp.exe  (a4f2d6c5e25cb56a755f5020d162e45d)

The following 18 files have been seen to comunicate with www.stocksafeupdate.com in live environments.

TCP » 52.38.209.219:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.38.209.219:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.38.209.219:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.38.209.219:80
browser.exe (Browser)

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.38.209.219:80
3.9.0.128_20140916045038.exe (The KMPlayer by PandoraTV)

TCP » 52.38.209.219:80
e5be.tmp

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

TCP » 52.38.209.219:80
client.exe

TCP » 52.38.209.219:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.38.209.219:80
kmplayer 3.8.0.117 -[www.patoghu.com].exe (The KMPlayer by PandoraTV)

TCP » 52.38.209.219:80
KMPlayer_3.9.0.126.exe (The KMPlayer by PandoraTV)

TCP » 52.38.209.219:80
3.9.0.125_20140702035547.exe (The KMPlayer by PandoraTV)

TCP » 52.38.209.219:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.38.209.219:80
online-guardian-v2.0.9.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.