Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

0
votes
2answers
166 views

Why don't the majority of today's malware use strong cryptography?

While reading another story of botnet takedown, my wondering has reached its apogee: Why don't malware authors use cryptography (encryption + signing) provided by good libraries when their creations ...
0
votes
2answers
68 views

Malware or viruses by browser redirects?

Recently was browsing and clicked on a link to the following address: (In code blocks so you cant accidently click it) http://paycheck-calculator.org/ Clicking on this quickly loaded 2-3 different ...
0
votes
2answers
494 views

How exactly does this Flash malware function on Ubuntu?

In this video, an experienced Ubuntu user manages to infect his system with some sort of malware. This is the first example I've ever seen of truly successful malware in the wild aside from privilege ...
-1
votes
2answers
112 views

Website Loading Content from Malicious Sites

I own a website. Now today I find that when I load the site, Chrome shows "waiting for xxx.com" and some other unknown sites. I never added content or links from these sites. The website is running on ...
3
votes
1answer
58 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
1
vote
1answer
55 views

How to distinguish malware from system crash?

Recently, I browsed to a website, which appeared to consume all the computer's resources. Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon ...
0
votes
1answer
87 views

Is Qt framework is under attack or it has something suspicious (only in free version)

I was trying to download Qt framework. I went to its Official site (I'm sure, I checked in Wikipedia) for Visual Studio. But when attempting to download Qt for Windows, my Firefox shows this message: ...
0
votes
1answer
127 views

Can't log into Windows, mac-spoofing issue or malware?

My computer won't let me log into my account. On the Windows sign in screen it has my account name, but when I put in my password, it always says my password is wrong. No Caps Lock. This happened ...
4
votes
0answers
208 views

Enabling virutalization, addressing the bluepill risk?

Background to this question is the ambivalence I assume with virtualization. Also to start directly with clarity: the term bluepill should here be a placeholder to denote "malware that uses ...
3
votes
0answers
37 views

How to detect suspicious content in a TrueType Font (.ttf) font file

I got curious about how to scan or assess the risk of a particular font file before deploying it to hosts. First line of defense, of course, is to make sure that our hosts are patched against any ...
3
votes
0answers
93 views

One-time mystery redirect from one of our pages

I'll make the explanation of the situation as thorough as I can, and the question is at the bottom. Recently, we received a report from one of our users that, immediately after logging out of our ...
3
votes
0answers
51 views

“Segmented” malware

I've been researching how anti-malware tools function and I feel like I'm missing something with heuristic analysis. What I've learned so far Anti-malware programs can use heuristic analysis and ...
3
votes
0answers
116 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...
2
votes
0answers
56 views

Creating a dynamic malware analysis environment

I don't know much about malware analysis so why this question here. I have analysed Short cut virus statistically and its impact on USB drives and wrote a code to repair its damage. My static ...
2
votes
0answers
27 views

Can I trust LPS?

LPS protects against spyware/malware by booting an OS from trusted media without reading from hard drives. However, not all components are open source. How do I know the US DoD didn't include ...
2
votes
0answers
155 views

How to scan large .bin files for malware?

I know about websites like VirusTotal, and programs like herdprotect. I'm using Avira and Superantispyware, but once the large bin files are scanned, usually nothing is found. But after running an ...
2
votes
0answers
72 views

Open source firmware as mitigation against firmware persistent malware?

I am concerned about the threat of persistent malware entrenched in device firmware. I am not familiar with the intricacies of firmware security, so I am turning to SE for help. I recently learned of ...
2
votes
0answers
59 views

Novicorp WinToFlash Lite, spyware etc

I used Novicorp WinToFlash Lite on Windows 7 to create a Windows 10 bootable USB memory stick. While creating the USB drive, I noticed that WinToFlash wrote something like adding blahblah files to ...
2
votes
0answers
151 views

Is the process Wslxrqjet.exe, tagged 'Google Chrome', malicious?

Multiple instances (between 3 and 15) of this of this process Wslxrqjet.exe are running on my Windows 8 system at all times. Windows Task Manager 'Description' field for all instances is "Google ...
1
vote
0answers
49 views

How does a malware overcomes this facility

I've seen many viruses/malicious VB scripts get executed when accidentally double clicked or through fake shortcuts redirecting to some viruses causing the Victim's PC a serious damage. But nowadays ...
1
vote
0answers
31 views

Polymorphic Analysis

I'm a beginner at malware analysis. For my research studies, I have to identify polymorphic malware based from experiments. I would like to know if there are any guides showing how to analyze the code ...
1
vote
0answers
72 views

What are the appropriate steps to take after installing a questionable Android app?

Situation: User installed an Android app from the Google Play Store. User's device is rooted, but that app does not have root privileges. XPrivacy reveals that the app is trying to make IPC ...
1
vote
0answers
30 views

iLivid infection/ iLivid behaviour analysis

Although lots of surveys and reports have been done on iLivid by lots of malware analyzers, I decided to inspect iLivid independent of previous research. I have read lots of reports about iLivid but ...
1
vote
0answers
148 views

How Skype Click to Call plugin is used to send spam?

My friend had Skype Click to Call plugin installed within browser on Mac OSX. And his Skype account started to send some automatic spam messages linking to lose weight websites (via goo.gl) without ...
1
vote
0answers
69 views

Detecting Malcode in Excel and Word Documents

There are a bunch of tricks to circumvent potentially malicious macros in office documents you receive. My question is how do I [forensically] detect if there are malicious macros in the documents? ...
1
vote
0answers
31 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
1
vote
0answers
31 views

cuckoo sandbox - PID exit

I hope someone could help me I've played with cuckoo for a while however I've just done a new installation and it all works however it will not run the binary i would like to scan. the PID exits ...
1
vote
0answers
84 views

Does this pdf file embeds an exploit or malware?

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
1
vote
0answers
97 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?
1
vote
0answers
61 views

Any Suggestion Exchanging shared key between process via port in untrusted machine (infected my malware)?

I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket. My assumption is that malware is running in ...
0
votes
0answers
22 views

Add new vulnerabilty module on honeypot dionaea

I want to install dionaea but i am not sure about it's capability to collect modern malware. I see that it use old vulnerabilities modules. My questions are: 1) It is possible to add new ...
0
votes
0answers
29 views

Is it suspicious that mail server sends traffic to Tor Exit node?

I am monitoring the outbound traffic from mail server through IDS and recently I observed there were some traffic sending to Tor Exit nodes from mail server, for example, IP 46.183.85.124. After doing ...
0
votes
0answers
53 views

Do these DNS requests seem like Conficker/Torpig-like behaviour?

I'm at my wit's end on this one... I have been seeing weird traffic from an IP on a client's local network and I think the host is malicious. Looking at the traffic it is producing, is always ...
0
votes
0answers
40 views

Where to get a specific malware by its name?

First of all, I have referred almost all the links provided by the following links Finding a specific malware sample for malware analysis purposes ...
0
votes
0answers
338 views

Tradeadexchange everywhere. On my mac, android and every browser

The tradeadexchange malware seems to have infected me in every possible way. It pops up new tabs whenever I am browsing on my Mac or Android devices, and also in any browser-Firefox/Chrome/.. ...
0
votes
0answers
28 views

Security Data Analytics - Classical Measurements/Metrics

for my new Job I have to prepare information about how Security Data Analysis is actually use in practice. So my question is if someone can provide me with measurements/metrics/queries (don't really ...
0
votes
0answers
77 views

Why malicious browser extensions along with API hooking

Most malware steals financial data by hooking to browser APIs like PR_Read, PR_write etc.. Also I see some malware like Sinowal use browser extensions along with these API hooks. I believe a user ...
0
votes
0answers
160 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
0
votes
0answers
117 views

Linux: Chinese Unionpay plugin, Ubuntu 64-bit - Spamware / Trojan?

China / Linux / Bank / Trojan / Backdoor / Executables Hey guys. I've got an account with a Chinese bank (I live here), and in the process of setting up an online account for the Chinese version of ...
0
votes
0answers
52 views

Is it possible to lock guest VMs (or processes) to sticks of physical RAM to prevent row hammer attacks?

I was wondering if it is possible through some means to isolate processes (or preferably guest VMs) to physical sticks of RAM. This would be to prevent row hammer like attacks from using physical ...
0
votes
0answers
302 views

Discovered unexplained large salted files in root folder on Linux, possible keylogger?

So I had Linux Mint running on my laptop, just installed it a month ago. It has a small hard drive, just 160gb, and I noticed shortly after installing the system, it ballooned to 80-some gigabytes ...
0
votes
0answers
55 views

Malware or exploit kit without escalation kit

Does anyone know of any malware or exploit kit that do not use a privilege escalation kit and just do malicious things with an unprivileged permission?
0
votes
0answers
473 views

Application Privilege Control in Kaspersky blocks program with no digital signature

I made a small application that displays hello world to the console output and attempted to open it in another computer that had Kaspersky fully updated. When I ran the application, Kaspersky gave a ...
-1
votes
0answers
56 views

Hacked site/hosting? Or hacked browser?

I need some help. I have a security plugin installed and I received an email notification telling me that A file change was detected on my system for my site. I logged in and noticed no unusual ...
-3
votes
0answers
19 views

How can I get rid of ogafdr.dll malware?

Every time my Windows 7 PC starts, Avast reports the following malicious process: C:\Program Files\cbe0a0d456caf9f5ffc42818634b4af9\d82a24b74d9073b29e5c73bb798c5253.exe The file reported by Avast ...