Hot answers tagged

14

This is a typical obfuscated JavaScript malware which targets the Windows Script Host to download the rest of the payload. In this case, it downloads what appears to be mainly a Chrome Extension (manifest.json and bg.js), and some autoit scripts which likely include some form of ransomware (all of which names with .jpg extensions on the server they are ...


5

This is a fool's errand. Even if you you could obfuscate them sufficiently in the source code, it would still be child's play to hook the device up to a proxy like Fiddler or Burp Suite, and see the raw URLs plain as day when the app is running. No need to look at your source code at all, and there is absolutely nothing you can do about protecting HTTP ...


5

Is this an exploit on Facebook? Most likely. The unscrupulous are always trying to find ways to gain access to bank accounts, passwords, friend lists, and anything else they can do to turn a buck. Is it possible that my friend got a virus which targets their contacts by tagging them on malicious links? There's no reason to think otherwise. The ...


4

What risks do you have? Possibly that your computer is now infected with malicious software like a virus or a trojan horse. The following steps should be taken if you didn't already. What to do? There are some steps you can take: First of all, don't click on links that you don't trust or know Use unshortenit.it or urlex.org to check where the ...


3

I haven't got the time to fully reverse-engineer what this script does, but it seems to link to several .jpg files that are actually not images but text, and then references some .au3 files, suggesting that it actually saves those .jpg files under that extension. Those .au3 files seem to match AutoIt's file extension and indeed they look like valid AutoIt ...


2

From what it looks like, a malicious actor leverage what is known as a XML External Entity vulnerability (XXE) and then a Server-Side Request Forgery (SSRF). Facebook's servers were tricked into linking a malicious XML file from another domain, processing it and served it up to you. Here is the XXE cheat sheet and SSRF bible's cheat sheet, if you're ...


2

It is not possible to encode the exploit as you would encode a payload. The reason is that the data that is part of an exploit is directly processed by the vulnerable application (in this case Flash). The function inside the Flash binary which process the exploit data won't decode it first. In case of payloads we can encode it because when the payload gets ...


1

What you are describing is essentially an extra salt encrypted with a key derived from an extra password consisting of dictionary words that are not chosen by the user. I know this will appear as a rather vague and general criticism, but I see three downsides with this: You are rolling your own. Inventing your own systems to solve problems with ...



Only top voted, non community-wiki answers of a minimum length are eligible