Hot answers tagged

97

This is a typical obfuscated JavaScript malware which targets the Windows Script Host to download the rest of the payload. In this case, it downloads what appears to be mainly a Chrome Extension (manifest.json and bg.js), the autoit Windows executable, and some autoit scripts which install them. All of these files are named with .jpg extensions on the (...


31

I haven't got the time to fully reverse-engineer what this script does, but it seems to link to several .jpg files that are actually not images but text, and then references some .au3 files, suggesting that it actually saves those .jpg files under that extension. Those .au3 files seem to match AutoIt's file extension and indeed they look like valid AutoIt ...


16

From what it looks like, a malicious actor leverage what is known as a XML External Entity vulnerability (XXE) and then a Server-Side Request Forgery (SSRF). Facebook's servers were tricked into linking a malicious XML file from another domain, processing it and served it up to you. Here is the XXE cheat sheet and SSRF bible's cheat sheet, if you're ...


11

Is this an exploit on Facebook? Most likely. The unscrupulous are always trying to find ways to gain access to bank accounts, passwords, friend lists, and anything else they can do to turn a buck. Is it possible that my friend got a virus which targets their contacts by tagging them on malicious links? There's no reason to think otherwise. The ...


7

What risks do you have? Possibly that your computer is now infected with malicious software like a virus or a trojan horse. The following steps should be taken if you didn't already. What to do? There are some steps you can take: First of all, don't click on links that you don't trust or know Use unshortenit.it or urlex.org to check where the ...



Only top voted, non community-wiki answers of a minimum length are eligible