I stumbled across suspicious file download behaviour from a site, but I am perplexed as to how it worked.

  • Visit Google.com
  • Search for the company name
  • On the list of results, click the company's link
  • Instead of being directed to their website, you remain on the Google search page and the file downloads to your computer without visiting the site at all
  • The file is a zip containing a JRE and "chrome updater.exe" (very suspiciously a malware package)
  • This was replicated on Chrome and Edge on Windows. Other OSes do not have this behaviour

How does this happen? I've never seen something download without actually being sent to a website before.

It appears that the file hosting service has now removed the file, and when clicking on the search results, it redirects you now to an actual website through box.com where the 'file removed' notice is stated.

  • Are you aware that it is possible to get direct file downloads from Google search results? try these results: google.com/search?q=commission+spreadsheet+filetype%3Axlsx
    – schroeder
    Apr 7 at 7:00
  • @schroeder I was not aware of that functionality - this virus was the first exposure I've had to to that behavior. Also, I suspected it was malware as it downloaded a zip containing JRE and "chrome updater.exe". It evaded the dynamic analysis tools I passed it through, as well as most engines on VirusTotal. Now that some time has elapsed, dozens of AVs now detect it as a Trojan. Apr 8 at 1:28

1 Answer 1


I've never seen something download without actually being sent to a website before.

It is unlikely that you were not send to the destination site. Instead the destination was not rendered in the browser window, but only download. Thus from the user experience it looked like the download comes from the origin site (Google), while technically it comes from a third party site.

If a link gets actually rendered in the browser window depends on the content delivered through the link. If it is HTML, an image, a PDF or other types which the browser supports for displaying (video, audio, plain text, ...) it will be rendered in the browser window and the URL shown reflects the origin of the windows content.

Data which cannot be rendered will be downloaded though. In this case it will stay with the original window content and also the original URL is shown, but download the content. Thus it will from the user experience look like the download happened from the original site, even if the actual source is a third party site. A download can also be enforced by having a Content-Disposition: attachment; filename=... HTTP header in the HTTP response.

Interestingly, the page loads normally when loading on an OS other than Windows.

The HTTP request sends in the HTTP header information which can be used to find out the OS - check https://www.whatismybrowser.com/detect/what-http-headers-is-my-browser-sending. Also from the your IP address your rough location can be determined. This can be used by the target to customize which content to send in the response, i.e. make it OS and location specific. This is also used to trick early malware detection by making sure that the malicious content is not send to IP addresses which might be associated with scanners of security companies.

I submitted it to their safe site form a few days ago, but it's still there.

The information entered will need to be validated because otherwise somebody could use this to make Google block inconvenient sites. Verification will take some time, especially if the target deliberately tries to trick detection by sending malicious content only to some IP addresses and/or only from time to time.

  • I appreciate your thorough answer Steffen - thank you. In case you were curious, google didn't end up taking the link down, but the file hosting service they were using to host the malware, box.com, has now removed the file. :) Apr 8 at 1:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .