Questions tagged [malware]
Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
2,510
questions
2
votes
1
answer
115
views
PC to iOS, USB storage Malware?
I have a laptop, with Windows 7, no internet (with the wifi adapter physically removed). I want to use that machine for stuff like old abandonware, and don’t want to risk any type of malware or virus ...
- 21
0
votes
2
answers
289
views
Chance of virus/malware and non-executable files
I’ve seen this question being asked so many times, but I still have questions.
I know that to execute malicious code from non-executable files such as videos (mp4), audios (mp3) and documents (pdf), ...
1
vote
0
answers
112
views
Has my browser been infected after visiting malicious link?
Today I typed in a URL of a site I know. Unfortunately I missed one letter of the TLD. I typed .co instead of .com.
No problem, I'll quickly retype the URL. Unfortunately, this was not possible. The ...
- 111
0
votes
1
answer
84
views
Using a program that likely has a trojan horse? [closed]
OP wants to back up his Blu-ray/4K collection to a HDD.
OP suspects that a very popular program that makes MKVs is actually a trojan horse that infects host computer's USB drives, which can later be ...
0
votes
1
answer
91
views
Verify the safety of old back ups
I have an old laptop that I've been using since high school, and for a long time I wasn't careful with how I used it. Namely, I shared USBs with friends and teachers for assignments and presentations, ...
- 1
0
votes
0
answers
864
views
How to inspect for potential malware on pdf attachment?
I received an email at work the other day from a client (with the correct email address) that had a pdf attached. When I opened the pdf, it said the client had required the recipient to login to ...
- 9
0
votes
0
answers
69
views
Technical details behind how a malware-infected device infects other devices on the same network?
I'm a security student and for one of my projects, I'm trying to learn the technical details behind a malware-infected device infecting other devices on the same network. I can see so much content ...
- 23
1
vote
0
answers
104
views
USB SSD Backdoor command issue [closed]
In our company we have many SpeedFaster 2TB USB SSDs. They were working perfectly until our endpoint protection software was updated. Currently they work only for a few seconds and are then blocked ...
- 11
1
vote
2
answers
449
views
How easy is it to inject malware into websites?
Please let me present you with a hypothetical scenario. A journalist is targeted by hackers. Said journalist is very careful with email attachments and will not click on them. However, surfing the web ...
- 11
0
votes
0
answers
560
views
Google Sheet with macro opened on Android phone. Will the macro run?
I accidentally opened up a spam mail containing a google drive sheet with a macro on my Galaxy S8 phone. The spam email goes something like:
Headline: "Need action! Withdrawing Funds id - (some ...
0
votes
0
answers
93
views
Is it possible for media files (mp3,mp4) contain malware [duplicate]
I would like to know the technique and if it’s possible in the first one place, not activating the media player the file it self
- 1
0
votes
1
answer
147
views
Can flash drive infect Android and then the Android infect Windows PC?
I found a flash drive outside my home. Thinking one of my neighbors might have dropped it and wanting to return to them (but still wanting to be cautious), I (stupidly) plugged it into an old Android ...
- 1
0
votes
0
answers
26
views
I clicked what looked like an Amazon email, but it (maybe) was from an Amazon affiliate. Ended up at Amazon.com anyway. Can I safely investigate? [duplicate]
In a case of clicking too fast, I clicked on a picture that looked like it was from Amazon. However this was not the case. I did end up at Amazon, but I'm aware that other things could've taken place ...
- 1
0
votes
0
answers
85
views
Downloaded malicious VSCode version
I just downloaded VSCode and after running the setup, which wouldn't give any response, I noticed that the setup.exe came from an obviously fake website. The website was the first to pop up upon ...
- 1
0
votes
0
answers
175
views
Font file flagged as malicious by antivirus
BitDefender (Free edition) for Windows identified the CascadiaCode.ttf font file as malware and moved it from the Fonts folder into quarantine.
My Windows 11 install is like a day old, so maybe it's ...
- 101
0
votes
2
answers
115
views
How to protect digital evidence against deletion when confronted with a motivated state actor
Given the hypothetical, you have digital evidence that state actors want to delete. Assuming two scenarios
Scenario #1 - The state actors are not the agencies themselves, but bad actors within the ...
- 103
0
votes
0
answers
458
views
Can malware get installed by phone call
I'm concerned about my phone's security. I work in a very sensitive field and I received a call from a private number. What seems strange to me is the following :
I received a call from a private ...
2
votes
2
answers
267
views
Does attaching malware or virus in an email count as Phishing attack
I know that Phishing attacks try to gain access or sensitive information from the user or victim. This attack comes under the Social Engineering attack, where personal confidential data such as login ...
0
votes
0
answers
86
views
Build Ransomware analysis lab
Could somebody help me with the following questions:
Does a sandbox adds extra security over a virtual machine host-guest interaction, or does it only provide a security analysis (API call sequences ...
- 35
0
votes
0
answers
44
views
There's malware on my machine and I can't find it [duplicate]
I just had a rather alarming experience.
As I was sitting here doing something else, with my laptop open, logged in (Windows 10) but not in use, with Chrome open, I noticed some activity out of the ...
- 273
0
votes
1
answer
248
views
Can my infected phone’s hotspot infect my outdated computer?
Knowing that anything is possible for the many ways a hacker can break into a system, is it also possible that if I have an infected phone acting as a hotspot, my outdated computer could get infected ...
2
votes
1
answer
215
views
How to decrypt Emotet's TLS traffic by MITMProxy
I have a question about Emotet's TLS traffic:
Using MITMProxy, I have successfully decrypted TLS traffic with Emotet's C2 server and can read the contents of the traffic.
https://mitmproxy.org
...
- 21
4
votes
1
answer
461
views
Some ISP inject malware/ads into my website in the middle of transit
I host my website by my own using droplet/VPS service and node.js server. My wesbite uses SSL Cert/HTTPS from LetsEncrypt, VPS service from DigitalOcean, domain registered from local vendor (RumahWeb) ...
- 143
1
vote
2
answers
451
views
Malware prevention of data received in a POST endpoint
Problem
Having one HTTPS api which has an endpoint i.e POST data how can we prevent/check that the data received is not malicious or possibly detrimental?
To consider (please read)
POST data receives ...
- 65
0
votes
1
answer
64
views
what is stack segment manipulation?
I was trying to research about anti-debugging techniques here, but i failed to make sense of what stack segment manipulation's. Could anyone have a good explanation for what it means or nice resources ...
2
votes
0
answers
370
views
Why does MS Teams establishing outbound connection towards malicious IP? [closed]
I'm wondering how come an internal "Teams.exe" can make outbound connections to a malicious IP, 132.147.119[.]217 (ISP: ViewQwest Pte Ltd) that was flagged as malicious and also was involved ...
- 21
2
votes
2
answers
369
views
What can a virus hidden in a video do and will the video be playable?
Based on existing answers, I found out that viruses can "hide" in a video by exploiting the software/libraries used to open the video, say ffmpeg. But my question is:
If a video contains ...
- 217
0
votes
0
answers
24
views
Found several potentially malicious PHP files but not sure what they are doing? [duplicate]
A friend found several suspicious PHP files on his server when we was upgrading his Wordpress install. They are all in the public_html folder and the filenames are the name of his domain with ...
- 101
2
votes
3
answers
215
views
Is Chrome's view-source dangerous when visiting malicious sites? [duplicate]
What are the risks of viewing the source code of malicious pages on Google Chrome?
I want to go directly to view-source:https://example-site.com to visit the sites without rendering anything malicious ...
0
votes
0
answers
112
views
Adding a script tag after the html closing tag
I am still a beginner in web vulnerability. While I was browsing on the internet I saw a challenge inspired by a real life security crisis. We are given a pcap of a malware infection that was done in ...
0
votes
1
answer
111
views
Is it safe to copy an encrypted file from quarantine to another computer for analysis?
Is it safe to configure the antivirus to automatically copy the file from the quarantine to a network share?
The antivirus should copy the encrypted archive (with password intact) from the quarantine ...
0
votes
0
answers
128
views
Requests to malicious IP being sent by background process on Windows
Whenever an internet connection is established on my pc, I am repeatedly getting warnings from QuickHeal like this:
I am getting such warnings repeatedly with different IP addresses. In the above ...
- 1
1
vote
2
answers
1k
views
Security Implications from Base64 Image
I copy / pasted a data:image/png;Base64 image from a Google search into a Google Slide, before realizing it was a BASE64 image. Is there any possibility that this contains malicious code, or any way ...
0
votes
1
answer
115
views
Does email provider scan mails for viruses?
Imagine I am on [email protected] and I send a mail to [email protected] with an eicar.txt as an attachement. Will the email be stopped because it contains the eicar.txt ?
In case there is an email ...
- 1
0
votes
0
answers
48
views
Are these cPanel processes malicious? [duplicate]
I have previously asked a question There's an expect.php file in all the git repositories of my web server, is this malicious? and this question is a further continuation if it.
After investigating ...
- 296
18
votes
2
answers
3k
views
Is this expect.php file (in all the git repositories of my web server) malicious? [closed]
Whenever I create a remote repository on my web server there seems to be a file called expect.php or options.php with the following code in it:
<?php
function visit_cookie() {
$h = $_COOKIE;
...
- 296
1
vote
0
answers
70
views
How can I get & keep an unauthorized user out of my network? [closed]
I have replaced hardware, equipment, and passwords. I think they are in Yahoo, Microsoft, phone, and laptop. I have changed all with no success. They use my identity as the temporary ID from Microsoft ...
0
votes
0
answers
388
views
How to tell if a mouse/keyboard doesn't have on-board memory?
How to tell if a mouse/keyboard doesn't have accessible on-board memory? I know if it has: there are tells like custom macro buttons for example, and I was told by A4tech support: if a mouse doesn't ...
- 1
0
votes
0
answers
28
views
How does a malware differentiate between a real user device from a sandbox? [duplicate]
I'm currently working on malware evasions. As far as I know, malware can tell sandboxes from real user devices by examining device characteristics like wear and tear, looking for human-like behavior ...
3
votes
1
answer
2k
views
What is known about the android spinmaze malware
The android spinmaze malware is characterised by the unrequested installation of the "spinmaze" application, and repeated popup messages of the form "Shortcut spinmaze already exists&...
- 131
-2
votes
1
answer
174
views
I have a spyware installed on my laptop and it is filtering my internet usage in real time. How can i bypass the spyware and search the internet [duplicate]
Both my Laptop and phone are compromised, a spyware was installed by someone who was close to me.
Now I am not able to browse the internet fully. Search results on both Google and onion engines are ...
- 125
1
vote
0
answers
185
views
How do I go about analysing VirusTotal and Hatching Triage's memdumps?
I normally use volatility to analyse memory dumps, however, in this case it doesn't seem to be working. I get a "Symbol table not found" kind of error, even though I have downloaded and ...
- 33
1
vote
1
answer
98
views
Secondary disk safe to use after potential virus?
I've recently bought a new disk and made a fresh install on a home PC after having potential malware (or a very corrupted registry, whatever your take is on having numerous Blue Screens of Death, one ...
user130386
0
votes
1
answer
300
views
Rogue login to Google account after Windows clean install
Yesterday I downloaded a sketchy .exe on my Windows desktop and executed it. A command prompt window appeared then nothing abnormal happened. I tried running MalwareBytes but it didn't display any ...
- 11
2
votes
2
answers
819
views
Is there malware that can run without user interaction after a download from the internet?
Is there malware that can run from a simple download from the internet autonomously without user interaction/initiation?
I know there are worms that can do that, but I assumed they needed to be opened ...
- 21
1
vote
0
answers
431
views
What does it mean when Google anti-virus engine reports "Detected"?
I need to convert a ton of directories of JPEGs into PDFs or EPUBs.
So I downloaded this: https://ci.appveyor.com/project/josch/img2pdf/build/artifacts
Being scared that it might be malware, as any ...
- 11
2
votes
2
answers
358
views
If a computer gets infected with malware, can the host firewall block the malware from communicating back to its controller on the internet?
I'm trying to figure out how secure a host firewall is, hence the question in the title.
I read that many firewalls allow outbound connections to port 80 to allow browsing, would that be enough for ...
2
votes
0
answers
43
views
BPFDoor injection point and containment
How to determine BPFdoor entrypoint?I used following link to detect it on host https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-...
- 21
0
votes
5
answers
547
views
Are portable apps vulnerable to binary planting?
Several Windows apps come in both "installer" and "portable" forms, with the latter having the advantage that you can just download and run it from anywhere in the system.
Doesn't ...
- 105
0
votes
1
answer
181
views
Can malware override and execute any memory location or it has to be specific?
Rather primitive Malware using Python3 and similar already available software on the victim's machine (which can also be compiled using PyInstaller/pycom if not) has the capability to override the ...
- 1,554