Editing 1247: The Mother of All Suspicious Files
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.
The edit can be undone.
Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 8: | Line 8: | ||
==Explanation== | ==Explanation== | ||
β | + | The save {{w|dialog box}} shows a download from the address <tt><nowiki>http://65.222.202.53</nowiki></tt>, an {{w|IP address}} that hosted {{w|JavaScript}} {{w|malware}} during a recent attack on the {{w|Tor anonymity network}}, with a very long file title. Many of the {{w|file extension|extensions}} used inside there indicate executable code; multiple file extensions are sometimes used to disguise a {{w|Trojan horse (computing)|trojan program}} as a document. | |
β | |||
β | |||
You can also see common download syntax for a pirated movie, {{w|Hackers (film)|''Hackers''}}, likely included to appear malicious to anyone skimming but is actually a movie about hackers, making it a benign reference rather than malicious. It is described as "<tt>_BLURAY_CAM</tt>", which contradicts itself ("<tt>_BLURAY</tt>" would imply it was ripped from a copy on {{w|Blu-ray Disc}}, while "<tt>_CAM</tt>" would mean it was copied by pointing a camera at the screen in the cinema). "<tt>_BLURAY_CAM</tt>" would probably indicate a search-keyword-stuffed fake copy; fake pirated media often contain viruses (although this is more likely to be a problem with newer media, before the first real pirated copy appears). | You can also see common download syntax for a pirated movie, {{w|Hackers (film)|''Hackers''}}, likely included to appear malicious to anyone skimming but is actually a movie about hackers, making it a benign reference rather than malicious. It is described as "<tt>_BLURAY_CAM</tt>", which contradicts itself ("<tt>_BLURAY</tt>" would imply it was ripped from a copy on {{w|Blu-ray Disc}}, while "<tt>_CAM</tt>" would mean it was copied by pointing a camera at the screen in the cinema). "<tt>_BLURAY_CAM</tt>" would probably indicate a search-keyword-stuffed fake copy; fake pirated media often contain viruses (although this is more likely to be a problem with newer media, before the first real pirated copy appears). |