Author Topic: Could Use a Little Peace of Mind  (Read 1437 times)

0 Members and 1 Guest are viewing this topic.

Offline spookyorbit

  • Newbie
  • *
  • Posts: 4
Could Use a Little Peace of Mind
« on: May 30, 2023, 08:00:59 AM »
Hi all,

Hoping for a second set of eyes to take a look at this exe file and let me know if I am safe. I downloaded and ran the exe file from Github below, it's an auto installer for a stable diffusion web UI. Like a true pro, I uploaded the exe file to Virus Total after I ran the file on my comp and found out that 3 out of the 71 security vendors flagged the file as malicious, one of them being Zillya. I've done a full scan and an offline scan of my computer with Windows Defender, as well as a full scan by Avast and nothing was flagged by either program. Can anyone take a look at the exe file and let me know if I should be worried? Thank you for your time and help in advance.

https://github.com/EmpireMediaScience/A1111-Web-UI-Installer/releases/tag/V1.7.0

Thanks,

Spooky

Online polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33978
  • malware fighter
Re: Could Use a Little Peace of Mind
« Reply #1 on: May 30, 2023, 11:21:02 AM »
A true pro would present a broken link, whenever in doubt something could be (potentially) malicious. Do so please.

Lumu flags as malicious and off the shelf products do not.
Let Avast establish this, file an FP report.
polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline spookyorbit

  • Newbie
  • *
  • Posts: 4
Re: Could Use a Little Peace of Mind
« Reply #2 on: May 30, 2023, 05:45:23 PM »
Thanks for the quick response Polonus! I've filed a false positive report with Avast so we will see what they say.

Out of curiosity, is Lumu flagging this file as malicious something I should worry about?

-Spooky

Online polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33978
  • malware fighter
Re: Could Use a Little Peace of Mind
« Reply #3 on: May 30, 2023, 07:52:51 PM »
If malware it is or could be "x-pjax malcode".

Read:  https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Xpaj

That it is not, is just that is what we seek to hear or get guaranteed from avast team. That's all we know for now,

polonus

Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline spookyorbit

  • Newbie
  • *
  • Posts: 4
Re: Could Use a Little Peace of Mind
« Reply #4 on: May 30, 2023, 09:01:40 PM »
Thanks again for the quick response! Do you know how long it takes the team to review FP requests? And with this particular malware, would restoring my computer to a previous backup would help squash any chances of infection?
« Last Edit: May 30, 2023, 09:14:41 PM by spookyorbit »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89428
  • No support PMs thanks
Re: Could Use a Little Peace of Mind
« Reply #5 on: May 30, 2023, 09:19:16 PM »
You should get a response in a day or two.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.6.6121 (build 24.6.9241.848) UI 1.0.809/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline spookyorbit

  • Newbie
  • *
  • Posts: 4
Re: Could Use a Little Peace of Mind
« Reply #6 on: May 30, 2023, 09:25:19 PM »
Awesome, thank you David!

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89428
  • No support PMs thanks
Re: Could Use a Little Peace of Mind
« Reply #7 on: May 30, 2023, 09:33:40 PM »
You're welcome.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.6.6121 (build 24.6.9241.848) UI 1.0.809/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Online polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33978
  • malware fighter
Re: Could Use a Little Peace of Mind
« Reply #8 on: May 31, 2023, 09:45:35 PM »
The link hxtps://github.com/EmpireMediaScience/A1111-Web-UI-Installer/releases/tag/V1.7.0
is blacklisted at urlscan.io and so won't be scanned.

Link wirth a Tomahawk motherboard? Site has Amazon and CDN tracking on it.

Consider IP abuse: https://www.abuseipdb.com/check/140.82.113.3  Scam- and Spamvertising abuse found.

Also condier report here: https://www.hybrid-analysis.com/sample/45399315734867d1bdcf5afc13c3dc19c05e4404455faab0786df742d51bbf5f

I lean towards no specific threat found.

Again wait for the final verdict from avast's team.

polonus
« Last Edit: June 01, 2023, 02:51:58 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!