Reply to thread

Message

<blockquote data-quote="struppigel" data-source="post: 1048870" data-attributes="member: 86910">It looks similar to Electron because it is also a Node.js application. But not Electron. It is also correct that the full folder&#039;s contents are necessary to run everything. But one could create a standalone executable by creating an SFX with 7zip. If you think this helps you with automatic analysis sandboxes, I can try to create one.You find the entry point of the application in the package.json. This file mentions first_page.html as main.[ATTACH=full]277024[/ATTACH]The malicious code is inside: init/first_page.htmlIn first_page.html you see obfuscated JavaScript.[ATTACH=full]277023[/ATTACH]The application creates a folder in %LOCALAPPDATA%\Leading and saves a lot of data there.You should delete this folder on your friend&#039;s system.[ATTACH=full]277021[/ATTACH][ATTACH=full]277025[/ATTACH]Looks like adware/spyware to me. The folder is full of affiliate and advertising related data.Didn&#039;t have time to deobfuscate the code yet, it looks a bit nasty, and I do not think it is worth sinking hours into it because it does not seem to be a serious threat. It stems likely from a Potentially Unwanted Software download. Make sure to check the installed programs on the system for PUP.</blockquote>

[QUOTE="struppigel, post: 1048870, member: 86910"] It looks similar to Electron because it is also a Node.js application. But not Electron. It is also correct that the full folder's contents are necessary to run everything. But one could create a standalone executable by creating an SFX with 7zip. If you think this helps you with automatic analysis sandboxes, I can try to create one. You find the entry point of the application in the package.json. This file mentions first_page.html as main. [ATTACH type="full" alt="1688998304654.png"]277024[/ATTACH] The malicious code is inside: init/first_page.html In first_page.html you see obfuscated JavaScript. [ATTACH type="full" alt="1688998159496.png"]277023[/ATTACH] The application creates a folder in %LOCALAPPDATA%\Leading and saves a lot of data there. You should delete this folder on your friend's system. [ATTACH type="full" alt="1688998084013.png"]277021[/ATTACH] [ATTACH type="full"]277025[/ATTACH] Looks like adware/spyware to me. The folder is full of affiliate and advertising related data. Didn't have time to deobfuscate the code yet, it looks a bit nasty, and I do not think it is worth sinking hours into it because it does not seem to be a serious threat. It stems likely from a Potentially Unwanted Software download. Make sure to check the installed programs on the system for PUP. [/QUOTE]

Verification