Someone sent me a file (.exe) on discord, saying it’s supposed to be a popup finder. Many people were worried about what’s inside, so… I ‘analyzed’ it together with my friends (<3).
No, it is not a virus! It is an AutoIT-Script that just opens redirects in a loop... in Microsoft-edge (Via Shellexecute). It only works on 64-Bit Windows 10 (because only Windows 10 has Microsoft-edge by default), you cannot execute it on 32bit and not Win7
Have a look at the source code.
https://pastebin.com/KAi3riTP
Apart from "byteread.org" opening gay porn, there is no real magic behind it.
What really bothers me is that it does not give you any warning about what it's doing, it does not tell you to run it inside a VM, it does not tell you how to stop it and it does not say that it's going to crash your browser (It will!)
Other than that, it's using the exact same links that other users already posted on scammer.info and the links that used to be on asat.cf/URLs. Well, this isn't necessarily bad .. but then it won't make a real difference to the other "popup finders".
Questions to whoever made this:
Why does it need to be an -.exe file? People thought there is a virus inside, also some scanners 'detected' it as malware or suspicious. I mean, you could just make a website / some HTML or javascript, something that you could edit.. couldn't you? Better than compiling an .exe file imo...
Why is there no warning about what it does and how you should not run it on your host machine? People don't know what it does and might execute it on their real PC.
