Exploit / PoCcritical
Chrome 0-day exploit CVE-2019
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-13720 | Use-After-Free in Google Chrome WebAudio Allows Heap Corruption (Actively Exploited) | 8.8 | 49% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | behindcorona.com | tag that loaded a remote script from hxxp://code.jquery.cdn.behindcorona[.]com/. The script then loads another script named .charlie.XXX |
| md5 | 27e941683d09a7405a9e806cc7d156c9 | he archive contains two files: File name: iohelper.exe MD5: 27e941683d09a7405a9e806cc7d156c9 SHA256: 8fb2558765cf648305493e1dfea7a2b26f4fc8f44ff72c95e91 |
| md5 | 8f3cd9299b2f241daf1f5057ba0b9054 | ve, with the following information: File size: 293,403 MD5: 8f3cd9299b2f241daf1f5057ba0b9054 SHA256: 35373d07c2e408838812ff210aa28d90e97e38f2d0132a86085 |
| md5 | f614909fbd57ece81d00b01958338ec2 | 4fc8f44ff72c95e9165a904a9a6a48 File name: msdisp64.exe MD5: f614909fbd57ece81d00b01958338ec2 SHA256: cafe8f704095b1f5e0a885f75b1b41a7395a1c62fd893ef4434 |
| sha256 | 35373d07c2e408838812ff210aa28d90e97e38f2d0132a86085b0d54256cc1cd | size: 293,403 MD5: 8f3cd9299b2f241daf1f5057ba0b9054 SHA256: 35373d07c2e408838812ff210aa28d90e97e38f2d0132a86085b0d54256cc1cd The archive contains two files: File name: iohelper.exe MD5 |
| sha256 | 8fb2558765cf648305493e1dfea7a2b26f4fc8f44ff72c95e9165a904a9a6a48 | iohelper.exe MD5: 27e941683d09a7405a9e806cc7d156c9 SHA256: 8fb2558765cf648305493e1dfea7a2b26f4fc8f44ff72c95e9165a904a9a6a48 File name: msdisp64.exe MD5: f614909fbd57ece81d00b01958338e |
| sha256 | cafe8f704095b1f5e0a885f75b1b41a7395a1c62fd893ef44348f9702b3a0deb | msdisp64.exe MD5: f614909fbd57ece81d00b01958338ec2 SHA256: cafe8f704095b1f5e0a885f75b1b41a7395a1c62fd893ef44348f9702b3a0deb Both files were compiled at the same time, which if we are |
| url | http://code.jquery.cdn.behindcorona.com/ | ted a small JavaScript tag that loaded a remote script from hxxp://code.jquery.cdn.behindcorona[.]com/. The script then loads another script named .charlie.XXXX |
From the original article
5 min read at securelist.com
Kaspersky Exploit Prevention is a component part of Kaspersky products that has successfully detected a number of zero-day attacks in the past. Recently, it caught a new unknown exploit for Google’s Chrome browser. We promptly reported this to the Google Chrome security team.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.