0

I tried to download a .exe today. It did not run properly (invalid signature, and Windows refused to run, then compatibility mode suggested Windows 8.1 mode, then again the run failed).

Then, I decided to check and noticed the file only weighs 27 KB, while the original .exe should weigh 65 MB.

So my first thought was that it was poisoned. I uploaded it to VirusTotal and it triggers a comodo engine detection rule: Heur.Corrupt.PE@1z141z3. Another engine also flagged a heuristic detection, all other detections came back negative.

So, it being a heuristic detection, it could also be consistent with benign file corruption.

But, Chrome has never shown an incomplete download as a valid file, it always showed them as .crdownload, etc.

So my question is: is it possible under some condition (I'm working on a unstable connection) Chrome shows an unfinished download as a valid file?

How much should I worry?

Improve this question
4
  • Its a corrupt download, not incomplete.
    – Moab
    Apr 23, 2020 at 19:19
  • So, is it possible for a download to be corrupted by an unstable connection and no other sign of it failing ?
    – cladelpino
    Apr 23, 2020 at 19:22
  • Why don't you download it again and see?
    – harrymc
    Apr 23, 2020 at 19:33
  • Downloading the file again works properly... How does that influence the benign corruption vs evil payload argument ?
    – cladelpino
    Apr 23, 2020 at 20:17

2 Answers 2

Reset to default
0

Yes, it is possible.

I dissasembled both files using DetectItEasy and checked that the 27 KB file is fully contained in the 55 MB (supposedly correct) file.

So apparently this was an incomplete download that wasn't flagged as such by chrome.

I had never seen this behaviour.

Improve this answer
0

I have no idea how Chrome checks the download and determines it is "correct" or "finished", but I doubt it can demonstrate such behavior often.

Instead, I would assume some different explanation: for example, Chrome might have downloaded the file completely and correctly, and then your antivirus detected a threat and "cured" the file, removing 99% of its content. This also looks weird, but I would personally bet on that rather than on Chrome malfunction :)

Improve this answer
1
  • 1
    Highly unlikely. Instead, some content is served without a “Content-Length” header. If the download connection is disconnected early for whatever reason, the browser cannot tell it’s incomplete.
    – Daniel B
    Oct 21, 2022 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.