ABE blocked a potential malware

[Salvy]

Hi today I was visiting this site http**://www**.chilenosencalifornia**.c*om/ and got a warning from ABE regarding it filtered a request from :

Code: Select all

ht**tp://***double.boubleba**relled.ws**/FrMal

After a bit of research I found out that piece of code is being used on exploited websites to distribute malware.

I'm curious how ABE determined it was a malicious code?

PS: Thanks for your great work Giorgio !

[GµårÐïåñ]

Because it attempts to make a local access to save the malware to be executed later. Since your standard ABE system ruleset denies such access to local system, it was thwarted.