Another test

Deleted: Setup.exe 64.2 KB

Setup.exe 64.2 KB Download

Pasting from .zip
*****************

README.txt:
**In order to test the bug you must run the contents in a server (I used XAMPP, but any stack will do) and not locally opening the file in Chrome, otherwise it will not work!
My code is in the /build folder that I used to make "Program.exe" and the website for the demonstration is in the /htdocs folder. 


From the index.html:
The program "Content.exe" was still passed to the user through the program "Program.exe". This was done by taking the "Content.exe" and converting the ".exe" to a ".txt". Next, I created a batch file that would change the extension automatically when executed and then it would end up launching the malicious code. Then, I put it into a ".exe" using a program called "Advanced BAT to EXE converter v2.94" and packaged the batch program and the malware hidden as a .txt into a single .exe. All the user has to do is simply execute that program and that malicious code is already running and stored on the users' temp folder so it could lead to further damage.

For testing I used a XAMPP stack on my computer and downloaded the two links below. The first one is the example malware taken from "https://testsafebrowsing.appspot.com/" and the second is another file (I will give my binaries that I used to make it) that ends up launching the same code.

Thanks for the report!

You're effectively wrapping an .exe in another one, which does not bypass safe browsing.  This will still trigger a request to Safe Browsing to analyze your new .exe, so this is WAI and doesn't meet the VRP rules:

https://www.google.com/about/appsecurity/chrome-rewards/
"The download should not send a Download Protection Ping back to Safe Browsing. Download Protection Pings can be measured by checking increments to counters at chrome://histograms/SBClientDownload.CheckDownloadStats. If a counter increments, a check was successfully sent (with exception to counter #7, which counts checks that were not sent)."

Thanks for taking a look at my report!

I'll try to see if I can catch any vulnerabilities and be able to fully bypass
Safe Browsing to were it doesn't send a Download Protection Ping. By the way, what did you mean when you said "so this is WAI"? 

WAI = "Working As Intended"

For all Download Protection VRP bugs: removing label Restrict-View-Google and adding Restrict-View-SecurityTeam instead.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot