Website is clean but kaspersky says malicious file found

[neelesh.om]

Our website is clean and internet security says that website contains malware. Can you please check as users are getting this , screenshot attached.

Kindly help

[Berny]

@neelesh.om Welcome.

Please submit the url here https://opentip.kaspersky.com/ and ask for reanalyze.
 

Spoiler

 

[harlan4096]

I just got a reply from K. analysts:

_______________________________________________________
User type: Active user
Application name: firefox.exe
Application path: C:\Program Files\Mozilla Firefox
Component: Safe Browsing
Result description: Blocked
Type: Trojan
Name: HEUR:Trojan-PSW.Script.Generic
Precision: Heuristic Analysis
Threat level: High
Object type: File
Object name: translate.min.js
Object path: https : // headvape . com/js/mage
MD5 of an object: B45831AD971E3B0343B65F38FC8DF36E
Reason: Expert analysis
Databases release date: Today, 26/05/2022 9:08:00
_______________________________________________________

Quote

 

Hello,

The blocking of this URL is correct.

Best regards, V. G., Malware Analyst
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 http://www.kaspersky.com https://securelist.com
https://opentip.kaspersky.com/ - get insights about suspicious files, hashes, URLs, IP addresses or domain names

 

 

It seems that URL performs an access to that different malicious URL...

[neelesh.om]

we have removed the url , can you guys check again

 

[harlan4096]

Accessing to https://www.myrabag.com/ detection is already there, but only if I access via FireFox, but not with Chrome or Opera ?:

Quote

User type: Active user
Application name: firefox.exe
Application path: C:\Program Files\Mozilla Firefox
Component: Safe Browsing
Result description: Blocked
Type: Trojan
Name: HEUR:Trojan-PSW.Script.Generic
Precision: Heuristic Analysis
Threat level: High
Object type: File
Object name: translate.min.js
Object path: https://headvape.com/js/mage
MD5 of an object: B45831AD971E3B0343B65F38FC8DF36E
Reason: Expert analysis

 

[Flood and Flood's wife]

14 minutes ago, harlan4096 said:

Accessing to https://www.myrabag.com/ detection is already there, but only if I access via FireFox, but not with Chrome or Opera ?:

 

Hello @harlan4096, 

Confirming detection, with Edge v101.0.1210.53:

Spoiler

Thank you?

Flood?+?

[Berny]

Hi @harlan4096

Please see detection under Chrome :

Spoiler

Event: Download denied
User: DESKTOP
User type: Active user
Application name: chrome.exe
Application path: C:\Program Files\Google\Chrome\Application
Component: Safe Browsing
Result description: Blocked
Type: Trojan
Name: HEUR:Trojan-PSW.Script.Generic
Precision: Heuristic Analysis
Threat level: High
Object type: File
Object name: translate.min.js
Object path: https://headvape.com/js/mage
MD5 of an object: B45831AD971E3B0343B65F38FC8DF36E
Reason: Expert analysis
Databases release date: Today, 31/05/2022 7:46:00

 

[Berny]

Kaspersky Threat Intelligence Portal

→ Lookup : "https://headvape.com/js/mage/translate.min.js" = Clean
→ File Analysis "b45831ad971e3b0343b65f38fc8df36e" = Malware

?

[harlan4096]

Maybe false positive, that script seems a translation library ?...

[neelesh.om]

Can you whitelist this url  "https://www.myrabag.com" from Kaspersky Database

[Berny]

@neelesh.om Please see Post above

"Please submit the url here https://opentip.kaspersky.com/ and ask for reanalyze."