1189338 - crash in *.dll@0x59c3f, *.dll@0x59b3d (PennyBee malware)

Status: RESOLVED WONTFIX

(External Software Affecting Firefox :: Other, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-17338efd-6bb4-4067-a4a4-af25c2150723.
=============================================================

Crashing Thread
Frame 	Module 	Signature 	Source
Ø 0 	soc3hen.dll 	soc3hen.dll@0x59c3f 	
Ø 1 	soc3hen.dll 	soc3hen.dll@0x43b8d 	
Ø 2 	soc3hen.dll 	soc3hen.dll@0x44367 	
3 	nss3.dll 	SocketWrite 	nsprpub/pr/src/io/prsocket.c
4 	nss3.dll 	PR_Write 	nsprpub/pr/src/io/priometh.c
5 	xul.dll 	nsSocketOutputStream::Write(char const*, unsigned int, unsigned int*) 	netwerk/base/nsSocketTransport2.cpp
6 	xul.dll 	mozilla::net::nsHttpConnection::OnReadSegment(char const*, unsigned int, unsigned int*) 	netwerk/protocol/http/nsHttpConnection.cpp
7 	xul.dll 	mozilla::net::nsHttpTransaction::ReadRequestSegment(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*) 	netwerk/protocol/http/nsHttpTransaction.cpp
8 	xul.dll 	nsBufferedInputStream::ReadSegments(nsresult (*)(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*) 	netwerk/base/nsBufferedStreams.cpp
9 	xul.dll 	mozilla::net::nsHttpTransaction::ReadSegments(mozilla::net::nsAHttpSegmentReader*, unsigned int, unsigned int*) 	netwerk/protocol/http/nsHttpTransaction.cpp
10 	xul.dll 	mozilla::net::nsHttpConnection::OnSocketWritable() 	netwerk/protocol/http/nsHttpConnection.cpp

these crash signatures are relatively new and caused around 1100 submitted reports on release last week, but with a rising tendency.
according to http://www.herdprotect.com/soc3hen.dll-506ce8017f070a9150ecf3a3d00f001696257e2e.aspx the library is part of adware/malware dubbed "PennyBee". cc'ing dmajor in the report to see if something can be done against it from our side.

Comment 1

[[:philipp]]

there are far more different variants of this malware around than just crashes in soc3hen.dll:
https://crash-stats.mozilla.com/search/?signature=0x59c3f&signature=0x59b3d&_facets=signature&_facets=version&_facets=uptime&_facets=user_comments&_facets=useragent_locale&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.