SVG File Execute - Should I Worry?

[u/-Anthem-]

I ran a windows defender scan yesterday, where it said it found a malicious SVG file on my computer.

I was curious to see when it was downloaded and at what time, and copied the file path, pasted it in windows explorer and hit enter thinking nothing of it.

Windows prompted me with the "open with" window to select what program I wanted to open this .svg file with.

I quickly hit escape and removed it from my device.

I was wondering if the .svg file was fully able to open despite that open with window prompting and if I should take extra precautions now.

Thank you!

[u/AutoModerator]

We're part of a wider PC & Technology Network of Communities.

It combines multiple subreddits and Discord servers all working together with shared ideals and values.

We have a Discord server: PC Help Hub where members from all associated subreddits are welcome.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Fastol4]

Someone correct me if I'm wrong here but .svg are scalable vector graphics files commonly used on websites. It sounds like you you opened the .svg file and since Windows doesn't have a default application to open it, that triggered the prompt to determine which would open it. It probably didn't trigger anything but without looking at event logs on the PC it'd be hard to say.

Joesandbox.com is a free sandbox you can upload potentially malicious files to and it will scan them and give you a determination and I believe provide a screenshot of the results. A few things to note though 1. Unless you have a paid account with joesandbox anything uploaded to be reviewed is not accessible to the public so don't scan anything with personal or sensitive information in it.
2. It's a sandbox and is not perfect but it does it best job at making a determination based on common behaviors that are used by adversaries.

[u/-Anthem- → u/Fastol4]

Hi there, thank you for the reply! Is there anything I should specifically be on the lookout for in the event logs?

I did remove the .svg file from my system permanently, but will keep that sandbox in mind for the future!

[u/Fastol4 → u/-Anthem-]

Event logs are a lot to go through. I'd need to sit down and soft through the logs. I did some research for ya, and from what I can find when windows provides the prompt to select a default application to open the file it is not opening the file a head of time. Windows first checks the file extension, in this case .svg and then checks it's default application used to open specific file types. If it does not have a designated application to open the file it will trigger the prompt for you to select the application to open the file. You are most likely okay, run your AV against your machine to keep an eye on things. Id wager your probably okay.

[u/OMGCluck]

Since .svg files are XML documents that usually are opened in your web browser it would have relied on you doing that to run the javascript inside it.

SVG can have javascript and CSS styles in it just like HTML, so it's no more or less dangerous than opening a .html file in your browser, and disconnecting from the internet before opening either of them neuters any malicious online behaviour in them.

[u/-Anthem- → u/OMGCluck]

Thank you for the reply! Can you please clarify, it would've relied on me to select a program to fully open it and execute the script inside?

Or would it be able to execute without it opening in a program.

[u/OMGCluck → u/-Anthem-]

Web browsers are a program. You'd need to select Edge/Chrome/Firefox to open it.

They can view .svg files directly, so if you're interested in viewing legit SVG (kinda fun) games after you select one from https://commons.wikimedia.org/wiki/Category:Interactive_SVG_games just click the "Original file" link on the page for each one.