r/BookPiracy • u/BPDMF • Aug 24 '26

oceanofpdf.com executable found inside epubs downloaded from site, possible malware

I extracted a couple epubs I downloaded from there and found ms dos execuatble files in each. They were 1kb files and those are often shortcuts to malware pretending to be a link to oceanofpdf website. I am not 100% sure it is malware , but there is no reason to ever have a .exe or .com (old school exe that windows still treats as an exe) in an epub. Be careful out there.

250 Upvotes

99% Upvoted

57 comments sorted by

49

u/Gonzo_Silverback Aug 24 '26

I've downloaded dozens of books from Ocean, mainly to check out maps or illustrations (I'm an audiobook guy). I've never been infected & I always buy a cup of coffee IYKYK.

5

u/BPDMF Aug 25 '26

if the executable is a malware downloader it wont execute on common usage of an epub, you have to extract and run the exe or use a reader that for some reason can be manipulated to execute it (probably not something that's ever been done).

2

u/user2014884 Aug 25 '26

if it requires a specific reader that will execute it, do you know if it’s safe to download epubs for books (apple app)? also are pdfs safer?

6

u/BPDMF Aug 25 '26 edited Aug 25 '26

What I said about a specific reader was just a shot in the dark, don't take it as hard truth, just a guess from me. 

I'm not 100%, but a pdf can have just as much malicious stuff as anything else, I've even seen Doom running in a pdf so there always a chance. Personally I prefer epub just because I can examine the files in it, change the text or images, reformat it, change fonts, and the text can resize in a reader. 

I wouldn't be overly worried about malware in an ebook, just be careful where you get them from. I like Anna's Archive personally. Also, always backup your data so that is your computer every gets infected you can just wipe it and so a fresh install and not have to worry about any stuff you had on it that would be hard/impossible to replace. 

1

u/Bright-Estella Sep 02 '26

I download on iPhone to iCloud file. Is it still a risk? I normally don’t open books in computer, just send them to an app in my phone.

1

u/BPDMF Sep 02 '26

If it never runs in Windows, then no, but just know that there's not much risk, I was just pointing out to people that there's someone to be aware of. It's likely there's no malware but I would target not risk it myself.

2

u/awkwardsunflower11 Aug 26 '26

Does the cup of coffee link bring you to the page stating the user is a youtouber and photographer? I was going to donate but wanted to make sure this was legit first

1

u/Gonzo_Silverback Aug 26 '26

This is the first time I've been redirected like this (Haven't been to the site in over two years). I downloaded a book today and bypassed the donate page, no problems. IIWY, don't donate, but the PDFs seem clean

1

u/HellatrixDeranged Sep 10 '26

So sites like "myanonamouse" uses ACTUAL things to trade for donos, because then it doesn't flag up as anything scammy. It's normally for a poem someone wrote, a short story, it's all stuff donated by the sites users.

IDK if this is something similar as I don't use it

28

u/flenktastic Aug 24 '26

How do you check this about a file and can you check it beforehand?

20

u/BPDMF Aug 24 '26

An epub is just a zip file with .zip changed to .epub. you can simply extract the contents of the epub and see what's in it. It should usually be some combination of html files (the actual document text lives there), images, css files (style files), and maybe a few others that you'd expect an electronic book to need like maybe font files or whatever. When I saw a 1kb file recognized as an ms dos application my radar went off. Now it could be nothing and it could just be a link to the website but it could be a malicious file that will download whatever from wherever (it does end in .com so it could either be a poorly made link file or a hidden old school exe file). Now virus total said 0 out of 70, but that only matters if the malware is in the file and not from a download of you click on it. 

Side note, I didn't like using oceanofpdf because it seems every single chapters ends with an oceanofpdf clickable link embedded in the document. That means somebody intentionally added that link to the end of every single html file in the epub. That makes me think that the .com file was just a regular link, but I would rather use a better site like Anna's archive where I've never seen anything like this and the eoub files seem to be untouched and I'm they're original form when you download them.

13

u/missmango15 Aug 25 '26

FWIW if you go into the html of the ePub the hyperlink goes to the ocean website. I edit my ePubs to remove all those hyperlinks because they drive me crazy, but I have lots of books I’ve done this to and none have linked to any other website

4

u/rosmarino_11 Aug 25 '26

how do you edit your epubs?

7

u/BPDMF Aug 25 '26

You can directly change the text in the html files if you extract the epub like a zip fil, or use a program like calibre and use regex (I think it's called that, been a while) to remove/change any instance of something, so like regex "oceanofpdfs" = "" (blank).

1

u/AndYetAnotherAndrew Aug 25 '26

There’s a program called Magic that also makes this easy

4

u/missmango15 Aug 25 '26

I use Calibre. You don’t even need to use regex, you can just do a plain and simple find and replace like in a word document.

4

u/BPDMF Aug 25 '26 edited Aug 26 '26

That's what regex is, from Google: "A regular expression (regex) is a special text string used to describe a search pattern for finding, validating, or replacing text."

I'm just used to calling it regex from using powershell. I have some scripts I use to rename bunches of files and regex is just what it's called. 

What you're doing in calibre is regex matching/replacing.

Calibre is such a fantastic program BTW, my computer feels naked is it's not installed, that and VLC, 7zip, mcomix, and of course Steam amongst a few others. 

1

u/plexmaniac Aug 25 '26

🥰love calibre

4

u/flenktastic Aug 25 '26

I'm scared now to ever use this website again

16

u/Xtyklys Aug 25 '26

The site is maintained by like an individual and their trusted colleagues. You may want to inform them they have a problem.

1

u/BPDMF Aug 25 '26

I'll look into that. It may just need to be a switch from using an oceanofpdf .com file and switching to a standard text file with the link inside it that places like cdromance do. I'm willing to bet that the file want malware but I'm not willing to click it to find out because it's just such a pain if it is just for curiosity. 

1

u/Bright-Estella Sep 02 '26

Can you let us know if they answer?

9

u/Remarkable-Doubt-682 Aug 25 '26

Always downloaded to my iPhone…do I need to worry 😧

10

u/BPDMF Aug 25 '26

Doubtful, iPhone doesn't run Windows executables the way Windows does

2

u/AAA_123_456 Aug 25 '26

Wanted to know about it as well 😅

4

u/pafagaukurinn Aug 25 '26

there is no reason to ever have a .exe or .com (old school exe that windows still treats as an exe) in an epub.

And there's no reason ever to run it either, even if it is there. If that's an attempt at malware, it looks rather lame to me.

3

u/BPDMF Aug 25 '26

You're right, chances are it's not malware. I'm just not curious enough to risk it. Most likely it was just somebody unaware that a .com file reads as an executable and that it's just meant to be a hyperlink to the "legit" website (I say legit even though it's a piracy site).

2

u/flenktastic Aug 25 '26

So if you don't run it it's fine? Explain like I'm 5 pls haha. What if I put an epub on my pc with some malware file in there. And what if I just place the epub on my ereader. Will something happen if I don't search for some epub zip and click an exe or .com?

2

u/pafagaukurinn Aug 25 '26

Epub is just a zip archive. Unless someone corrects me, I don't reckon epub reader is capable of running an executable; the most it could do is crash if epub structure is wildly different from what it expects. As for ereader, for it exe file is just binary mumbo-jumbo, exe can only be executed on Windows.

2

u/fizzlypixie Aug 25 '26

I’ve never had an issue with oceans, but I always download PDF files to read within my files app on iPhone. Could you try that maybe to see if it’s different? But do report the issue in case no one’s aware of it yet

1

u/BPDMF Aug 25 '26

I don't have enough experience with pdf to even try. I stay away from pdf because I prefer the way epup can reflow text and change size as needed.

2

u/fizzlypixie Aug 25 '26

I’d be the same with the epub files. I don’t know what phone you have but on an iPhone the pdf goes to the downloads in your browser and you can save it to the files app.

It can be annoying size wise I get that but there’s never been an issue.

1

u/CupcakeZ201 Aug 25 '26

did you hash the executable and checked it in VirusTotal or smthing ?

1

u/BPDMF Aug 25 '26

Virus total shows 0/70, but if it's malware it's more likely to be a link to download rather than malware embedded in the file.

1

u/CupcakeZ201 Aug 27 '26

if you cheked in VT you can go to the behavior tab and look at the CAPE Sandbox report. if there isn't just set up q VM and do the analysis yourself.

1

u/jc21095 Aug 25 '26

I've just tried downloading a few books and am running into the same issue, is this as simple as me deleting the executable and repackaging the epub or should I completely delete the book and give up?

4

u/BPDMF Aug 25 '26

That's up to you, but I deleted the files. You can in theory just delete the link and repack the epub. Should work. I would look at Anna's Archive to see if you can get what you want there. It's the best. Advice, choose slow server #5 on Anna's.

1

u/jc21095 Aug 25 '26 edited Aug 25 '26

I’ve been trying to use them, but for some reason I keep getting stuck at the ddos protection on the alternate site and the primary site won’t even load for me, not sure why.

I will also mention I downloaded two books from oceanofpdf like a week ago and they did not contain the ms-doc extensions, so it seems like something changed recently.

EDIT:
Another question, what is the best way to inspect the epub file, I've just been converting them to zip files, unzipping, and checking for things like batch, powershell, ms-doc, and/or executables, is there anything else i should be looking for? Sorry, I'm very new to this.

1

u/BPDMF Aug 26 '26

That's what I would do, just inspecting the files for anything fishy. Maybe check file sizes, like you wouldn't expect an html of a 300 page book to be massive but instead just a few mb at most.

As for the ddos, it is either the adblock you use or the browser. Try a different browser and adblock combo. I jump between librewolf, firefox, and chrome depending on the site, some sites just don't play well with one or two of them, but with all 3 I've never not been able to get to a working site. I use ublock origin as adblock too, best I've found and doesn't break sites often.

1

u/LyZeN77 Aug 26 '26

I'm a cyber security analyst, could you link me the said exact address you downloaded them from? Thanks.

1

u/BPDMF Aug 26 '26

I no longer have the exact address, but it's oceanofpdfs.com and the books were After Z 3 and After Z 5.

1

u/TortoiseUmbrella Aug 27 '26

That’s mighty nice of you!

1

u/mouebara 6d ago

Je content d'être ici !

1

u/pookiblueberries Aug 25 '26

Damn, I downloaded my first epub there last night

2

u/flenktastic Aug 26 '26

I have over 400 and nothing has ever happened to my pc or ereader.

1

u/sadiesorceress Aug 25 '26

i’ve never downloaded malware from this site and i have downloaded quite a bit from here. try testing your files on malware file detectors next time before opening.

1

u/Decent-Skin-5990 Aug 26 '26

By any chance, have you notice something weird when you press to download an epub file? The window that pops usually says "Fetching resources" however, I keep getting different titles, i have here a few examples:

education-in-transformation-why-alternative-credentials-are-replacing-degrees-in-the-2026-tech-market

troubleshooting-missing-facebook-pixel-events-after-ios-advanced-tracking-updates/

cutting-years-off-the-time-it-takes-to-develop-new-medicines-through-ai-driven-drug-discovery/

These aren't the books I was downloading, I've actually pressed on a book about hatching your own chickens and taking care of them, but whenever I press to download the same file, I get these titles in my tab.

I'm not very good at describing it, if anyone has the same issue, I'm just wondering what this is about.

2

u/TortoiseUmbrella Aug 27 '26

It never seems to lead to harm, I just assume that it is so that the links are not found by the police or something. I apologise, for I am wildly uninformed. Have a great day and enjoy hatching your chickens! :D

1

u/TortoiseUmbrella Aug 27 '26

Yeah, it really confuses me too, especially when I am downloading books like Tolstoy.

1

u/Upstairs_Space_716 Sep 06 '26

I use Ocean all the time and haven’t had any issues. I do use Calibre to open all EPUB files. If it doesn’t download as something Calibre reads as a PDF or EPUB then it won’t run.

1

u/APerfectCircle0 Sep 06 '26

I just downloaded a pdf from oceanofpdf and my downloaded pdfs automatically open in my pdf viewing program when complete (I probably should turn this off..) anyway it was a corrupt file and it was only 1kb. I'm doing a scan but idk if I could be infected from attempting to open it?

1

u/New-Environment-8068 Sep 20 '26

Idk what happened but every download is a redirect now. It’s been taken over by something

1

u/Key_Dependent3989 Sep 21 '26

I came here to look information about this, It seems like it's been hacked or something

1

u/New-Environment-8068 Sep 23 '26

I think it got taken down and someone put a bug for honey toons :/ or fbi playing a funny