Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This software seems to good (and nasty) to be true. I'm aware of other options of hiding files like NTFS streams but to join multiple files and have them all execute at the same time, it seems suspicious, devious and makes me feel like the internet is one notch less secure than it was before. Anyone know how software like these work and how common these things are used in practice?

share|improve this question
up vote 3 down vote accepted

On a fundamental level, this kind of tool is not at all different from a self-extracting archive (SFX). All it does is compress some files and include them as resources to an executable that will decompress them and then run one or more of the files. This exact same functionality is available in common tools like 7-zip and WinRAR, and it's how installers work on a basic level.

The only thing different about this product is that the self-extractor (the executable part that extracts the other files) is designed to be undetectable, while normal SFXs will show a dialog when they run indicating the decompression, and are designed so that even when the contents are encrypted they are recognizable as SFX. This is the only way that this product differs from a standard SFX system.

So, the functionality is not new or malware-specific at all. What is malware-specific is that it's designed to be hidden like that. Even so, before intelligent users this is still not a very effective way to distribute malware. Although the file could be given an arbitrary icon and name, it must be an executable file and be marked as such, so this tool just reiterates that you should never run shady executables.

When you use this in malware, the vector is like this: you email (or otherwise distribute, most often email) a file called funny cats.docx.exe or something like that. On Windows machines, the file extension is hidden, so the user just sees funny cats.docx. You can package with the executable a Microsoft Word icon so that it looks right on first inspection. When the user double-clicks the file to open it, you unpack an actual Word document and run that so that Word will start and load the file (the user gets what they want, some funny cats). At the same time, though, you unpack a trojan/downloader and execute that. It installs itself somewhere discreet and downloads an actual payload (some sort of botnet client).

This can be avoided by users being diligent about files they run. Remember to see what kind of file something actually is, especially if you have file extensions turned off (I always change settings to show file extensions). In recent Windows versions (Vista and 7) most trojans require administrative privileges, so to be effective funny cats.docx would have to trigger a UAC prompt in order to install the trojan, so also make sure that users are trained to think about UAC prompts - they shouldn't see one when they aren't expecting one.

share|improve this answer
Its perfect for a drive by download infection, you will never know it executed from your browser. – Moab Aug 10 '11 at 14:08
Fortunately, modern browsers will warn you when downloading any type of file that could contain executable code. Since they use file signature detection instead of trusting file extensions, your browser will warn you that the file is executable. – jcrawfordor Aug 10 '11 at 19:26
Not always, there are 0day exploits all the time. – Moab Aug 10 '11 at 20:13
Generally, though, in the case of a true drive-by you would not use any form of deceit (i.e. the program would run completely silently, as opposed to this software, which is intended for hiding a payload on a non-silent distraction). These kinds of exploits are difficult to impossible to mitigate. – jcrawfordor Aug 10 '11 at 23:54

Sounds like what malware writers use! Simple answer, It is a container with a script that executes or opens all the files inside the container. Common for software package installers, they have been around a long time, but this one has some special features.

I could see someone putting a few thousand small text documents in one of these, have fun watching when your co-worker opens it. Not as much fun as a ZIP Bomb.

Like anything else in this world, it can be used for Good, Fun or Evil!

Looks like a fun toy. A Must have in my book.

After reading the purchase page it appears to be used for evil purposes!

During the support period you'll receive new versions (upgrades) and fixes. If File Joiner gets detected when scanned with antiviruses (Norton, Kaspersky, McAfee, Panda, AVG, Avast, TrendMicro), within the support period, you'll receive a new undetectable version as soon as possible (usually in less than 48 hours).

They accept anonymous cash payments also

We are pretty flexible regarding the payment methods, so you're able to use LibertyReserve, WesternUnion, MoneyGram etc.

Then there is the sister site, selling keyloggers as parental control software, Muhahahaha!

share|improve this answer
Evil laugh ftw. – surfasb Aug 10 '11 at 5:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .