Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Well I don't know if this technique is still used, but about 5-7 years ago it was a popular way to deliver a malicious patch (Sub-7 , bifrost etc ..) to a victim.

There used to be a program that binds the malicious patch with an image or MP3 file.

How dose this happen on the binary level?

How can two codes of two different types of file be put together?

And when running the program (.i.e when its loaded in memory ) how does the OS differentiate the the EXE code from the image or MP3 code?

In other words, how do binding programs work?

share|improve this question

1 Answer 1

up vote 6 down vote accepted

Sub7 and Bifrost (or any other popular RAT I can think of) have never provided the ability to include malicious code in .jpg or .mp3 files (or any non-executable format).

Sub7 and ProRAT had, however, the ability to pack the malicious binary and a .jpg file (or any other file for that matter) in one self-extracting archive with an icon of your own choice (check the image below). When you clicked on the resulting .exe file, it stealthily extracted the files, installed the backdoor, and then opened the .jpg file with the default image viewer leading the unsuspecting user to believe that everything is okay.

There are other ways to deploy a malicious payload on the victim's machine. For example, the attacker could create a specially crafter image file to exploit a vulnerability in your image viewer, which would allow the attacker to execute arbitrary code including installing backdoors. An example for this is the famous MS06-001 in Windows Graphic Device Interface (GDI).

That is not only limited to image files, one vulnerability in Windows Media Player allowed a specially crafted .mpg file to execute code on the victim's machine.

Selecting the result file format:
Selecting the format

Selecting the icon:
Binding process

share|improve this answer
thanks adnan... but what about the programs that takes a patch and a pic as an input and gives one pic with the patch embedded in it as output ? –  HSN Mar 21 '13 at 2:36
@HSN I haven't seen such programs in the wild. Regardless, I have provided an explanation for that in the 3rd paragraph on my answer. –  Adnan Mar 21 '13 at 2:45
@HSN It is not possible for a JPEG image file to execute any embedded executable. The reason is that even if there is executable data in JPEG, it will always be interpreted as image data (such as grayscale values of a pixel on a particular co-ordinate). Just as Adnan pointed out, if you want to embedd an image with an exe and you want both to be executed, the resulting file will be image.jpeg.exe and the exe file after executing will run the jpeg –  void_in Mar 21 '13 at 5:44
I'm pretty sure there was a an exploit a few years ago that made certain browsers execute code embedded in a jpeg-file. Probably a buffer overflow exploit. –  Jonatan Hedborg Mar 21 '13 at 10:12
@JonatanHedborg, correct, and I talked about it. Why aren't you guys reading the 3rd paragraph of the answer? –  Adnan Mar 21 '13 at 10:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.