Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I used hopper disassembler to see if there was any strange activity on this particular mov file. What was bizarre and unexpected was This .mov file is particularly strange such as it seems to lower the audio quality on people's computers who play the video.
I found processes in the middle of the file which I thought would just be data. Is this normal?
It is kind of cool because the code is way too organized to just be random data.
The only thing that makes this credible is the large amount of x86 jump-like 'opcodes' in the video (7a-7f). What makes it less likely is the memory addresses: the pointers in that piece of disassembly reference edi + > 0x75000000 and - > 0x50000000. This is not entirely impossible, but is highly unusual. If you look at the top instruction, AAD, this is entirely out of place:
The AAD instruction is only useful when it precedes a DIV instruction that divides (binary division) the adjusted value in the AX register by an unpacked BCD value. http://x86.renejeschke.de/html/file_module_x86_id_2.html
So my impression is that you simply have a very forgiving disassembler that will try to make sense of anything you feed it. If you're still unconvinced, give us the file so we can look at it.
