2

I have a malicious file zipped in .gz which was not opened. However, when I tried to delete the folder containing the file, I wasn't able to due to running processes. Can a zipped malware execute itself in Windows?

3
  • 7
    More likely your AV is quarantining the file? May 15, 2017 at 10:37
  • 2
    Try lsof to see which process is using the file
    – licklake
    May 15, 2017 at 11:14
  • @Chubby, dont think my AV scans within zipped file
    – George
    May 16, 2017 at 4:24

2 Answers 2

2

Unless you have some program that is able to run compressed programs from archive, no it can't.

You inability to suppress the file is more likely due to the fact that the file itself is being used or access restricted by some program (e.g. antivirus quarantine).

1

Normally a program cannot execute itself, but must be launched from something else(*). That something else is normally:

  • a command line shell (command.exe, /bin/sh (or bash, zsh, etc.) )
  • a GUI explorer (Windows explorer, gnome file manager, etc.)

Those can only start programs in a standard executable format.

But a program can also be started by another program that starts it as a child subprocess. Here almost everything is possible, because it depends how that other program was designed. Anyway, on common operating system (at least Windows and Unix or Unix-like), the system can only execute an uncompressed file, so in that case, the launcher program should first unzip the file in a temporary one and then execute the temporary. That means that the zipped file should not be kept open, because the system does not use it directly.

TL/DR: A zipped file could probably be executed via a specialized laucher, but even in that case, it is very unlikely that it would be kept open all its execution time: it should be kept open only for being uncompressed.


(*) beware, the launcher could be a normal program such as a mail reader or a browser, through an exploitable vulnerability

3
  • You mentioned launcher and mail reader - does outlook thick-client pre-download attachments and store in local machine without user opening the attachment?
    – George
    May 16, 2017 at 5:32
  • 1
    @George An attachement is included in the mail body, and AFAIK all desktop mail readers always download and store the full mail including all attachements as a whole. May 16, 2017 at 6:05
  • Thanks. Do you know if the attachment is wrapped? Because if the mail gateway doesnt block executables, and mail client downloads them, then it's really dangerous.
    – George
    May 16, 2017 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.