Can a virus or malware be bundled with a non executable download?

Question

Can a virus or malware be bundled with a non executable download?

For example, when choosing 'save link as' on an .mp3 or a .pdf file, is it possible for the download to include more than just the file?

Or are virus/malware only distributable through .exe files...

Answer 1

Short answer - YES a virus can be contained within another file type.

Files like JPG, MP3 etc all have to be opened and "read" by an executable. By "mal-forming" or injecting special code or data into these files, it can cause programs to fault or to execute code contained within the files - which can in turn cause other problems and give a gateway for a full on viral attack.

This example is a link to the sophos website which discusses just such a virus which can be embedded and hidden in a picture file.

Getting back to the rest of your question, by simply "downloaidng an MP3" all you will normally get is the MP3 - but that doesn't mean its not infected. Also, if you download items such as using the "save webpage" features in browsers, you will find the sitesa images etc will also be downloaded - which may in turn contain viruses.

Answer 2

In a way, PDF documents are executable, due to the ability to embed JavaScript into the document. Microsoft Office documents are similar – they allow VBScript macros, which has allowed many "macro viruses" in the past.

In theory, such JavaScript or similar code should be "sandboxed", but in practice people find ways to escape it, sometimes by calling functions that were meant to be limited but aren't, sometimes by finding ways to overwrite the JavaScript interpreter's code.

Another possibility is a malformed file that tricks the reader into executing part of the document as code (this was a particularly huge problem with Adobe Reader just last year).

Answer 3

If a browser opens an HTTP connection to a web server and the response headers include the field Content-Type: audio/mpeg or Content-Type: application/pdf (for instance). The browser is going to interpret this content as an audio or PDF file. Is going to show downloaded content according to its configuration. If the user saves the files "as...", the browser is going to create a file con disk with that content. The browser won't download any other file than that. Which is one of the questions here.

In the other hand, of course, a virus is nothing but a bunch of bytes. Like any other piece of software expressed in machine code. Then any kind of file could have a virus inside. But under normal circumstances a computer isn't going to execute bytes from an MP3 or PDF file. Even if the virus code is inside that file, it's meaningless.

Finally, if an inexpert user reaches an HTML file, which in turn plays an MP3 file. He could think that using Save as... is going to save the MP3 file. But in fact it's going to save the HTML file. During that process the browser is going to save more than just one file.