#266 7-Zip as *malware* transporter? -> Screenshots Inside!

[Alex Baker]

Dear 7-Zip Community,

I’m using your software (7-ZIp, Win Server 2008 64bit) and experience some extremely strange behavior:

1. Since some month, the 7Zip-engine is inflating an arbitrary image file in a directory I’m compressing
   (Think of it like a “backup-directory”)

The setup:

• I’m developing some webapps and i'm using 7Zip to make a backup of the source tree
• The source tree contains several apps, all with a somehow similar directory structure
• Then, 7Zip is used to make an encrypted exe

• Most of the apps have an “image”-folder
  o Containing: GIF, PNG, JPGS and SVG

• Since some month, 7Zip is picking an arbitray(!) file and inflates it by around 19MB, it looks like something is attaching something into the archive?

I deleted this file.

Then, I did another run – then, the inflated file was the second GIF in this directory (just below the first one)
For testing, I deleted just ALL files in this image directory.

As mentioned above, the “backup-directory” contains more than one app, each with its own directory of images/sprites ---> Then, the engine picks ANOTHER file from the whole "backup directory", and inflates this one, this time, a JPG image file from a directory that is stored as "image/graphic store"

So, i thought it may be a ZIP bomb or similar (because this "bug" picks always some image files).
Finally i upgraded WinZIP to latest version and so i did a run on the same directory.
This time the 19.5MB are attached to a XML File:

So, dear community - what is this?

For me, it looks like somehow the app/my machine/setup is hacked and 7-ZIP-archives are used to transport malware through my backup process?
(though, i may be too paranoid ;-)

Any ideas?

Very interesting case, i'd say? Looking forward to hearing from you!

Regards,

Alex

[Alex Baker]

Sorry, my screenshot links were erased, even if i used the img-function in the toolbar here:

Link1:
https://imgur.com/a/Fbmpi7S

Link2:
https://imgur.com/a/dH0ntVn

Link3:
https://imgur.com/a/A0a2C8f

[Alex Baker]

Sorry for misleading wording up there, i wrote >WinZIP< at some part of the text - for sure, i meant 7ZIP, sorry for this typo.

Regards

[Igor Pavlov]

It's not problem.
7-Zip compresses many files as one big block.
And 7-Zip doesn't know exact compressed size for each file in that block. So 7-Zip shows packed size of whole block for first file in block.

[Alex Baker]

Hi Igor,

thanks for your response.

Short answer:
I do not think this is the solution.

Then:
a) why did this jump occur from one backup-run to the backup-run next day?
b) why is the "blown file" almost the same size=
AND
c) yesterday, i wiped the installation/harddisk and setup'd everything from scratch with new all new binaries/downloads (no reuse of any old install files etc.) -> now the 7ZIP archive has the prior, expected, size?
(Same setup, 64x86 bit win. server, latest version of 7Zip)

Regards,

Alex

[Igor Pavlov]

7-Zip splits all files to groups.
For example, group size can be 16 MB for "Fastest" mode.
You can see group size in field "Solid Block size" when you create new archive.
And you see packed size of each group in first file of that group when you open archive.
So the sum of all these sizes is real packed size of whole archive.