Although at this point it’s more significant as proof-of-concept than as being an actual risk,W32/Perrunis thefirst known virusthat infects JPEG files and utilizes them to eventually infect other systems.
It is an appending virus that requires an extractor file to extract and execute the virus code from infected JPEG files or files with a .JPG file extension. The virus arrives in the form of an 11,780 byte PE (portable executable) file, or .EXE. When Perrun is executed, the 5,636 byte extractor component (EXTRK.EXE) is dropped to the current directory and the following system Registry key is modified:
HKEY_CLASSES_ROOTjpegfileshellopencommand “(Default)” = (current directory)EXTRK.EXE %1
Infected JPEG files are unable to replicate on machines without the extractor component installed in the system registry. Both files are written in Visual Basic 6, and are packed with UPX.
In its current form, Perrun is relatively harmless and easily detectable. JPEG files that have been altered by Perrun are noticeably corrupted when they are opened. Systems that do not have the Perrun extractor EXTRK.EXE installed are not affected when they open an infected JPEG file, and computers that only have the extractor installed but never open infected JPEG files will not infect existing JPEG files. Therefore, antivirus software only needs to detect the extractor executable to prevent Perrun from spreading.
