111
all 10 comments
sorted by: hot top controversial new old
[-] jokro@feddit.org 25 points 3 days ago

Wow, in case it's not clear, it really is the same file for all three platforms.

[-] diemartin@sh.itjust.works 25 points 3 days ago* (last edited 2 days ago)

This is pretty cool. Reminds me of .kkrieger, but this beats it in small size and that it's a polyglot (though .kkrieger wins in visuals)

I didn't see a link to source code for the snake tho

[-] 01189998819991197253@infosec.pub 12 points 3 days ago* (last edited 3 days ago)

I've been looking for this game for so long! Thank you!

Edit. Here's the source.

[-] diemartin@sh.itjust.works 8 points 3 days ago

Oh, I meant the polyglot snake sources, but thanks

Ah whoops. Sorry about the misunderstanding

[-] diemartin@sh.itjust.works 3 points 2 days ago* (last edited 2 days ago)

No problem :)

Upon reading my comment again, it's a bit ambiguous. Clarified a bit

[-] FishFace@piefed.social 10 points 2 days ago

Ok but is it good

[-] Hirom@beehaw.org 4 points 2 days ago

VirusTotal doesn't like it https://www.virustotal.com/gui/file/ede115f31fb3fcc3c27bad1b6da5cfee30bd692c3fc04ca1e8f0e8f43787b66f

Either it's because it's using the same technique as malware, or because it's malware.

[-] TeamAssimilation@infosec.pub 9 points 2 days ago* (last edited 2 days ago)

I’d guess the former, given it’s tiny compared to normal droppers, but you can never be sure these days.

This sample is a multi-platform 'polyglot' binary acting as a dropper and potentially a browser-based exploit. It functions as a Windows PE (with no standard imports, suggesting custom shellcode or manual API resolution), a Linux shell script, and an HTML/JavaScript file. The Linux component contains a command ('tail -c+4294 $0 | lzma -dc > /tmp/a') that extracts and executes a hidden payload from its own body. The embedded JavaScript is obfuscated and uses 'eval' to execute dynamically generated code. This structure is typical of sophisticated malware or cross-platform exploit delivery kits.

this post was submitted on 12 Jan 2026
111 points (100.0% liked)

Programming

24394 readers
312 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev



founded 2 years ago
MODERATORS