你有没有想过，一个压缩包可以包含它自己？去年我尝试用 ZIP Quine 实现，却被 DEFLATE 的 32KiB 回溯窗口卡死。直到我把论文和生成器扔给 AI……它只花了两个小时，就基于 LZMA2 和 7z 做出了真正的递归压缩包！现在我的博客压缩包不仅包含全站内容，还包含这个压缩包本身——下载、解压、再解压，无限套娃（理论上）。 文章亮点： * 为什么 ZIP Quine 受限于 32KiB ？ LZMA2 如何破局？ * AI 写出的 CRC32 求解代码：高斯消元法偷懒版 + 扩展欧几里得硬核版😆 * 附赠 tar.xz 版本生成器（虽然作者还是更喜欢 7z ） * 关于 AI 创新能力的思考：组合创新算不算创新？ 原文标题：如何制作一个“完整”的博客压缩包？ 原文链接：https://mabbs.github.io/2026/10/01/quine.html 博客压缩包下载：https://mayx.eu.org/MayxBlog.7z 如果你也对 Quine 、压缩算法、AI 编程感兴趣，欢迎来读原文、下载体验，一起讨论！

Fake 7-Zip installer malware hides proxyware inside a working app and can turn Windows PCs into residential proxy nodes.

攻撃者が、再コンパイルした7-Zipの自己解凍形式アーカイブ（SFX）モジュールの中に、OpenSUpdaterのリフレクティブローダーを隠していることがわかりました。 このインストーラーには正規のfoobar2000セットアップファイルが含まれています。しかし、悪意のあるコードは展開スタブ自体から実行されます。展開

CoC6 黒の家、サウスウィック家の 7 つの席 略称：くろせき 舞台：現代、夏のキングスポート 人数：１～４人（1PL複数PC等の遊び方も可能） 時間：30分～3 時間（人数とRP 次第でさらに延びる） 難易度：低 探索者条件：継続探索者クトゥルフ神話技能 1%以上 特記：サプリ不要 ！ダウンロードしたzipは解凍せずそのままココフォリアの部屋に入れてください。 ！PC背景の白いパネルが表示され...

Malware operators are hiding code inside the part of a 7-Zip installer that unpacks files. A seemingly ordinary installation can start while a concealed loader contacts an attacker-controlled server. Users and analysts may overlook that step because it usually does nothing more than prepare the visible installation. The samples belong to OpenSUpdater, previously linked to certificate tricks. Attackers put a genuine foobar2000 installer inside a self-extracting archive, making the package look useful. That credible interior is part of the deception: the familiar software is not necessarily where the harmful behavior begins. Unlike fake archive utility download sites , the danger here sits in the extraction code itself. Analysts at G Data Software identified the altered component, while ESET detects recent samples as OpenSUpdater, while Microsoft uses the name Snackarcin. G Data Software said in a report shared with Cyber Security News (CSN) that attackers had rebuilt open-source installer code to conceal a loader. The research establishes neither infection numbers nor a delivery campaign. Buildup of a 7zip SFX file and its plain text configuration (Source – G Data) Checking only the contained program may miss code that runs first. A valid digital signature also does not settle whether the whole package is safe, particularly when the signed publisher has little apparent connection to the bundled program. A familiar wrapper can hide a downloader and an unknown payload. Hackers Hide Malware Inside 7-Zip Installers A 7-Zip self-extracting installer unpacks an archive and launches a chosen file. Analysts usually check that chosen file and the installer’s configuration first. Here, both distract from the altered extraction program. That program normally looks standard enough for an analyst to set it aside. The attackers rebuilt the open-source extraction component and inserted a call to their loader just before the installation progress bar begins. Its starting point, text and imported functions resemble an ordinary component. A quick review may miss the tampering because the added call sits in the middle of a normal extraction routine, not at its obvious entry point. The archive contains a real audio-player installer. Its signer, however, is Animated Productions, LLC, which the researchers noted presents itself as a game-app developer. That mismatch raises suspicion. As with signed installers carrying hidden malware , a valid signature can make an unfamiliar package appear more reassuring than it deserves. Insertion point of the loader in ExtractArchive() of 7zip SFX stub (Source – G Data) The certificate contains repeated padding bytes, while version details resemble unrelated words. Researchers suggested the padding might change a build’s hash without invalidating its signature, but did not confirm the reason. These oddities are clues, not proof. This is not a flaw in every 7-Zip archive. It is a deliberately modified installer component paired with a legitimate program. Checking only extracted files could miss attacker-added instructions. Downloader and Related Installer Variants The hidden code retrieves an obscured server address and registers using a distinctive byte sequence. A built-in network library then downloads two DLL components and an encrypted data blob. Operators can then supply further code. The loader runs a function in the first downloaded component, then a function in the second to decrypt the blob. It loads the resulting DLL into memory and calls another function that researchers believe starts the final payload. They could not obtain those components, leaving the payload’s behavior unverified. In an NSIS variant, attackers changed an open-source NSIS plugin so its loader runs only when a particular function receives an empty string. Its script stores the server location in compressed form and requests a payload. Earlier trojanized NSIS installer investigations show why the packaging deserves close inspection, although these campaigns differ. Across the samples, the shared features are a real installer nested inside another installer, a padded but valid certificate, and a loader tucked into modified open-source code. This differs from other malicious 7-Zip archive campaigns , which used a separate Windows warning-bypass flaw. The distinction matters for investigation. For analysts, G Data Software recommends staying with suspicious files even when the obvious program looks clean. An installer inside another installer, strange version details or an unusually padded certificate should prompt inspection of less obvious code paths. Indicators of compromise (IoCs):- Type Indicator Description SHA-256 a7666e5aa3c6ecae0295caa7c3f49714eb561d6e1be6807cf1020b79f1902cd0 7-Zip self-extracting sample . SHA-256 e99a053b9d6a414256177e1529417f85867d6ed355f6009300d626f63429753c 7-Zip self-extracting sample . SHA-256 ba38916e82c47cff6de71791f179ce762e640e2975e40d6a1803d16ff591b752 Related NSIS sample . C2 URL hxxps://codeonicinc(dot)com Address associated with samples and , preserved in the source’s defanged format. C2 URL hxxps://setupsoftwarecenter(dot)com Address associated with sample , preserved in the source’s defanged format. File name setup.exe Genuine foobar2000 installer embedded in samples and ; not identified as the malicious loader. Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC The post Hackers Hide Malware Inside 7-Zip Installers Using a New Evasion Technique appeared first on Cyber Security News .

マルウェアファミリー「OpenSUpdater」の攻撃者は、再コンパイルした7-Zip自己展開（SFX）アーカイブのコンポーネント内にリフレクティブローダーを隠しています。これにより、悪意あるコードは一見正規のインストーラーに紛れ込み、従来のトリアージをすり抜けます。 攻撃者は、悪意ある実行ファイルを埋め込むだけにと

7" (178mm) Heel 2 3/4" (70mm) Platform Two Tone Lace-Up Front Ankle Boot Quadruple Cone-Studded Buckle Straps Inner Side Zip Closure Unleash your inner fashionista with the Adore-1046TT ankle boots. T...

YouTube video by thedubber7