sorry about that, it was me, it is encrypted and actually says, Ph3Ar M3 f0r 1 am 733t.

and then starts a britney spears mp3 stream.

 

 

blah, blah, blah, blah...

Ive thrown it in a decryption algorithm but I really dont feel like waiting days for this to find the key...

 

sorry about that, it was me, it is encrypted and actually says, Ph3Ar M3 f0r 1 am 733t.

and then starts a britney spears mp3 stream.

lol

 

Where are you getting encryption? If someone sent you something encrypted then you could not execute it without the proper key to decrypt the cypher.

All that stuff is the code for the demo.exe not cyphertext.

I tried cut and pasting the code into notepad and saving as demo.exe then running thru the latest norton av and it didn't come up with anything. That might be due to the formating that was done on the text you posted.

Mime types are just a specification.

http://www.iana.org/assignments/media-types/


If I had to bet its probably some sort of keylogger or remote admin/control trojan.

I got this in email. I think they tried to pipe an .exe through mime. OR, this is an encrypted message. Anybody recognize the cryption??

<--BEGIN-->
Here is the archive with those information, you asked me.
And don't forget, it is strongly confidencial!!!
Seya, man.

P.S. Don't forget my fee
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0001_0636F877.AB43B646"
X-Priority: 3
X-MSMail-Priority: Normal

This is a multi-part message in MIME format.

------=_NextPart_000_0001_0636F877.AB43B646
Content-Type: text/plain;
charset="windows-1252"
Content-Transfer-Encoding: 7bit

RE: order


------=_NextPart_000_0001_0636F877.AB43B646
Content-Type: application/x-msdownload; name="demo.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="demo.exe"

 

Where are you getting encryption? If someone sent you something encrypted then you could not execute it without the proper key to decrypt the cypher.

All that stuff is the code for the demo.exe not cyphertext.

I tried cut and pasting the code into notepad and saving as demo.exe then running thru the latest norton av and it didn't come up with anything. That might be due to the formating that was done on the text you posted.

Mime types are just a specification.

http://www.iana.org/assignments/media-types/


If I had to bet its probably some sort of keylogger or remote admin/control trojan.

I got this in email. I think they tried to pipe an .exe through mime. OR, this is an encrypted message. Anybody recognize the cryption??

<--BEGIN-->
Here is the archive with those information, you asked me.
And don't forget, it is strongly confidencial!!!
Seya, man.

P.S. Don't forget my fee
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0001_0636F877.AB43B646"
X-Priority: 3
X-MSMail-Priority: Normal

This is a multi-part message in MIME format.

------=_NextPart_000_0001_0636F877.AB43B646
Content-Type: text/plain;
charset="windows-1252"
Content-Transfer-Encoding: 7bit

RE: order


------=_NextPart_000_0001_0636F877.AB43B646
Content-Type: application/x-msdownload; name="demo.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="demo.exe"

Yea, I didnt think it was cyper text, but sometimes my friends like to play jokes. And if you paste it into notepad, you wont be able to save it as an exe. You will have to try edit.com... Since its already in machine code, theres not sense in trying to re-compile it. Really the only way is to de-compile it and read the source, in which of course Im too lazy to do so.

 

Its the Plexus.A worm.

 

That's an .exe file encoded in base64. Base64 is a way to represent a binary file using only ascii text. Even though you think you are sending binary data it has to be converted into a plain text format to flow across email.

Technically, it's a way to encode 3 binary bytes into 4 ascii displayable character bytes. A byte has 8 bits which can represent values from 0 thru 255. 3 bytes is 24 bits. The 24 bits are split into 4 groups of 6 bits. 6 bits can represent values from 0 to 63. The value 0 is assigned an ascii character of "A", 1 gets a "B", and so on through "Z". Then it starts with "a" thru "z", "1" thru "9", and finally "+" & "/". So binary 3 bytes in = 4 ascii characters (bytes) out. It's called base 64 since there are 64 possible characters in the alphabet using 6 bits.

At the receiving end the 4 ascii characters (bytes) are processed in reverse fashion and the original 3 binary bytes result.

Looks like an ordinary MIME format e-mail with a virus attached to me.

 

That's an .exe file encoded in base64. Base64 is a way to represent a binary file using only ascii text. Even though you think you are sending binary data it has to be converted into a plain text format to flow across email.

Technically, it's a way to encode 3 binary bytes into 4 ascii displayable character bytes. A byte has 8 bits which can represent values from 0 thru 255. 3 bytes is 24 bits. The 24 bits are split into 4 groups of 6 bits. 6 bits can represent values from 0 to 63. The value 0 is assigned an ascii character of "A", 1 gets a "B", and so on through "Z". Then it starts with "a" thru "z", "1" thru "9", and finally "+" & "/". So binary 3 bytes in = 4 ascii characters (bytes) out. It's called base 64 since there are 64 possible characters in the alphabet using 6 bits.

At the receiving end the 4 ascii characters (bytes) are processed in reverse fashion and the original 3 binary bytes result.

Looks like an ordinary MIME format e-mail with a virus attached to me.

i knew that.

 

i knew that.

lmao, yeah, who didnt?