11:11 p.m.
On Thu, Jan 17, 2013 at 1:49 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
MHL,
I've tried sending twice, 2nd time passworded. Rejected both times. I've not
seen anything on the Vol-list either. May be a size problem.
----
Reporting-MTA: dns;snt0-omc2-s18.snt0.hotmail.com
Received-From-MTA: dns;SNT118-W46
Arrival-Date: Thu, 17 Jan 2013 12:18:41 -0800
Final-Recipient: rfc822;michael.hale(a)gmail.com
Action: failed
Status: 5.5.0
Diagnostic-Code: smtp;552-5.7.0 Our system detected an illegal attachment on
your message. Please
552-5.7.0 visit http://support.google.com/mail/bin/answer.py?answer=6590 to
552 5.7.0 review our attachment guidelines. m1si2744262obl.114
Gmail does pretty deep inspection of attachments, in this case
noticing a .exe file in the header of the ZIP archive:
$ zipinfo Rocra_svchost-exe_464_exe-dump.zip
Archive: Rocra_svchost-exe_464_exe-dump.zip 29582 bytes 2 files
-rwxa-- 2.0 fat 60928 Bl defN 16-Jan-13 14:44 svchost_executable.464.exe
-rw-a-- 2.0 fat 10543 Tl defN 16-Jan-13 14:46
130115b.w32_suspect_PID_464_volatility20_info.txt
2 files, 71471 bytes uncompressed, 29202 bytes compressed: 59.1%
I tend to strip extensions and send in encrypted zips when dealing
with Google services. Fantastic for everything except threat sharing.
:)
--
Darren Spruell
phatbuckett(a)gmail.com
11:14 p.m.
New subject: [OT} ZIPs (was: Re: IAT hook question)
On Thu, Jan 17, 2013 at 9:11 PM, Darren Spruell <phatbuckett(a)gmail.com> wrote:
I tend to strip extensions and send in encrypted zips
when dealing
with Google services. Fantastic for everything except threat sharing.
7z -mhe for the win.
12:02 p.m.
New subject: [OT} ZIPs (was: Re: IAT hook question)
Being a WinRAR user, I don't have 7z.
What do the -mhe option do?
Thanks
Date: Thu, 17 Jan 2013 21:14:43 -0700
Subject: Re: [OT} ZIPs (was: Re: [Vol-users] IAT hook question)
From: aoz.syn(a)gmail.com
To: phatbuckett(a)gmail.com
CC: dragonforen(a)hotmail.com; vol-users(a)volatilityfoundation.org
On Thu, Jan 17, 2013 at 9:11 PM, Darren Spruell <phatbuckett(a)gmail.com> wrote:
I tend to strip extensions and send in encrypted
zips when dealing
with Google services. Fantastic for everything except threat sharing.
7z -mhe for the win. 
12:10 p.m.
New subject: [OT} ZIPs (was: Re: IAT hook question)
I have also found if you change the file extension on a zip file to .txt,
you'll fool Gmail into thinking it's a text file. The receiving party just
has to change the extension back to zip and all is well. I've sent a number
of zips containing malware or other exe's that way successfully.
Ken Pryor
On Fri, Jan 18, 2013 at 11:02 AM, Mike Lambert <dragonforen(a)hotmail.com>wrote:
Being a WinRAR user, I don't have 7z.
What do the -mhe option do?
Thanks
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
Date: Thu, 17 Jan 2013 21:14:43 -0700
Subject: Re: [OT} ZIPs (was: Re: [Vol-users] IAT hook question)
From: aoz.syn(a)gmail.com
To: phatbuckett(a)gmail.com
CC: dragonforen(a)hotmail.com; vol-users(a)volatilityfoundation.org
On Thu, Jan 17, 2013 at 9:11 PM, Darren Spruell <phatbuckett(a)gmail.com>
wrote:
I tend to
strip extensions and send in encrypted zips when dealing
with Google services. Fantastic for everything except threat sharing.
7z -mhe for the win.
2:34 p.m.
New subject: [OT} ZIPs (was: Re: IAT hook question)
On Fri, Jan 18, 2013 at 10:02 AM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
Being a WinRAR user, I don't have 7z.
What do the -mhe option do?
In 7z (the CLI verson) "-mhe=on" means "encrypt headers", that is -
encrypt the file listing inside the archive. The GUI version does it
as well but I don't recall what the checkbox is. 7-zip does RAR too,
and is free.
noon
New subject: [OT} ZIPs (was: Re: IAT hook question)
Hi Darren!
I think I'll have to start doing that.
Thanks,
Mike
Date: Thu, 17 Jan 2013 21:11:11 -0700
Subject: [OT} ZIPs (was: Re: [Vol-users] IAT hook question)
From: phatbuckett(a)gmail.com
To: dragonforen(a)hotmail.com
CC: vol-users(a)volatilityfoundation.org; michael.hale(a)gmail.com
On Thu, Jan 17, 2013 at 1:49 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
MHL,
I've tried sending twice, 2nd time passworded. Rejected both times. I've not
seen anything on the Vol-list either. May be a size problem.
----
Reporting-MTA: dns;snt0-omc2-s18.snt0.hotmail.com
Received-From-MTA: dns;SNT118-W46
Arrival-Date: Thu, 17 Jan 2013 12:18:41 -0800
Final-Recipient: rfc822;michael.hale(a)gmail.com
Action: failed
Status: 5.5.0
Diagnostic-Code: smtp;552-5.7.0 Our system detected an illegal attachment on
your message. Please
552-5.7.0 visit http://support.google.com/mail/bin/answer.py?answer=6590 to
552 5.7.0 review our attachment guidelines. m1si2744262obl.114
Gmail does pretty deep inspection of attachments, in this case
noticing a .exe file in the header of the ZIP archive:
$ zipinfo Rocra_svchost-exe_464_exe-dump.zip
Archive: Rocra_svchost-exe_464_exe-dump.zip 29582 bytes 2 files
-rwxa-- 2.0 fat 60928 Bl defN 16-Jan-13 14:44 svchost_executable.464.exe
-rw-a-- 2.0 fat 10543 Tl defN 16-Jan-13 14:46
130115b.w32_suspect_PID_464_volatility20_info.txt
2 files, 71471 bytes uncompressed, 29202 bytes compressed: 59.1%
I tend to strip extensions and send in encrypted zips when dealing
with Google services. Fantastic for everything except threat sharing.
:)
--
Darren Spruell
phatbuckett(a)gmail.com
4318
days inactive
4318
days old
vol-users@lists.volatilityfoundation.org
5 comments
4 participants
participants (4)
-
Darren Spruell -
Ken Pryor -
Mike Lambert -
RB